Graham McIntire
5e9032314b
Created 30+ security rules to protect against common web attacks: Protection categories: - SQL injection (UNION, OR/AND, comments) - XSS (script tags, event handlers) - Path traversal (directory traversal, absolute paths) - Common exploits (WordPress, PHPMyAdmin, admin panels) - Malicious bots (scanners, scrapers, empty user agents) - Shell injection (commands, ShellShock) - File upload exploits (PHP, double extensions) - Information disclosure (.git, .env, backups, configs) - Protocol attacks (HTTP/0.9, TRACE, TRACK) - Known CVEs (Log4Shell, SSRF, XXE) Features: - Allowlist for legitimate traffic (health checks, agents, monitoring) - Detailed documentation with examples - Testing and troubleshooting guides - Performance impact analysis - Compliance mapping (OWASP, PCI DSS, SOC 2) Documentation: docs/PANGOLIN_SECURITY.md Configuration: pangolin-security-rules.toml
285 lines
7.8 KiB
TOML
285 lines
7.8 KiB
TOML
# Pangolin Security Rules for Towerops
|
|
# Block common web attacks and malicious traffic
|
|
#
|
|
# Apply these rules to your Pangolin configuration to filter traffic before
|
|
# it reaches your application server.
|
|
#
|
|
# Documentation: https://docs.pangolin.net/
|
|
|
|
# ============================================================================
|
|
# SQL Injection Attempts
|
|
# ============================================================================
|
|
|
|
[[rules]]
|
|
name = "Block SQL Injection - UNION"
|
|
match.url.regex = "(?i)(union.*(all|select)|select.*from.*information_schema)"
|
|
action = "block"
|
|
log = true
|
|
|
|
[[rules]]
|
|
name = "Block SQL Injection - Common Patterns"
|
|
match.url.regex = "(?i)(\\bor\\b.*=.*|\\band\\b.*=.*|'.*or.*'|\".*or.*\"|;.*drop|;.*delete|;.*insert|;.*update)"
|
|
action = "block"
|
|
log = true
|
|
|
|
[[rules]]
|
|
name = "Block SQL Injection - Comments"
|
|
match.url.regex = "(?i)(/\\*.*\\*/|--.*$|#.*$)"
|
|
action = "block"
|
|
log = true
|
|
|
|
# ============================================================================
|
|
# Cross-Site Scripting (XSS)
|
|
# ============================================================================
|
|
|
|
[[rules]]
|
|
name = "Block XSS - Script Tags"
|
|
match.url.regex = "(?i)(<script|</script|javascript:|onerror=|onload=)"
|
|
action = "block"
|
|
log = true
|
|
|
|
[[rules]]
|
|
name = "Block XSS - Event Handlers"
|
|
match.url.regex = "(?i)(onclick|ondblclick|onmouseover|onmouseout|onkeydown|onkeyup|onchange|onsubmit|onfocus|onblur)\\s*="
|
|
action = "block"
|
|
log = true
|
|
|
|
# ============================================================================
|
|
# Path Traversal
|
|
# ============================================================================
|
|
|
|
[[rules]]
|
|
name = "Block Path Traversal - Directory Traversal"
|
|
match.url.regex = "(\\.\\./|\\.\\.\\\\/|%2e%2e%2f|%2e%2e/|..%2f|%2e%2e%5c)"
|
|
action = "block"
|
|
log = true
|
|
|
|
[[rules]]
|
|
name = "Block Path Traversal - Absolute Paths"
|
|
match.url.regex = "(?i)(^/etc/|^/proc/|^/sys/|^/var/|^/usr/|^/bin/|^/sbin/|c:\\\\|c:/)"
|
|
action = "block"
