[GH-ISSUE #118] 按最佳实践开启 ModSecurity 报错 #89

New issue

Closed

opened 2026-03-04 12:18:50 +03:00 by kerem · 1 comment

kerem commented

2026-03-04 12:18:50 +03:00

Owner

Originally created by @b111110110 on GitHub (Jan 4, 2023).
Original GitHub issue: https://github.com/ADD-SP/ngx_waf/issues/118

ngx_waf: Current
nginx -V
nginx version: nginx/1.16.1
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC)
built with OpenSSL 1.0.2k-fips 26 Jan 2017
TLS SNI support enabled
configure arguments: --prefix=/usr/local/nginx --user=www --group=www --with-http_auth_request_module --with-http_gzip_static_module --with-http_realip_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-stream --with-stream_ssl_module --add-module=ngx_devel_kit-0.3.1 --add-module=lua-nginx-module-0.10.18 --add-module=form-input-nginx-module-0.12 --add-module=headers-more-nginx-module-0.33 --add-module=naxsi-1.3/naxsi_src --add-module=nginx-upstream-fair --add-module=ngx_cache_purge-2.3 --add-module=ngx_http_geoip2_module-3.3 --add-module=ngx_waf-10.1.2 --with-cc-opt=-std=gnu99
日志
nginx: [emerg] ngx_waf: Rules error. File: /usr/local/nginx/conf/modsecurity/owasp/REQUEST-922-MULTIPART-ATTACK.conf. Line: 27. Column: 53. Expecting a variable, got: : MULTIPART_PART_HEADERS:charset "!@eq 0" \ in /usr/local/nginx/conf/vhost/***.conf:20
nginx: configuration file /usr/local/nginx/conf/nginx.conf test failed

Originally created by @b111110110 on GitHub (Jan 4, 2023). Original GitHub issue: https://github.com/ADD-SP/ngx_waf/issues/118 * ngx_waf: Current * `nginx -V` nginx version: nginx/1.16.1 built by gcc 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC) built with OpenSSL 1.0.2k-fips 26 Jan 2017 TLS SNI support enabled configure arguments: --prefix=/usr/local/nginx --user=www --group=www --with-http_auth_request_module --with-http_gzip_static_module --with-http_realip_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-stream --with-stream_ssl_module --add-module=ngx_devel_kit-0.3.1 --add-module=lua-nginx-module-0.10.18 --add-module=form-input-nginx-module-0.12 --add-module=headers-more-nginx-module-0.33 --add-module=naxsi-1.3/naxsi_src --add-module=nginx-upstream-fair --add-module=ngx_cache_purge-2.3 --add-module=ngx_http_geoip2_module-3.3 --add-module=ngx_waf-10.1.2 --with-cc-opt=-std=gnu99 * 日志 nginx: [emerg] ngx_waf: Rules error. File: /usr/local/nginx/conf/modsecurity/owasp/REQUEST-922-MULTIPART-ATTACK.conf. Line: 27. Column: 53. Expecting a variable, got: : MULTIPART_PART_HEADERS:_charset_ "!@eq 0" \ in /usr/local/nginx/conf/vhost/***.conf:20 nginx: configuration file /usr/local/nginx/conf/nginx.conf test failed

kerem closed this issue

2026-03-04 12:18:51 +03:00

kerem commented

2026-03-04 12:18:51 +03:00

Author

Owner

@b111110110 commented on GitHub (Jan 6, 2023):

找到原因了, MULTIPART_PART_HEADERS 需要 ModSecurity v2.9.6/v3.0.8 版本支持, 我安装版本是v3.0.7所以会报错.
解决办法是将 REQUEST-922-MULTIPART-ATTACK.conf 文件重命名, 这样就不会被加载.

https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves/

@b111110110 commented on GitHub (Jan 6, 2023): 找到原因了, MULTIPART_PART_HEADERS 需要 ModSecurity v2.9.6/v3.0.8 版本支持, 我安装版本是v3.0.7所以会报错. 解决办法是将 REQUEST-922-MULTIPART-ATTACK.conf 文件重命名, 这样就不会被加载. https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves/

kerem referenced this issue

2026-03-13 17:01:38 +03:00

[GH-ISSUE #89] openresty可以使用吗 #202