ModSecurity extends nginx configuration via several new directives. These can be used in http, server, or location contexts.
modsecurity
Enables or disables the ModSecurity module. This is an nginx flag and is independent of the SecRuleEngine state.
- Syntax:
modsecurity on | off - Default:
off
modsecurity_rules_file
Specifies a local path to a ModSecurity configuration file.
- Syntax:
modsecurity_rules_file <path to rules file> - Default:
no
modsecurity_rules_remote
Downloads a ModSecurity configuration file from a remote URL using an authentication key.
- Syntax:
modsecurity_rules_remote <key> <URL to rules> - Default:
no
modsecurity_rules
Allows injecting ModSecurity rules directly into the nginx configuration string. This is useful for per-location customizations (e.g., SecRuleRemoveById).
- Syntax:
modsecurity_rules <modsecurity rule> - Default:
no
modsecurity_transaction_id
Passes a custom transaction ID from nginx to the library instead of letting the library generate one. This is highly recommended for correlating nginx access logs with ModSecurity error logs using variables like $request_id.
- Syntax:
modsecurity_transaction_id string - Default:
no
modsecurity_use_error_log
Controls whether ModSecurity error log functionality is enabled.
- Syntax:
modsecurity_use_error_log on | off - Default:
on
server {
modsecurity on;
modsecurity_rules_file /etc/my_modsecurity_rules.conf;
location / {
root /var/www/html;
}
location /ops {
root /var/www/html/opts;
modsecurity_rules '
SecRuleEngine On
SecDebugLog /tmp/modsec_debug.log
SecDebugLogLevel 9
SecRuleRemoveById 10
';
}
}
