PageRenderTime 52ms CodeModel.GetById 26ms RepoModel.GetById 1ms app.codeStats 0ms

/doc/topics/web_application_firewall/index.md

http://github.com/gitlabhq/gitlabhq
Markdown | 95 lines | 67 code | 28 blank | 0 comment | 0 complexity | 37139c858deb6691301af8882f82f19b MD5 | raw file
Possible License(s): CC-BY-SA-4.0, Apache-2.0, CC-BY-3.0, CC0-1.0, JSON 
    

  1. # Web Application Firewall - ModSecurity
    2. 

  2. 

  3. A web application firewall (or WAF) filters, monitors, and blocks HTTP traffic to
    4. 

  4. and from a web application. By inspecting HTTP traffic, it can prevent attacks
    5. 

  5. stemming from web application security flaws. It can be used to detect SQL injection,
    6. 

  6. Cross-Site Scripting (XSS), Remote File Inclusion, Security Misconfigurations, and
    7. 

  7. much more.
    8. 

  8. 

  9. ## Overview
    10. 

  10. 

  11. GitLab provides a WAF out of the box after Ingress is deployed.
    12. 

  12. All you need to do is deploy your application along with a service
    13. 

  13. and Ingress resource.
    14. 

  14. 

  15. In GitLab's [Ingress](../../user/clusters/applications.md#ingress) deployment, the [ModSecurity](https://modsecurity.org/) module is loaded
    16. 

  16. into Ingress-NGINX by default and monitors the traffic going to the
    17. 

  17. applications which have an Ingress.
    18. 

  18. 

  19. The ModSecurity module runs with the [OWASP Core Rule Set (CRS)](https://coreruleset.org/) by default. The OWASP CRS will detect and log a wide range of common attacks.
    20. 

  20. 

  21. NOTE: **Note**
    22. 

  22. The WAF is deployed in "Detection-only mode" by default and will only log attack
    23. 

  23. attempts.
    24. 

  24. 

  25. ## Requirements
    26. 

  26. 

  27. The Web Application Firewall requires:
    28. 

  28. 

  29. - **Kubernetes**
    30. 

  30. 

  31.   To enable the WAF, you need:
    32. 

  32. 

  33.   - Kubernetes 1.12+.
    34. 

  34.   - A load balancer. You can use NGINX-Ingress by deploying it to your
    35. 

  35.     Kubernetes cluster by either:
    36. 

  36.     - Using the [`nginx-ingress` Helm chart](https://github.com/helm/charts/tree/master/stable/nginx-ingress).
    37. 

  37.     - Installing the [Ingress GitLab Managed App](../../user/clusters/applications.md#ingress) with WAF enabled.
    38. 

  38. 

  39. - **Configured Kubernetes objects**
    40. 

  40. 

  41.   To use the WAF on an application, you need to deploy the following Kubernetes resources:
    42. 

  42. 

  43.   - [Deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/)
    44. 

  44.   - [Service](https://kubernetes.io/docs/concepts/services-networking/service/)
    45. 

  45.   - [Ingress Resource](https://kubernetes.io/docs/concepts/services-networking/ingress/)
    46. 

  46. 

  47. ## Quick start
    48. 

  48. 

  49. If you are using GitLab.com, see the [quick start guide](quick_start_guide.md) for
    50. 

  50. how to use the WAF with GitLab.com and a Kubernetes cluster on Google Kubernetes Engine (GKE).
    51. 

  51. 

  52. If you are using a self-managed instance of GitLab, you need to configure the
    53. 

  53. [Google OAuth2 OmniAuth Provider](../../integration/google.md) before
    54. 

  54. you can configure a cluster on GKE. Once this is set up, you can follow the steps on the [quick start guide](quick_start_guide.md) to get started.
    55. 

  55. 

  56. NOTE: **Note**
    57. 

  57. This guide shows how the WAF can be deployed using Auto DevOps. The WAF
    58. 

  58. is available by default to all applications no matter how they are deployed,
    59. 

  59. as long as they are using Ingress.
    60. 

  60. 

  61. ## Network firewall vs. Web Application Firewall
    62. 

  62. 

  63. A network firewall or packet filter looks at traffic at the Network (L3) and Transport (L4) layers
    64. 

  64. of the [OSI Model](https://en.wikipedia.org/wiki/OSI_model), and denies packets from entry based on
    65. 

  65. a set of rules regarding the network in general.
    66. 

  66. 

  67. A Web Application Firewall operates at the Application (L7) layer of the OSI Model and can
    68. 

  68. examine all the packets traveling to and from a specific application. A WAF can set
    69. 

  69. more advanced rules around threat detection.
    70. 

  70. 

  71. ## Features
    72. 

  72. 

  73. ModSecurity is enabled with the [OWASP Core Rule Set (CRS)](https://modsecurity.org/crs/) by
    74. 

  74. default. The OWASP CRS logs attempts to the following attacks:
    75. 

  75. 

  76. - [SQL Injection](https://wiki.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_SQL_Injection)
    77. 

  77. - [Cross-Site Scripting](https://wiki.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Cross-Site_Scripting_(XSS))
    78. 

  78. - [Local File Inclusion](https://wiki.owasp.org/index.php/Testing_for_Local_File_Inclusion)
    79. 

  79. - [Remote File Inclusion](https://wiki.owasp.org/index.php/OWASP_Periodic_Table_of_Vulnerabilities_-_Remote_File_Inclusion)
    80. 

  80. - [Code Injection](https://wiki.owasp.org/index.php/Code_Injection)
    81. 

  81. - [Session Fixation](https://wiki.owasp.org/index.php/Session_fixation)
    82. 

  82. - [Scanner Detection](https://wiki.owasp.org/index.php/Category:Vulnerability_Scanning_Tools)
    83. 

  83. - [Metadata/Error Leakages](https://wiki.owasp.org/index.php/Improper_Error_Handling)
    84. 

  84. 

  85. It is good to have a basic knowledge of the following:
    86. 

  86. 

  87. - [Kubernetes](https://kubernetes.io/docs/home/)
    88. 

  88. - [Ingress](https://kubernetes.github.io/ingress-nginx/)
    89. 

  89. - [ModSecurity](https://www.modsecurity.org/)
    90. 

  90. - [OWASP Core Rule Set](https://modsecurity.org/crs/)
    91. 

  91. 

  92. ## Roadmap
    93. 

  93. 

  94. More information on the direction of the WAF can be
    95. 

  95. found in [Product Vision - Defend](https://about.gitlab.com/direction/defend/#waf)
    96. 

  96.