forked from docs/doc-exports
qinweiwei
6f60ff9f8d
Reviewed-by: Rogal, Marcel <mrogal@noreply.gitea.eco.tsi-dev.otc-service.com> Co-authored-by: qinweiwei <qinweiwei@huawei.com> Co-committed-by: qinweiwei <qinweiwei@huawei.com>
112 lines
18 KiB
HTML
112 lines
18 KiB
HTML
<a name="waf_01_0008"></a><a name="waf_01_0008"></a>
|
|
|
|
<h1 class="topictitle1">Configuring Basic Web Protection to Defend Against Common Web Attacks</h1>
|
|
<div id="body1499850551754"><p id="waf_01_0008__p92731116102415">After this function is enabled, WAF can defend against common web attacks, such as SQL injections, XSS, remote overflow vulnerabilities, file inclusions, Bash vulnerabilities, remote command execution, directory traversal, sensitive file access, and command/code injections. You can also enable other checks in basic web protection, such as web shell detection, deep inspection against evasion attacks, and header inspection.</p>
|
|
<div class="section" id="waf_01_0008__section12205121204219"><h4 class="sectiontitle">Suggestions</h4><ul id="waf_01_0008__ul1967116228408"><li id="waf_01_0008__li2671172218402">If you are not clear about your service traffic characteristics, you are advised to switch to the <strong id="waf_01_0008__b11796358135516">Log only</strong> mode first and observe the WAF protection for a period of time. Generally, you need to observe service running for one to two weeks, and then analyze the attack logs.<ul id="waf_01_0008__ul167115222408"><li id="waf_01_0008__li067113224401">If no record of blocking legitimate requests is found, switch to the <strong id="waf_01_0008__b15753247563">Block</strong> mode.</li><li id="waf_01_0008__li1367182204016">If legitimate requests are blocked, adjust the protection level or configure global protection whitelist rules to prevent legitimate requests from being blocked.</li></ul>
|
|
</li><li id="waf_01_0008__li0671182214404">Note the following points in your operations:<ul id="waf_01_0008__ul26716227408"><li id="waf_01_0008__li267142213404">Do not transfer the original SQL statement or JavaScript code in a legitimate HTTP request.</li><li id="waf_01_0008__li5671112264011">Do not use special keywords (such as UPDATE and SET) in a legitimate URL. For example, <strong id="waf_01_0008__b1675712249574">https://www.example.com/abc/update/mod.php?set=1</strong>.</li><li id="waf_01_0008__li1671022174017">Use Object Storage Service (OBS) or other secure methods to upload files that exceed 50 MB rather than via a web browser.</li></ul>
|
|
</li></ul>
|
|
</div>
|
|
<div class="section" id="waf_01_0008__section5903171661012"><h4 class="sectiontitle">Prerequisites</h4><p id="waf_01_0008__en-us_topic_0000001452648049_en-us_topic_0110861312_en-us_topic_0115673325_p173267390016">You have added the website you want to protect to WAF.</p>
|
|
</div>
|
|
<div class="section" id="waf_01_0008__section3393202511516"><h4 class="sectiontitle">Constraints</h4><ul id="waf_01_0008__ul088972181618"><li id="waf_01_0008__li1488912131616">Basic web protection has two modes: <strong id="waf_01_0008__b168571495289">Block</strong> and <strong id="waf_01_0008__b1685714910283">Log only</strong>.</li><li id="waf_01_0008__li20889925160">If you select <strong id="waf_01_0008__b1514535014251">Block</strong> for <strong id="waf_01_0008__b11461850112510">Basic Web Protection</strong>, you can <a href="waf_01_0271.html">configure access control criteria for a known attack source</a>. WAF will block requests matching the configured IP address, cookie, or params for a length of time configured as part of the rule.</li><li id="waf_01_0008__li39951185113">Currently, Shiro decryption detection is not available in regions CN East-Qingdao and AP-Manila.</li></ul>
|
|
</div>
|
|
