django-pymodsecurity

This is a work-in-progress. Do not use in production

This middleware adds the modsecurity capabilities to the django framework.

Dependencies

• pymodsecurity >= 0.0.4
• django >= 2.1.2

HOWTO

Install the middleware in your django settings module. It's highly recommended to install at the first position, so all requests and responses can be approved by modsecurity.

MIDDLEWARE= [
>'django_pymodsecurity.middleware.PyModSecurityMiddleware',
'django.contrib.sessions.middleware.SessionMiddleware',
'django.middleware.common.CommonMiddleware',
...
]

Settings

Valid settings you can define in your settings django module

MODSECURITY_RULE_FILES

You can specify a list of rule set to be imported (For example owasp top10).

It accepts a list of files or glob-like patterns

MODSECURITY_RULE_FILES= [
'/data/config-logs.conf',
'/data/owasp/*.conf'
]

MODSECURITY_RULES

You can also define rules directly to be loaded into modsecurity. It can be a list of strings or a single string

MODSECURITY_RULES= [
'SecRuleEngine DetectionOnly',
'SecRule REMOTE_ADDR "@ipMatch 127.0.0.1" "phase:0,allow,id:161"'
]

MODSECURITY_RULES='''SecRuleEngine DetectionOnlySecRule REMOTE_ADDR "@ipMatch 127.0.0.1" "phase:0,allow,id:161"'''

License

MIT License