SecGeoLookupDb Not Working with Owasp CRS 4.5 Nginx Image

[Dr-Lazarus-V2]

Issue: Lack of GeoLocation Support in OWASP CRS 4.5 Nginx Image

Description:

The OWASP CRS 4.5 Nginx Docker image, which is built on top of ModSecurity v3, is currently compiled with the following configuration flags:

./configure --with-yajl --with-ssdeep --with-geoip --with-pcre2 --enable-silent-rules

However, it appears that support for GeoLocation lookups is missing from this configuration, as the SecGeoLookupDb directive fails to load the GeoIP database. Specifically, the --with-maxmind flag seems to be missing, which is necessary for enabling MaxMind GeoIP database support.

Problem:

When trying to use the following configuration in ModSecurity:

SecGeoLookupDb /path/to/GeoLite2-Country.mmdb

ModSecurity fails to load the database, resulting in the inability to block traffic based on GeoLocation. This issue affects users who need GeoIP-based rules for their Web Application Firewall (WAF) using the CRS 4.5 Nginx image.

Steps to Reproduce:

1. Use the OWASP CRS 4.5 Nginx image.
2. Configure SecGeoLookupDb to point to a valid GeoIP database (e.g., /path/to/GeoLite2-Country.mmdb).
3. Attempt to block traffic based on GeoLocation rules.
4. Observe that the GeoIP database fails to load, and GeoLocation-based blocking is unavailable.

[Dr-Lazarus-V2]

I have a proposed solution to update the following file: modsecurity-crs-docker/nginx/Dockerfile

1. Added libmaxminddb-dev to the list of installed packages:

   libmaxminddb-dev

2. Modified the ModSecurity configuration to include --with-maxmind:

   ./configure --with-yajl --with-ssdeep --with-geoip --with-pcre2 --with-maxmind --enable-silent-rules;

3. Added libmaxminddb-dev to the additional packages:

   libmaxminddb-dev

These are the main changes reflecting the use of maxmind for GeoIP lookups instead of the previous geoip module.

[theseion]

Thanks @Dr-Lazarus-V2.

[fzipi]

Thanks @Dr-Lazarus-V2 . Can you provide a patch for nginx/Dockerfile, nginx/Dockerfile-alpine and openresty/Dockerfile-alpine? Thanks! 🚀

[Dr-Lazarus-V2]

@fzipi, How do I provide a patch?

[fzipi]

Yes, can you? Just editing the files in the web interface will guide you in the process...

[Dr-Lazarus-V2]

Okiee, I will try and raise a patch today.

[fzipi]

Fixed by #288.