WAFͷϧʔϧͰ͋Δ OWASP ModSecurity Core Rule Set (CRS)Λ ࢖ͬͨՄࢹԽ·Ͱͷۤ࿑࿩ !EFMQIJO[

08"41
$POOFDU!'PMJP 

໊લɿ Masahiro Tabataʢ@delphinzʣ
 
 ࢓ࣄɿγεςϜίϯαϧλϯτ 
 ηΩϡϦςΟ͸ͨ͠ͳΈఔ౓ झຯ͸ओʹङྌ࠾ूɻ
 BBQͰϚάϩͦͯ͠ಲΛ͞͹͖·͢ɻ MINI Hardening ӡӦϝϯόʔ(ϑΝγ Ϧςʔγϣϯʣ΍ͬͯ·͢♫ ࣗݾ঺հ ʹ+"84
%":Ͱ08"41ͱ
.*/*
IBSEFOJOHΛએ఻தͷ༷ࢠ 

.*/*
IBSEFOJOHͰฉ͍ͨ
ʢݫ͍͠ʣ͝ҙݟɾཁ๬ ɾΠϚυΩ"QBDIFͱ͔࢖Θͳ͍͠ʔʂ
ɾ8"'ͱ͔ೖͬͯͳ͍αʔϏε͋Γ·͔͢ʔʁ 

ΑΖ͍͠
ͳΒ͹OHJOY

NPETFDVSJUZͩʂ 

NPETFDVSJUZʹ$34Λఴ͑ͯ .PE
TFDVSJUZ
w .PE4FDVSJUZ͸Φʔϓϯιʔεͷ8FCΞϓϦέʔγϣϯϑΝΠΞ΢Υʔ ϧ 8"' Ͱɺ"QBDIFɺOHJOYɺ**4ͷϞδϡʔϧͱͯ͠ಈ࡞͢Δɻ
 ։ൃ͸4QJEFS-BCT͕ߦ͍ͬͯΔɻ
 IUUQTHJUIVCDPN4QJEFS-BCT.PE4FDVSJUZ
08"41
NPETFDVSJUZ
$PSF
3VMF
4FU
w 08"41͕ఏڙ͢ΔNPETFDVSJUZ༻ͷ߈ܸΛݕ஌͢Δجຊతͳϧʔϧ ηοτ
 IUUQTXXXPXBTQPSHJOEFYQIQ$BUFHPSZ08"[email protected]@$PSF@3VMF@4FU@1SPKFDU


OHJOYNPETFDVSJZͷ᠘ w "QBDIFͷ৔߹͸΄ͱΜͲͷMJOVYύοέʔδͰެࣜఏڙ͞ Ε͍ͯΔɻ
 OHJOY͸ιʔε͔ΒͷϏϧυ͕ඞཁʂ
w ެࣜͲ͏Γʹ΍ͬͯ΋ઈରʹೖΒͳ͍ʂ
 CVJME࣌఺ͷϢʔβʔࢦఆ͕ඞཁ
 ύοέʔδ͕଍Γͳ͍ͱಈ͔ͳ͍ɻ
 ΤϥʔΛు͔ͳ͍ʢٽʣ 

͓Αͦਓྨͷखʹෛ͑ͳ͍
ϩάग़ྗܗࣜ 

ՄࢹԽπʔϧΛࢼͯ͠ΈΔ w "VEJU$POTPMF
 NPETFDVSJUZͷϩάΛ؅ཧ͢ΔͨΊʹ࡞ΒΕͨ+BWBΞϓ Ϧέʔγϣϯ
 5PNDBU্ʹల։͞Εͯ8&#ϒϥ΢β͔Βϩάͷऩूɺ อଘɺϑΟϧλϦϯάͳͲͷػೳΛఏڙ͢Δɻ
 IUUQXXXKXBMMPSHXFCBVEJUDPOTPMFJOEFYKTQ 

