Issue Web Application Firewall: Security rule IDs broken/reset

[KlausO]

Server operating system version

AlmaLinux release 8.10 (Cerulean Leopard)

Plesk version and microupdate number

Plesk Obsidian 18.0.68

Hello,

this is an issue that first appeared last week after updating from Obsidian 18.0.67 to 18.0.68:

Our Web Application Firewall uses Comodo (free) with daily rule updates. We switched off the following security roles

211180
211170
210730
210040
210220

Whenever Comodo rules are changed our rules are replaced by

210710
222212
218500

The replacement occures after the daily update. It can be manually reproduced:

1. Open "Tools & Settings -> Web Application Firewall (ModSecurity)"
2. Enter your desired rules in "Security rule IDs"
3. Hit OK and open "Tools & Settings -> Web Application Firewall (ModSecurity)" again.

Your rules should be saved as expected in "Security rule IDs". They are also saved in server.conf and psa-database table WebServerSettingsParameters. Everything is working.

4. Open "Tools & Settings -> Web Application Firewall (ModSecurity) -> Settings" and disable updates (remove checkbox).
5. Hit OK and open "Tools & Settings -> Web Application Firewall (ModSecurity)" again.

Your rules are gone and 210710, 222212, 218500 are there.

We don't know if this is a bug or if we are missing something. Maybe custom rules are limited on AlamaLinux 8? What can be done? Thank you!

 

[Sebahat.hadzhi]

Thanks for the report, @KlausO . I was able to reproduce the behavior and will pass it for further investigation to our team. I will update you with more details as soon as possible.

 

[Azurel]

No way! This must be a very bad joke! So many false positive rules are gone—that's really frustrating. I never thought I’d need to back this up as well. Please focus on quality control instead of unnecessary features! Now I have extra work to keep an eye on this again. Grrrrrrr

 

[Azurel]

For all those who stumble across the topic in time. Under /var/lib/psa/dumps there is the file mysql.daily.dump.8.gz and in it I found my old rules. Search for

INSERT INTO `WebServerSettingsParameters` VALUES (1,'configPreset','fast'),(1,'filterById','HERE-ARE-YOUR-RULES'),(1,'ruleEngine','On'),(1,'ruleSet','comodo_free')