<div class="section" id="waf_01_0008__section61533550183130"><h4 class="sectiontitle">Enabling Basic Web Protection Rules</h4><ol id="waf_01_0008__ol202261245463"><li id="waf_01_0008__li612711519813"><span>Log in to the management console.</span></li><li id="waf_01_0008__li458314281487"><span>Click <span><img id="waf_01_0008__en-us_topic_0000002335595889_image158886314810" src="en-us_image_0000002395174933.png"></span> in the upper left corner and select a region or project.</span></li><li id="waf_01_0008__li159657213511"><span>Click <span><img id="waf_01_0008__en-us_topic_0000002335595889_image172869321316" src="en-us_image_0000002395334641.png"></span> in the upper left corner and choose <strong id="waf_01_0008__en-us_topic_0000002335595889_b1545322105418">Web Application Firewall (Dedicated)</strong> under <strong id="waf_01_0008__en-us_topic_0000002335595889_b12545122195419">Security</strong>.</span></li><li id="waf_01_0008__li86686045213"><span>In the navigation pane on the left, click <strong id="waf_01_0008__en-us_topic_0000002335595889_b14305215551">Policies</strong>.</span></li><li id="waf_01_0008__li792422110149"><span>Click the name of the target policy to go to the protection configuration page.</span></li><li id="waf_01_0008__li1357185016155"><span>Click the <span class="parmname" id="waf_01_0008__parmname84531940141914"><b>Basic Web Protection</b></span> configuration area and toggle it on or off if needed.</span><p><ul id="waf_01_0008__ul103222180"><li id="waf_01_0008__li16311214181"><span><img id="waf_01_0008__image12518105842612" src="en-us_image_0000002395174901.png"></span>: enabled.</li><li id="waf_01_0008__li245212187"><span><img id="waf_01_0008__image16420271818" src="en-us_image_0000002361494960.png"></span>: disabled.</li></ul>
|
|
</p></li><li id="waf_01_0008__li990115155146"><span>Click the <span class="uicontrol" id="waf_01_0008__uicontrol3183651460"><b>Protection Status</b></span> tab, and enable protection types one by one by referring to <a href="#waf_01_0008__table1054818371898">Table 2</a>.</span><p><div class="fignone" id="waf_01_0008__fig17347539113910"><span class="figcap"><b>Figure 1 </b>Basic web protection</span><br><span><img id="waf_01_0008__image13536163921814" src="en-us_image_0000002395174837.png" title="Click to enlarge" class="imgResize"></span></div>
|
|
<ol type="a" id="waf_01_0008__ol0550153464115"><li id="waf_01_0008__li9710940174112">Set the protective action.<ul id="waf_01_0008__ul01166616421"><li id="waf_01_0008__li17116867425"><strong id="waf_01_0008__b169013192558">Block</strong>: WAF blocks and logs detected attacks.<p id="waf_01_0008__p10979163816424">If you select <strong id="waf_01_0008__b1840865114572">Block</strong>, you can select a known attack source rule to let WAF block requests accordingly. For details, see <a href="waf_01_0271.html">Configuring a Known Attack Source Rule to Block Specific Visitors for a Specified Duration</a>.</p>
|
|
</li><li id="waf_01_0008__li1611611624213"><strong id="waf_01_0008__b416591125912">Log only</strong>: WAF only logs detected attacks.</li></ul>
|
|
</li><li id="waf_01_0008__li754917341415">Set the protection level.<p id="waf_01_0008__p1454917342415"><a name="waf_01_0008__li754917341415"></a><a name="li754917341415"></a>In the upper part of the page, set <strong id="waf_01_0008__b44522292303">Protection Level</strong> to <strong id="waf_01_0008__b588018219453">Low</strong>, <strong id="waf_01_0008__b1988042104510">Medium</strong>, or <strong id="waf_01_0008__b188192110459">High</strong>. The default value is <strong id="waf_01_0008__b158821321174519">Medium</strong>.</p>
|
|
|
|
<div class="tablenoborder"><table cellpadding="4" cellspacing="0" summary="" id="waf_01_0008__table4686152913388" frame="border" border="1" rules="all"><caption><b>Table 1 </b>Protection levels</caption><thead align="left"><tr id="waf_01_0008__en-us_topic_0165951356_row257619443717"><th align="left" class="cellrowborder" valign="top" width="28.849999999999998%" id="mcps1.3.5.2.7.2.2.2.2.2.3.1.1"><p id="waf_01_0008__en-us_topic_0165951356_p2576844573">Protection Level</p>
