django-pymodsecurity

This is a work-in-progress. Do not use in production

This middleware adds the modsecurity capabilities to the django framework.

Dependencies

• pymodsecurity >= 0.0.4
• django >= 2.1.2

HOWTO

Install the middleware in your django settings module. It's highly recommended to install at the first position, so all requests and responses can be approved by modsecurity.

MIDDLEWARE = [
  > 'django_pymodsecurity.middleware.PyModSecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    ...
]

Settings

Valid settings you can define in your settings django module

MODSECURITY_RULE_FILES

You can specify a list of rule set to be imported (For example owasp top10).

It accepts a list of files or glob-like patterns

MODSECURITY_RULE_FILES = [
    '/data/config-logs.conf',
    '/data/owasp/*.conf'
]

MODSECURITY_RULES

You can also define rules directly to be loaded into modsecurity. It can be a list of strings or a single string

MODSECURITY_RULES = [
    'SecRuleEngine DetectionOnly',
    'SecRule REMOTE_ADDR "@ipMatch 127.0.0.1" "phase:0,allow,id:161"'
]

MODSECURITY_RULES = '''
SecRuleEngine DetectionOnly
SecRule REMOTE_ADDR "@ipMatch 127.0.0.1" "phase:0,allow,id:161"
'''

License

MIT License