8000 Idea: Adaptive paranoia level · Issue #2240 · coreruleset/coreruleset · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Idea: Adaptive paranoia level #2240

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
azurit opened this issue Oct 20, 2021 · 8 comments
Closed

Idea: Adaptive paranoia level #2240

azurit opened this issue Oct 20, 2021 · 8 comments
Labels
⌛ Stale issue This issue has been open 120 days with no activity. 👍 Feature Request

Comments

@azurit
Copy link
Member
azurit commented Oct 20, 2021 •
edited
Loading

Motivation

I was thinking about doing paranoia level some kind of adaptive to the request so, for example, if the IP address is suspicious, paranoia level will be automatically raised. On the other hand, PL can be lowered for known IPs.

Paranoia level can be changed based on these parameters:

  • remote IP address (fixed IPs, ranges, geoip, reputation, tor exit nodes)
  • RBL
  • score from previous phases
  • ...

What do you think?

Proposed solution

I have working prototype of the plugin which is able to change paranoia level based on geoip.
@dune73
Copy link
Member
dune73 commented Oct 20, 2021

I thought about this before and I would be interested to hear people experiment with it. Perfect feature for a plugin.

@fzipi fzipi mentioned this issue Nov 14, 2021
Closed
@dune73
Copy link
Member
dune73 commented Nov 15, 2021

Have you tried out your implementation, @azurit? How did it go?

I'm covering this idea / concept in my blog post at https://coreruleset.org/20211028/working-with-paranoia-levels/. Do you think my concerns apply or would you use it nevertheless and add it to the list of official plugins?

@azurit
Copy link
Member Author
azurit commented Nov 15, 2021

I have a working plugin ready. It's able to set paranoia or executing paranoia level based on geoip (you can assing ISO codes to paranoia levels using configuration file).
I'm still thinking about not setting paranoia level directly based on request parameters but adding a score for every parameter and then, after all checks (i.e. geoip, ip reputation, ..) are done, setting paranoia level based on score.

I read your blog post and i think there are situations where this feature can be usefull but it must be used wisely.

@dune73
Copy link
Member
dune73 commented Nov 15, 2021

Sounds good. This is scheduled for the chat tonight. I think it's worthwhile to do a plugin around this idea. What I am unsure is whether we want to make it an official plugin or a 3rd party plugin. Also has a bit to do with the GeoIP support in ModSec.

@azurit
Copy link
Member Author
azurit commented Nov 15, 2021

I found a way how to use also external source of geoip data (for example mod_geoip2 / mod_maxminddb).

@fzipi fzipi mentioned this issue Dec 5, 2021
Closed
@dune73 dune73 mentioned this issue Feb 21, 2022
Closed
@github-actions
Copy link
Contributor

This issue has been open 120 days with no activity. Remove the stale label or comment, or this will be closed in 14 days

@github-actions github-actions bot added the ⌛ Stale issue This issue has been open 120 days with no activity. label Mar 16, 2022
@dune73
Copy link
Member
dune73 commented Mar 16, 2022

@azurit, OK if we close this?

@azurit
Copy link
Member Author
azurit commented Mar 16, 2022

Yes, closing for now.

@azurit azurit closed this as completed Mar 16, 2022
@dune73 dune73 mentioned this issue Mar 21, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
⌛ Stale issue This issue has been open 120 days with no activity. 👍 Feature Request
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@dune73 @azurit
0