|
|
</th>
|
|
<th align="left" class="cellrowborder" valign="top" width="71.15%" id="mcps1.3.5.2.7.2.2.2.2.2.3.1.2"><p id="waf_01_0008__en-us_topic_0165951356_p95761144176">Description</p>
|
|
</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody><tr id="waf_01_0008__en-us_topic_0165951356_row2576644570"><td class="cellrowborder" valign="top" width="28.849999999999998%" headers="mcps1.3.5.2.7.2.2.2.2.2.3.1.1 "><p id="waf_01_0008__en-us_topic_0165951356_p7576844572">Low</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="71.15%" headers="mcps1.3.5.2.7.2.2.2.2.2.3.1.2 "><p id="waf_01_0008__en-us_topic_0165951356_p15576174416714">WAF only blocks the requests with obvious attack signatures.</p>
|
|
<p id="waf_01_0008__en-us_topic_0165951356_p7903127245">If a large number of false alarms are reported, <strong id="waf_01_0008__b4828386410">Low</strong> is recommended.</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="waf_01_0008__en-us_topic_0165951356_row18576344378"><td class="cellrowborder" valign="top" width="28.849999999999998%" headers="mcps1.3.5.2.7.2.2.2.2.2.3.1.1 "><p id="waf_01_0008__en-us_topic_0165951356_p20576044476">Medium</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="71.15%" headers="mcps1.3.5.2.7.2.2.2.2.2.3.1.2 "><p id="waf_01_0008__en-us_topic_0165951356_p2910122920245">The default level is <strong id="waf_01_0008__b1046210431349">Medium</strong>, which meets a majority of web protection requirements.</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="waf_01_0008__en-us_topic_0165951356_row857616441575"><td class="cellrowborder" valign="top" width="28.849999999999998%" headers="mcps1.3.5.2.7.2.2.2.2.2.3.1.1 "><p id="waf_01_0008__en-us_topic_0165951356_p1857694417714">High</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="71.15%" headers="mcps1.3.5.2.7.2.2.2.2.2.3.1.2 "><p id="waf_01_0008__en-us_topic_0165951356_p55766441379">At this level, WAF provides the finest granular protection and can intercept attacks with complex bypass features, such as Jolokia cyber attacks, common gateway interface (CGI) vulnerability detection, and Druid SQL injection attacks.</p>
|
|
<p id="waf_01_0008__p20119344130">To let WAF defend against more attacks but make minimum effect on normal requests, observe your workloads for a period of time first. Then, configure a global protection whitelist rule and select <strong id="waf_01_0008__b143351214165018">High</strong>.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
</li><li id="waf_01_0008__li11550834124116">Set the protection type.<div class="notice" id="waf_01_0008__note1564322641017"><span class="noticetitle"><img src="public_sys-resources/notice_3.0-en-us.png"> </span><div class="noticebody"><p id="waf_01_0008__p145481432121014">By default, <strong id="waf_01_0008__b2876035154311">General Check</strong> is enabled. You can enable other protection types by referring to <a href="#waf_01_0008__table1054818371898">Table 2</a>.</p>
|
|
</div></div>
|
|
|
|
<div class="tablenoborder"><a name="waf_01_0008__table1054818371898"></a><a name="table1054818371898"></a><table cellpadding="4" cellspacing="0" summary="" id="waf_01_0008__table1054818371898" frame="border" border="1" rules="all"><caption><b>Table 2 </b>Protection types</caption><thead align="left"><tr id="waf_01_0008__row25491137297"><th align="left" class="cellrowborder" valign="top" width="40.04%" id="mcps1.3.5.2.7.2.2.3.2.2.3.1.1"><p id="waf_01_0008__p1854915379911">Type</p>
|
|
</th>
|
|
<th align="left" class="cellrowborder" valign="top" width="59.96%" id="mcps1.3.5.2.7.2.2.3.2.2.3.1.2"><p id="waf_01_0008__p8549737894">Description</p>
|
|
