[sclug] Web Application Firewall

[Graham Swallow]

I get the digestified version,
so it is already past the end of tomorrow.

To proxy each web request, would take a long time to develop.
The web server code needs to be reviewed end-to-end and do it itself.
A second, similar filter is a good idea, but not overnight.

Maybe the person who asked did a 'mixed-metaphor' request,
and wants with a TCP/IP firewall for a web application.

Thats a lot simpler, with port 80, 443, and not much else,
all basic ITP rules, personally I like the 'established' module-rule,
inparticular nothing outgoing (DNS). That would protect the web
server from being hacked in ways other than the web service itself.
IE something that an IIS server would need.

Graham


Message: 1
> Date: Wed, 28 Sep 2011 18:17:54 +0100
> From: Sapan Ganguly <sapan.ganguly at gmail.com>
> Subject: [sclug] Web Application Firewall?



>

is that I've been told that I need to provide a web application firewall by
> the end of tomorrow.  There is a Windows IIS web server that needs some
> kind
> of extra protection.  Does anyone know of a ready made free web application
> firewall that is provided as a virtual appliance?
>
> I know it is a long shot but I've been given very little time to do this,
> I've had a look at things like ModSecurity which I can go ahead and set up
> and configure if I can't find something ready made.  OpenWAF (
> http://openwaf.org) looks promising, has anyone used it?
>
> Thanks,
>
> Sapan
>
>
>