Web Application Defender's Cookbook

Recipe 14-9: Temporarily Locking Account Access

This recipe shows you how to use ModSecurity to temporarily disallow access to application accounts.

Ingredients

• ModSecurity
  • setuid action
  • setvar action
  • expirevar action

If you have configured ModSecurity to track application users with the setuid action, as outlined in Recipe 7-7, you can take action on individual users. Let’s assume that your login page sends this data within the username parameter. We can update our rules to use the setuid action when this data is present:

SecRule ARGS:username ".*" "phase:3,id:'981075',t:none,pass,nolog,
noauditlog,capture,
setvar:session.username=%{TX.0},setuid:%{TX.0},
setvar:user.username=%{TX.0}"

This ruleset accesses the USER persistent storage collection during the current transaction and also saves this information in the SESSION storage collection. With this association, after login, we can still track the username with the SessionID value using the following rule:

SecRule REQUEST_COOKIES:'/(?i:([a-z0-9]{32}))/' ".*" "chain,phase:1,
id:'981054',t:none,pass,nolog,capture,setsid:%{TX.0}"
        SecRule SESSION:USERNAME ".*" "capture,setuid:%{TX.0},
setvar:user.username=%{TX.0}"

When a user logs in to the application, the following USER persistent storage is created:

Rule 1009c0200: SecRule "ARGS:username" "@rx .*" "phase:3,id:999075, t:none,pass,nolog,noauditlog,capture, setvar:session.username=%{TX.0},setuid:%{TX.0}, setvar:user.username=%{TX.0}" Transformation completed in 1 usec. ...