</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody><tr id="waf_01_0008__row354983713918"><td class="cellrowborder" valign="top" width="40.04%" headers="mcps1.3.5.2.7.2.2.3.2.2.3.1.1 "><p id="waf_01_0008__p35498371299">General Check</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="59.96%" headers="mcps1.3.5.2.7.2.2.3.2.2.3.1.2 "><p id="waf_01_0008__p125497371397">Defends against attacks such as SQL injections, XSS, remote overflow vulnerabilities, file inclusions, Bash vulnerabilities, remote command execution, directory traversal, sensitive file access, and command/code injections. SQL injection attacks are mainly detected based on semantics.</p>
|
|
<div class="note" id="waf_01_0008__note66541414413"><span class="notetitle"> NOTE: </span><div class="notebody"><p id="waf_01_0008__p86559124115">If you enable <strong id="waf_01_0008__b1528150124711">General Check</strong>, WAF checks your websites based on the built-in rules.</p>
|
|
</div></div>
|
|
</td>
|
|
</tr>
|
|
<tr id="waf_01_0008__row5549123715914"><td class="cellrowborder" valign="top" width="40.04%" headers="mcps1.3.5.2.7.2.2.3.2.2.3.1.1 "><p id="waf_01_0008__p754913375913">Webshell Detection</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="59.96%" headers="mcps1.3.5.2.7.2.2.3.2.2.3.1.2 "><p id="waf_01_0008__p1754993711914">Protects against web shells from upload interface.</p>
|
|
<div class="note" id="waf_01_0008__note19915165154218"><span class="notetitle"> NOTE: </span><div class="notebody"><p id="waf_01_0008__p1591614514423">If you enable <strong id="waf_01_0008__b1727114744710">Webshell Detection</strong>, WAF detects web page Trojan horses inserted through the upload interface.</p>
|
|
</div></div>
|
|
</td>
|
|
</tr>
|
|
<tr id="waf_01_0008__row837585613435"><td class="cellrowborder" valign="top" width="40.04%" headers="mcps1.3.5.2.7.2.2.3.2.2.3.1.1 "><p id="waf_01_0008__p17376556194316">Deep Inspection</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="59.96%" headers="mcps1.3.5.2.7.2.2.3.2.2.3.1.2 "><p id="waf_01_0008__p16868294452">Identifies and blocks evasion attacks, such as the ones that use homomorphic character obfuscation, command injection with deformed wildcard characters, UTF7, data URI scheme, and other techniques.</p>
|
|
<div class="note" id="waf_01_0008__note825125516470"><span class="notetitle"> NOTE: </span><div class="notebody"><p id="waf_01_0008__p1425155154718">If you enable <strong id="waf_01_0008__b388906719">Deep Inspection</strong>, WAF detects and defends against evasion attacks in depth.</p>
|
|
</div></div>
|
|
</td>
|
|
</tr>
|
|
<tr id="waf_01_0008__row124533351015"><td class="cellrowborder" valign="top" width="40.04%" headers="mcps1.3.5.2.7.2.2.3.2.2.3.1.1 "><p id="waf_01_0008__p122469331102">Header Inspection</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="59.96%" headers="mcps1.3.5.2.7.2.2.3.2.2.3.1.2 "><p id="waf_01_0008__p1714019071217">This function is disabled by default. When it is disabled, General Check will check some of the header fields, such as User-Agent, Content-type, Accept-Language, and Cookie.</p>
|
|
<div class="note" id="waf_01_0008__note6982930171110"><span class="notetitle"> NOTE: </span><div class="notebody"><p id="waf_01_0008__p20983730201118">If you enable this function, WAF checks all header fields in the requests.</p>
|
|
</div></div>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
</li></ol>
|
|
</p></li></ol>
|
|
</div>
|
|
<div class="section" id="waf_01_0008__section1773143201419"><h4 class="sectiontitle">Protection Verification</h4><p id="waf_01_0008__p16820174712143">To verify that WAF is protecting your website (<strong id="waf_01_0008__b87701656194812">www.example.com</strong>) based on basic web protection (with <strong id="waf_01_0008__b15322194514493">General Check</strong> enabled and <strong id="waf_01_0008__b18794193210500">Mode</strong> set to <strong id="waf_01_0008__b18715133511509">Block</strong>), take the following steps:</p>