|
|
log = true
|
|
|
|
# ============================================================================
|
|
# Common Exploit Paths (WordPress, PHPMyAdmin, etc.)
|
|
# ============================================================================
|
|
|
|
[[rules]]
|
|
name = "Block WordPress Admin"
|
|
match.url.path = "/wp-admin"
|
|
action = "block"
|
|
log = true
|
|
|
|
[[rules]]
|
|
name = "Block WordPress Login"
|
|
match.url.path = "/wp-login.php"
|
|
action = "block"
|
|
log = true
|
|
|
|
[[rules]]
|
|
name = "Block WordPress XML-RPC"
|
|
match.url.path = "/xmlrpc.php"
|
|
action = "block"
|
|
log = true
|
|
|
|
[[rules]]
|
|
name = "Block PHPMyAdmin"
|
|
match.url.regex = "(?i)/(phpmyadmin|pma|myadmin|mysql|phpmy|sqladmin)"
|
|
action = "block"
|
|
log = true
|
|
|
|
[[rules]]
|
|
name = "Block Common Admin Panels"
|
|
match.url.regex = "(?i)/(admin|administrator|cpanel|webmail|plesk|directadmin|phppgadmin)"
|
|
action = "block"
|
|
log = true
|
|
|
|
# ============================================================================
|
|
# Malicious Bots and Scanners
|
|
# ============================================================================
|
|
|
|
[[rules]]
|
|
name = "Block Vulnerability Scanners"
|
|
match.headers."User-Agent".regex = "(?i)(nikto|nessus|nmap|masscan|zap|burp|sqlmap|metasploit|acunetix|w3af|havij)"
|
|
action = "block"
|
|
log = true
|
|
|
|
[[rules]]
|
|
name = "Block Scrapers and Crawlers"
|
|
match.headers."User-Agent".regex = "(?i)(scrapy|webcopier|httrack|teleport|wget|curl.*bot|python-requests.*bot)"
|
|
action = "block"
|
|
log = false
|
|
|
|
[[rules]]
|
|
name = "Block Empty User Agent"
|
|
match.headers."User-Agent".exact = ""
|
|
action = "block"
|
|
log = false
|
|
|
|
# ============================================================================
|
|
# Shell Injection Attempts
|
|
# ============================================================================
|
|
|
|
[[rules]]
|
|
name = "Block Shell Commands"
|
|
match.url.regex = "(?i)(\\|.*ls|\\|.*cat|\\|.*wget|\\|.*curl|;.*ls|;.*cat|;.*wget|;.*curl|`.*`|\\$\\(.*\\))"
|
|
action = "block"
|
|
log = true
|
|
|
|
[[rules]]
|
|
name = "Block Shell Shock"
|
|
match.headers.regex = "(?i)\\(\\)\\s*\\{.*\\}"
|
|
action = "block"
|
|
log = true
|
|
|
|
# ============================================================================
|
|
# File Upload Exploits
|
|
# ============================================================================
|
|
|
|
[[rules]]
|
|
name = "Block Malicious File Extensions"
|
|
match.url.regex = "(?i)\\.(php\\d?|phtml|asp|aspx|jsp|cgi|pl|sh|bash|exe|dll|com|bat)\\.?"
