Web Application Defender's Cookbook

Recipe 4-1: Analyzing the Client’s Geographic Location Data

This recipe demonstrates how to use the MaxMind GeoIP database data to identify a client’s geographic location.

Ingredients

• MaxMind’s GeoLite City Database1
• ModSecurity
  • SecGeoLookupDb directive
  • @geoLookup action
  • GEO variables

You can download and unpack the GeoLite City binary database archive file by using the following UNIX commands:

# pwd
/usr/local/apache/conf
# wget http://geolite.maxmind.com/download/geoip/database/
GeoLiteCity.dat.gz
--2012-02-05 12:12:02—
http://geolite.maxmind.com/download/geoip/database/
GeoLiteCity.dat.gz
Resolving geolite.maxmind.com (geolite.maxmind.com)... 
174.36.207.186
Connecting to geolite.maxmind.com (geolite.maxmind.com)|
174.36.207.186|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 18312422 (17M) [text/plain]
Saving to: "GeoLiteCity.dat.gz"
 
100%[===============================================================
=======================================>] 18,312,422  2.18M/s   
in 9.1s
 
2012-02-05 12:12:11 (1.92 MB/s) - "GeoLiteCity.dat.gz" saved 
[18312422/18312422]
 
# gunzip GeoLiteCity.dat.gz

To utilize the GeoIP data within ModSecurity, you must import it with the SecGeoLookupDb directive. After the SecGeoLookupDb directive is configured, you need to create a ModSecurity rule that passes the client’s IP address (REMOTE_ADDR variable) to the ModSecurity @geoLookup operator:

SecGeoLookupDb /usr/local/apache/conf/GeoLiteCity.dat SecRule REMOTE_ADDR "@geoLookup" ...