Coraza WAF via SPOE

Was ist das?

Coraza ist eine moderne WAF-Engine (Go), die das OWASP Core Rule Set (CRS) ausführt. Die Integration in HAProxy erfolgt über SPOE – denselben Mechanismus wie bei CrowdSec.

Schaubild

Installation des SPOE-Agents

apt install golang git

git clone https://github.com/corazawaf/coraza-spoa.git /opt/coraza-spoa
cd /opt/coraza-spoa
go build -o coraza-spoa ./...
cp coraza-spoa /usr/local/bin/

OWASP Core Rule Set herunterladen

mkdir -p /etc/coraza/crs
git clone https://github.com/coreruleset/coreruleset.git /etc/coraza/crs
cp /etc/coraza/crs/crs-setup.conf.example /etc/coraza/crs/crs-setup.conf

Coraza-Konfiguration

nano /etc/coraza/coraza.conf

Include /etc/coraza/crs/crs-setup.conf
Include /etc/coraza/crs/rules/*.conf

SecRuleEngine On
SecRequestBodyAccess On
SecResponseBodyAccess On
SecAuditLog /var/log/coraza/audit.log
SecAuditLogType Serial
SecAuditEngine RelevantOnly

mkdir -p /var/log/coraza

SPOE-Agent als Systemd-Service

nano /etc/systemd/system/coraza-spoa.service

[Unit]
Description=Coraza SPOA for HAProxy
After=network.target

[Service]
ExecStart=/usr/local/bin/coraza-spoa -config /etc/coraza/coraza.conf
Restart=on-failure
User=haproxy

[Install]
WantedBy=multi-user.target

systemctl daemon-reload
systemctl enable --now coraza-spoa

SPOE-Konfiguration für HAProxy

nano /etc/haproxy/spoe-coraza.conf

[config]
  spoe-agent coraza
    messages    coraza-req
    option      var-prefix      coraza
    timeout     hello           100ms
    timeout     idle            30s
    timeout     processing      500ms
    use-backend coraza_backend

  spoe-message coraza-req
    args        src                    method=method    path=path    query=query    ver=req.ver    hdrs_bin=req.hdrs.bin    body_size=req.body_size    body=req.body
    event       on-frontend-http-request

HAProxy Konfiguration erweitern

Im frontend ft_https ergänzen:

frontend ft_https
    # ... bestehende Einträge ...
    filter spoe engine coraza config /etc/haproxy/spoe-coraza.conf
    http-request deny deny_status 403 if { var(txn.coraza.action) -m str "deny" }

Backend für den Coraza-Agent hinzufügen:

backend coraza_backend
    server coraza 127.0.0.1:9000

Konfiguration testen und neu laden

haproxy -c -f /etc/haproxy/haproxy.cfg
systemctl reload haproxy

Test

Klassischer WAF-Test mit einem OWASP-typischen Angriff (SQL Injection):

curl -vk "https://revproxy.it2XX.int/?id=1'+OR+'1'='1"

Erwartet: HTTP 403

XSS-Test:

curl -vk "https://revproxy.it2XX.int/?q=<script>alert(1)</script>"