OWASP CRS is a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls. ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.

Stable Tags are composed of:

• CRS version, in the format <major>[.<minor>[.<patch]]
• web server variant
• OS variant (optional)
• date, in the format YYYYMMDDHHMM

The stable tag format is <CRS version>-<web server>[-<os>]-<date>. Examples:

• 4-nginx-202401121309
• 4.0-apache-alpine-202401121309
• 4.0.0-openresty-alpine-fat-202401121309

Rolling tags are updated whenever a new stable tag release occurs. Rolling tags can be practical but should not be used in production.

Rolling Tags are composed of:

• web server variant
• OS variant (optional)

The stable tag format is <web server>[-<os>]. Examples:

• nginx
• apache-alpine
• openresty-alpine-fat

• nginx – latest stable ModSecurity v3 on Nginx 1.27.2 official stable base image, and latest stable OWASP CRS 4.8.0
  • nginx
  • nginx-alpine
• Openresty - last stable ModSecurity v3 on OpenResty 1.25.3.1 official stable base image, and latest stable OWASP CRS 4.8.0
  • openresty-alpine-fat
• Apache httpd – last stable ModSecurity v2 on Apache 2.4.62 official stable base image, and latest stable OWASP CRS 4.8.0
  • apache
  • apache-alpine

We currently only provide a version of the Openresty image based on Alpine Linux. The Dockerfile for Openresty resides in the docker-openresty repository.

Our builds are based on the official Apache httpd, nginx and Openresty images, which means we can only support the architectures they support.

We currently provide images for the following architectures:

• linux/amd64
• linux/arm/v7
• linux/arm64/v8
• linux/i386

We require a version of buildx >= v0.9.1. Visit the official documentation for instructions on installing and upgrading buildx. You can check which version you have using:

docker buildx version
github.com/docker/buildx v0.9.1 ed00243a0ce2a0aee75311b06e32d33b44729689

If you want to see the targets of the build, use:

docker buildx bake -f ./docker-bake.hcl --print

To build for any platforms of your choosing, just use this example:

docker buildx create --use --platform linux/amd64,linux/i386,linux/arm64,linux/arm/v7
docker buildx bake -f docker-bake.hcl

To build a specific target for a single platform only (replace target and platform strings in the example with the your choices):

docker buildx bake -f docker-bake.hcl --set "*.platform=linux/amd64" nginx-alpine

Openresty image builds currently support only these architectures:

• linux/amd64
• linux/arm64

🆕 We add healthchecks to the images, so that containers return HTTP status code 200 from the /healthz endpoint. When a container has a healthcheck specified, it has a health status in addition to its normal status. This status is initially starting. Whenever a health check passes, it becomes healthy (whatever state it was previously in). After a certain number of consecutive failures, it becomes unhealthy. See https://docs.docker.com/engine/reference/builder/#healthcheck for more information.

Hey, I used some specific git version with the containers? What happened?

You can achieve the same results just by getting any version you want, and using docker volumes. See this example:

git clone https://github.com/coreruleset/coreruleset.git myrules
cd myrules
git checkout ac2a0d1
docker run -p 8080:8080 -ti -e PARANOIA=4 -v rules:/opt/owasp-crs/rules:ro --rm owasp/modsecurity-crs

• Where to get help: the OWASP CRS container repo, the OWASP CRS Slack channel (#coreruleset on owasp.slack.com), or Stack Overflow

• Where to file issues: the OWASP CRS container repo

• Maintained By: The CRS project maintainers

ModSecurity is an open source, cross platform Web Application Firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis.

If using the Nginx environment variables is not enough for your use case, you can mount your own nginx.conf file as the new template for generating the base config.

An example can be seen in the docker-compose file.

💬 What happens if I want to make changes in a different file, like /etc/nginx/conf.d/default.conf? You mount your local file, e.g. nginx/default.conf as the new template: /etc/nginx/templates/conf.d/default.conf.template. You can do this similarly with other files. Files in the templates directory will be copied and subdirectories will be preserved.

Both nginx and httpd containers now run with an unprivileged user. This means that we cannot bind to ports below 1024, so you might need to correct your PORT and SSL_PORT settings. Now the defaults for both nginx and httpd are 8080 and 8443.

These variables are common to image variants and will set defaults based on the image name.

Openresty uses the same environment variables as the nginx version.

All these variables impact in configuration directives in the modsecurity engine running inside the container. The reference manual has the extended documentation, and for your reference we list the specific directive we change when you modify the ENV variables for the container.

docker build -t my-modsec .
docker run -p 8443:8443 my-modsec

TLS is configured on port 8443 and enabled by default.

We use sane intermediate defaults taken from the Mozilla SSL config tool. Please review the defaults and choose the ones that best match your needs.

You can set the *_ALWAYS_TLS_REDIRECT environment variables to always redirect from http to https.

The owasp/modsecurity-crs container images in their default configuration (i.e., without manual changes to / overrides of configuration files) act as reverse proxies and require a running backend at the address specified through the BACKEND environment variable.