|
|
action = "block"
|
|
log = true
|
|
|
|
[[rules]]
|
|
name = "Block Double Extensions"
|
|
match.url.regex = "(?i)\\.(jpg|jpeg|png|gif|pdf|doc|docx)\\.php"
|
|
action = "block"
|
|
log = true
|
|
|
|
# ============================================================================
|
|
# Information Disclosure
|
|
# ============================================================================
|
|
|
|
[[rules]]
|
|
name = "Block Git Directory"
|
|
match.url.path_prefix = "/.git"
|
|
action = "block"
|
|
log = true
|
|
|
|
[[rules]]
|
|
name = "Block SVN Directory"
|
|
match.url.path_prefix = "/.svn"
|
|
action = "block"
|
|
log = true
|
|
|
|
[[rules]]
|
|
name = "Block Environment Files"
|
|
match.url.regex = "(?i)/\\.env(\\..*)?$"
|
|
action = "block"
|
|
log = true
|
|
|
|
[[rules]]
|
|
name = "Block Backup Files"
|
|
match.url.regex = "(?i)\\.(bak|backup|old|orig|save|swp|swo|~)$"
|
|
action = "block"
|
|
log = true
|
|
|
|
[[rules]]
|
|
name = "Block Config Files"
|
|
match.url.regex = "(?i)/(config|configuration|settings)\\.(php|xml|json|yml|yaml|ini|conf)$"
|
|
action = "block"
|
|
log = true
|
|
|
|
# ============================================================================
|
|
# Protocol and Method Attacks
|
|
# ============================================================================
|
|
|
|
[[rules]]
|
|
name = "Block HTTP/0.9"
|
|
match.http_version = "0.9"
|
|
action = "block"
|
|
log = false
|
|
|
|
[[rules]]
|
|
name = "Block TRACE Method"
|
|
match.method = "TRACE"
|
|
action = "block"
|
|
log = true
|
|
|
|
[[rules]]
|
|
name = "Block TRACK Method"
|
|
match.method = "TRACK"
|
|
action = "block"
|
|
log = true
|
|
|
|
# ============================================================================
|
|
# Known Exploit Patterns
|
|
# ============================================================================
|
|
|
|
[[rules]]
|
|
name = "Block Log4Shell"
|
|
match.headers.regex = "(?i)\\$\\{jndi:(ldap|rmi|dns)://"
|
|
action = "block"
|
|
log = true
|
|
|
|
[[rules]]
|
|
name = "Block Server-Side Request Forgery (SSRF)"
|
|
match.url.regex = "(?i)(localhost|127\\.0\\.0\\.1|0\\.0\\.0\\.0|\\[::1\\]|169\\.254\\.|192\\.168\\.|10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.)"
|
|
action = "block"
|
|
log = true
|
|
|
|
[[rules]]
|
|
name = "Block XXE (XML External Entity)"
|
|
match.body.regex = "(?i)<!entity.*system"
|
|
action = "block"
|
|
log = true
|
|
|
|
# ============================================================================
|
|
# Rate Limiting (requires Pangolin Pro)
|
|
# ============================================================================
|
|
|
|
# Uncomment if you have Pangolin Pro with rate limiting
|
|
# [[rules]]
|
|
# name = "Rate Limit - General"
|
|
# match.all = true
|
|
# action = "rate_limit"
|
|
# rate_limit.requests = 100
|
|
# rate_limit.window = "1m"
|
|
# rate_limit.by = "ip"
|
|
|
|
# [[rules]]
|
|
# name = "Rate Limit - Login Endpoints"
|
|
# match.url.regex = "(?i)/(login|signin|session|auth)"
|
|
# action = "rate_limit"
|
|
# rate_limit.requests = 10
|
|
# rate_limit.window = "1m"
|
|
# rate_limit.by = "ip"
|
|
|
|
# ============================================================================
|
|
# Geo-Blocking (optional)
|
|
# ============================================================================
|
|
|
|
# Block traffic from specific countries if needed
|
|
# [[rules]]
|
|
# name = "Block Countries"
|
|
# match.geo.country_code = ["CN", "RU", "KP"]
|
|
# action = "block"
|
|
# log = false
|
|
|
|
# ============================================================================
|
|
# Allowlist for Legitimate Traffic
|
|
# ============================================================================
|
|
|
|
# Always allow health checks
|
|
[[rules]]
|
|
name = "Allow Health Checks"
|
|
match.url.path = "/health"
|
|
action = "allow"
|
|
priority = 1000
|
|
|
|
# Allow legitimate API endpoints
|
|
[[rules]]
|
|
name = "Allow API v1"
|
|
match.url.path_prefix = "/api/v1"
|
|
match.headers."User-Agent".regex = "towerops-agent"
|
|
action = "allow"
|
|
priority = 1000
|
|
|
|
# Allow legitimate user agents from monitoring
|
|
[[rules]]
|
|
name = "Allow Monitoring Services"
|
|
match.headers."User-Agent".regex = "(?i)(uptimerobot|pingdom|statuspage|datadog)"
|
|
action = "allow"
|
|
priority = 1000
|