ModSec @rbl Operator

Discussion in 'Bug Reports' started by Private, Sep 25, 2013.

  1. Private

    Private New Member

    Hello,

    I want to block IPs in RBL blacklist. I tried below modsec rules from OWASP.

    Code:
    SecRule IP:PREVIOUS_RBL_CHECK "@eq 1" "phase:1,id:'981137',t:none,pass,nolog,skipAfter:END_RBL_LOOKUP"
      SecRule REMOTE_ADDR "@rbl sbl-xbl.spamhaus.org" "phase:1,id:'981138',t:none,pass,nolog,auditlog,msg:'RBL Match for SPAM Source',tag:'AUTOMATION/MALICIOUS',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.automation_score=+%{tx.warning_anomaly_score},setvar:tx.anomaly_score=+%{tx.warning_anomaly_score},setvar:tx.%{rule.id}-AUTOMATION/MALICIOUS-%{matched_var_name}=%{matched_var},setvar:ip.spammer=1,expirevar:ip.spammer=86400,setvar:ip.previous_rbl_check=1,expirevar:ip.previous_rbl_check=86400,skipAfter:END_RBL_CHECK"
    
      SecAction "phase:1,id:'981139',t:none,nolog,pass,setvar:ip.previous_rbl_check=1,expirevar:ip.previous_rbl_check=86400"
    SecMarker END_RBL_LOOKUP
    
    SecRule IP:SPAMMER "@eq 1" "phase:1,id:'981140',t:none,pass,nolog,auditlog,msg:'Request from Known SPAM Source (Previous RBL Match)',tag:'AUTOMATION/MALICIOUS',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.automation_score=+%{tx.warning_anomaly_score},setvar:tx.anomaly_score=+%{tx.warning_anomaly_score},setvar:tx.%{rule.id}-AUTOMATION/MALICIOUS-%{matched_var_name}=%{matched_var}"
    
    SecMarker END_RBL_CHECK
    It didn't work. I tested with LiteSpeed 4.2.2 and 4.2.4. Does LiteSpeed support @rbl operator?
  2. mistwang

    mistwang LiteSpeed Staff

    No LiteSpeed does not support @rbl, it is very hard to do for a non-blocking event-driven server as it need to query a server on the network.
  3. Private

    Private New Member

    Is @inspectFile supported?

    Any features for @rbl replacement?
  4. NiteWave

    NiteWave Administrator

Share This Page