ModSecurity is often used in a reverse proxy setup with the following porperties:

• reverse proxy acts as public end point
• reverse proxy performs TLS termination (necessary for ModSecurity to inspect content)
• ModSecurity runs on the reverse proxy to filter traffic
• only benign traffic is passed to the backend

This allows one to use ModSecurity without modifying the webserver hosting the underlying application and also protects web servers that ModSecurity cannot currently be embedd into.

Tips:

• the application web server (the one receiving traffic from the reverse proxy) should not listen on a public interface. Only the reverse proxy should be exposed to the public. With Docker, this could mean setting up a network for both containers and only exposing the reverse proxy with -p 8080:8080, for example. docker compose takes care of this automatically. See the docker-compose.yaml for an example setup.

docker build -t my-modsec . -f
docker run -p 8080:8080 -e BACKEND=http://example.com my-modsec

It is often convenient to set your server name (set to localhost by default). To do this simply use the SERVER_NAME environment variable.

docker build -t modsec .
docker run -p 8080:8080 -e SERVER_NAME=myhost my-modsec

There are two possible ways to pass ModSecurity CRS tuning rules to the container:

• To map the ModSecurity tuning file(s) via volumes into the container during the run command
• To copy the ModSecurity tuning file(s) into the created container and then start the container

docker run -dti --rm \
   -p 8080:8080 \
   -v /path/to/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf:/etc/modsecurity.d/owasp-crs/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf \
   -v /path/to/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf:/etc/modsecurity.d/owasp-crs/rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf \
   owasp/modsecurity-crs:apache

This example can be helpful when no volume mounts are possible (some CI pipelines).

docker create -ti --name modseccrs \
   -p 8080:8080 \
   owasp/modsecurity-crs:apache

docker cp /path/to/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf \
   modseccrs:/etc/modsecurity.d/owasp-crs/rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf

docker start modseccrs

The following example illustrates how to use docker run with some of the variables. It's purpose is illustration only and it should not be used to run a container in production.

Some important things to note:

• Error and audit logs are enabled and mapped to files on the host, so that their contents are accessible and don't pollute the container filesystem. Docker requires these files to exist, otherwise they would be created as directories, hence the use of the touch ... commands.
• For containers with read-only filesystems, the volumes might have to be specified differently, e.g., using tmpfs. Alternatively, if only one log output is required, the output could be redirected to stdout (/proc/self/fd/2).
• The example expects a backend web server to be running at localhost:8081.

touch /tmp/host-fs-auditlog.log
touch /tmp/host-fs-errorlog.log
docker run \
   -dti \
   -p 8080:8080 \
   --rm \
   -v /tmp/host-fs-auditlog.log:/var/log/modsec_audit.log \
   -v /tmp/host-fs-errorlog.log:/var/log/modsec_error.log \
   -e MODSEC_AUDIT_ENGINE=on \
   -e MODSEC_AUDIT_LOG=/var/log/modsec_audit.log \
   -e LOGLEVEL=warn \
   -e ERRORLOG=/var/log/modsec_error.log \
   -e PARANOIA=1 \
   -e EXECUTING_PARANOIA=2 \
   -e ENFORCE_BODYPROC_URLENCODED=1 \
   -e ANOMALY_INBOUND=10 \
   -e ANOMALY_OUTBOUND=5 \
   -e ALLOWED_METHODS="GET POST PUT" \
   -e ALLOWED_REQUEST_CONTENT_TYPE="text/xml|application/xml|text/plain" \
   -e ALLOWED_REQUEST_CONTENT_TYPE_CHARSET="utf-8|iso-8859-1" \
   -e ALLOWED_HTTP_VERSIONS="HTTP/1.1 HTTP/2 HTTP/2.0" \
   -e RESTRICTED_EXTENSIONS=".cmd/ .com/ .config/ .dll/" \
   -e RESTRICTED_HEADERS="/proxy/ /if/" \
   -e STATIC_EXTENSIONS="/.jpg/ /.jpeg/ /.png/ /.gif/" \
   -e MAX_NUM_ARGS=128 \
   -e ARG_NAME_LENGTH=50 \
   -e ARG_LENGTH=200 \
   -e TOTAL_ARG_LENGTH=6400 \
   -e MAX_FILE_SIZE=100000 \
   -e COMBINED_FILE_SIZES=1000000 \
   -e TIMEOUT=60 \
   -e SERVER_ADMIN=root@localhost \
   -e SERVER_NAME=localhost \
   -e PORT=8080 \
   -e MODSEC_RULE_ENGINE=on \
   -e MODSEC_REQ_BODY_ACCESS=on \
   -e MODSEC_REQ_BODY_LIMIT=13107200 \
   -e MODSEC_REQ_BODY_NOFILES_LIMIT=131072 \
   -e MODSEC_RESP_BODY_ACCESS=on \
   -e MODSEC_RESP_BODY_LIMIT=524288 \
   -e MODSEC_PCRE_MATCH_LIMIT=1000 \
   -e MODSEC_PCRE_MATCH_LIMIT_RECURSION=1000 \
   -e VALIDATE_UTF8_ENCODING=1 \
   -e CRS_ENABLE_TEST_MARKER=1 \
   -e BACKEND="http://localhost:8081" \
   owasp/modsecurity-crs:apache