͜Ε΋"VEJU$POTPMFͷ᠘͔ w +BWB͸ܾΊଧͪɺެࣜͲ͓Γͩͱ͕ೖΓಈ͔ͳ͍
w SPPUҎԼʹ഑ஔ͠ͳ͍ͱϦΞϧλΠϜϩάऔࠐෆՄ
w ϦΞϧλΠϜग़ྗʹඞཁͳNMPHDʢNPETFDVSJUZͷϩάग़ ྗπʔϧʣ͸BQBDIF൛ͷΈରԠɺOHJOY͸ඇରԠ
w όονܗࣜͷ୅ସπʔϧ QFSM ΋OHJOY൛Ͱ͸ಈ͔ͳ͍
w BVEJUDPOTPMF͕ఏڙ͢Δϩάૹ৴πʔϧͰ୅༻
 ʢͨͩ͠ɺҰׅૹ৴Ͱࠩ෼ૹ৴Ͱ͖ͳ͍ʣ 

ແࣄʹՄࢹԽʹ੒ޭ͠·ͨ͠ʂ w ͱΓ͋͑ͣ.*/*
IBSEFOJOHͰൃੜͨ͠NPETFDVSJZϩά ΛҰׅͰऔΓࠐΜͰΈΔͱ͜Μͳײ͡ 

͓·͚ɿ$34࡞ऀͷϫφ w 08"41ެࣜͷ$34ͷઆ໌ʹʮϥΠΞϯɾόʔωοτʯͷه ࡌ͋Γ
w ʮϥΠΞϯɾόʔωοτʯͱ͍͑͹%%04ରࡦͷαʔϏεͰ
 ༗໊ͳ1SPMFYJDࣾʢͷͪʹ"LBNBJ͕ങऩʣͷ૑ۀऀ
 ʢৄࡉ͸ॻ੶ʮαΠόʔɾΫϥΠϜʯΛࢀরʣ 

͡Όɺͳ͍ਓͩͬͨʂ 

͓·͚ɿ$34࡞ऀͷϫφ w ޡΓ͸ʮ-ZPOʯਖ਼͘͠͸ʮ3ZBOʯͰͨ͠ɻ
 ϥΠΞϯɾόʔωοτͷ௲Γʹ஫ҙʂ
 ޡɿ ਖ਼ɿ ͪ͜Β͕$34ͷ࡞ऀͰͨ͠ʂ 

݁࿦ɿPTTͷΈͰͷ8"'ೖ໳ ͸ਏ͍ɺֶ͕ͼ͸͋ͬͨ w 8"'ͷ࢓૊ΈΛ஌Δ͜ͱ͕Ͱ͖ͨɻ
 ঎༻8"'Λ࢖͑ͳ͍ਓ͸PTT͔ΒॳΊͯ΋ྑ͍͔΋ɻ
w ݕ஌ઐ༻ͷઃఆʹͯ͠΍ΒΕαʔόΛ͍͡ΔͱͲΜͳΞΫηε͕ 8"'ʹҾ͔͔ͬΔ͔ݟΕΔɻ
w ଞͷPTT
8"'΋࣌ؒ ͱϞνϕʔγϣϯ ͕͋Ε͹ࢼͯ͠Έ͍ͨɻ
w 7BHSBOU BOTJCMFͰॻ͍ͨͷͰHJUެ։͍ͨ͠ ͔΋
w ਖ਼͍͠࡞ऀ͕Θ͔ͬͨʂ 

ͪΐͬͱࠂ஌
.*/*
IBSEFOJOH։࠵༧ఆ w ੈքॳʂʁɹςʔϚ͸ʮԾ૝௨՟ࢢ৔ΛकΓ͖Εʂʯ
w ౦ژ!:BIPPͰ։࠵ɺͦͷޙෳ਺ճ։࠵༧ఆ
 ౦ژҎ֎Ͱ͸໊ݹ԰ɺେࡕͰͷ։࠵Λௐ੔த
 ଞͷ஍ҬͰͷ։࠵ཁ๬Λ͓଴͓ͪͯ͠Γ·͢ʂ
w ࢀՃر๬ͷํ͸$POOQBTTΛνΣοΫ͍ͯͩ͘͠͞ɻ IUUQTNJOJIBSEFOJOHDPOOQBTTDPN 

"QQFOEJY w 8FC
"QQMJDBUJPO
'JSFXBMM
8"'
ಡຊ
վగୈ̎൛
 IUUQTXXXJQBHPKQpMFTQEG
 w 08"41
.PE4FDVSJUZ
$PSF
3VMF
4FU3ZBO
#BSOFUUQQU
 IUUQTXXXPXBTQPSHJOEFYQIQ 'JMF08"[email protected]@$PSF@3VMF@4FU3ZBO@#BSOFUUQQU