8000 Add more user agents to scanner user agent list · Issue #3285 · coreruleset/coreruleset · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Add more user agents to scanner user agent list #3285

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
jfeng-league opened this issue Aug 24, 2023 · 2 comments
Closed

Add more user agents to scanner user agent list #3285

jfeng-league opened this issue Aug 24, 2023 · 2 comments
Labels
👍 Feature Request

Comments

@jfeng-league
Copy link

https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker/blob/master/_generator_lists/bad-user-agents.list

I'd like to add these user agents into the scanner detection list. It will greatly improve all the downstream systems (GCP Cloud Armor) that utilize these lists
@jfeng-league
Copy link
Author

for reference:
https://github.com/coreruleset/coreruleset/blob/v4.0/dev/rules/scanners-user-agents.data

@RedXanadu
Copy link
Member

Hi @jfeng-league,

Please use our issue templates when opening an issue, e.g. the 'Feature Request' template. This ensures we have the information required and in a standard format, making these issues easier and quicker to triage.

Your idea is a good one, but we have recently decided against continuing to do much blocking based on User Agent:

We agreed in the June meeting, that [overhauling the User Agent detection rules] would not work and we are now stripping the UA based scanner detection to the most malicious scanners announcing themselves in the UA in a PL1 rule. All the rest is being kicked out since we are not able to draw a line between benign, annoying and not so benign scanners and bots. Creating a plugin to provide this for those who really want it, would be an option though, but that is not a priority / depends on a volunteer.

The plan was to use the "apache-ultimate-bad-bot-blocker", so very similar to your suggestion!

This type of User Agent block/spam detection could be turned into a plugin in the future, but at the moment the decision is that it will not live as part of the core/default CRS rules.

I'm going to close this issue as we've already decided as a project not to move in this direction of UA scanning/blocking, but feel free to follow up if you have any further questions or points to make.

@RedXanadu RedXanadu closed this as not planned Won't fix, can't repro, duplicate, stale Aug 26, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
👍 Feature Request
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@RedXanadu @jfeng-league
0