|
|
<ol id="waf_01_0008__ol6579193319255"><li id="waf_01_0008__li14744134912716"><span>Clear the browser cache and enter the domain name in the address bar to check whether the website is accessible.</span><p><ul id="waf_01_0008__ul112081054104215"><li id="waf_01_0008__li181201354134518">If the website is inaccessible, connect the website domain name to WAF by following the instructions in <a href="waf_01_0326.html">Step 1: Add Your Website to WAF</a>.</li><li id="waf_01_0008__li15572817174415">If the website is accessible, go to <a href="#waf_01_0008__li2057953372517">Step 2</a>.</li></ul>
|
|
</p></li><li id="waf_01_0008__li2057953372517"><a name="waf_01_0008__li2057953372517"></a><a name="li2057953372517"></a><span>Clear the browser cache and enter <strong id="waf_01_0008__b1340247113319">http://www.example.com?id=1%27%20or%201=1</strong> in the address box of the browser to simulate an SQL injection attack.</span></li><li id="waf_01_0008__li524318597290"><span>Return to the WAF console. In the navigation pane on the left, click <strong id="waf_01_0008__b522224273615">Events</strong>. On the displayed page, check event logs.</span></li></ol>
|
|
</div>
|
|
<div class="section" id="waf_01_0008__section1358382112810"><h4 class="sectiontitle">Configuration Example - Blocking SQL Injection Attacks</h4><p id="waf_01_0008__p17906197219">If domain name <strong id="waf_01_0008__b1546101419157">www.example.com</strong> has been connected to WAF, perform the following steps to verify that WAF can block SQL injection attacks.</p>
|
|
<ol id="waf_01_0008__ol6309021174110"><li id="waf_01_0008__li19808155854119"><span>Enable <strong id="waf_01_0008__b1426113192910">General Check</strong> in<strong id="waf_01_0008__b1282720562288"> Basic Web Protection</strong> and set the protection mode to <strong id="waf_01_0008__b179381032172914">Block</strong>.</span><p><div class="fignone" id="waf_01_0008__fig11294730881"><span class="figcap"><b>Figure 2 </b>Enabling General Check</span><br><span><img id="waf_01_0008__image3531517112015" src="en-us_image_0000002395334729.png" title="Click to enlarge" class="imgResize"></span></div>
|
|
</p></li><li id="waf_01_0008__li1230917217412"><span>Enable WAF basic web protection.</span><p><div class="fignone" id="waf_01_0008__fig845094155618"><span class="figcap"><b>Figure 3 </b>Basic Web Protection configuration area</span><br><span><img id="waf_01_0008__image17543253143715" src="en-us_image_0000002395334701.png"></span></div>
|
|
</p></li><li id="waf_01_0008__li882114012163"><span>Clear the browser cache and enter a simulated SQL injection (for example, http://www.example.com?id=' or 1=1) in the address box.</span><p><p id="waf_01_0008__p146701211510">WAF blocks the access request. <a href="#waf_01_0008__fig4672124158">Figure 4</a> shows an example block page.</p>
|
|
<div class="fignone" id="waf_01_0008__fig4672124158"><a name="waf_01_0008__fig4672124158"></a><a name="fig4672124158"></a><span class="figcap"><b>Figure 4 </b>Block page</span><br><span><img id="waf_01_0008__image367812141510" src="en-us_image_0000002361494948.png" title="Click to enlarge" class="imgResize"></span></div>
|
|
</p></li><li id="waf_01_0008__li10820165001813"><span>Go to the WAF console. In the navigation pane on the left, choose <strong id="waf_01_0008__b9180192515489">Events</strong>. View the event on the <strong id="waf_01_0008__b39151846184810">Events</strong> page.</span></li></ol>
|
|
</div>
|
|
</div>
|
|
<div>
|
|
<div class="familylinks">
|
|
<div class="parentlink"><strong>Parent topic:</strong> <a href="waf_01_0007.html">Configuring Protection Policies</a></div>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
<script language="JavaScript">
|
|
<!--
|
|
initImageViewer('.imgResize');
|
|
var msg_imageMax = "view original image";
|
|
var msg_imageClose = "close";
|
|
//--></script> |