Resolved Web Application Firewall: Security rule IDs broken/reset

[KlausO]

Server operating system version

AlmaLinux release 8.10 (Cerulean Leopard)

Plesk version and microupdate number

Plesk Obsidian 18.0.68

Hello,

this is an issue that first appeared last week after updating from Obsidian 18.0.67 to 18.0.68:

Our Web Application Firewall uses Comodo (free) with daily rule updates. We switched off the following security roles

211180
211170
210730
210040
210220

Whenever Comodo rules are changed our rules are replaced by

210710
222212
218500

The replacement occures after the daily update. It can be manually reproduced:

1. Open "Tools & Settings -> Web Application Firewall (ModSecurity)"
2. Enter your desired rules in "Security rule IDs"
3. Hit OK and open "Tools & Settings -> Web Application Firewall (ModSecurity)" again.

Your rules should be saved as expected in "Security rule IDs". They are also saved in server.conf and psa-database table WebServerSettingsParameters. Everything is working.

4. Open "Tools & Settings -> Web Application Firewall (ModSecurity) -> Settings" and disable updates (remove checkbox).
5. Hit OK and open "Tools & Settings -> Web Application Firewall (ModSecurity)" again.

Your rules are gone and 210710, 222212, 218500 are there.

We don't know if this is a bug or if we are missing something. Maybe custom rules are limited on AlamaLinux 8? What can be done? Thank you!

 

[Sebahat.hadzhi]

Thanks for the report, @KlausO . I was able to reproduce the behavior and will pass it for further investigation to our team. I will update you with more details as soon as possible.

 

[Azurel]

No way! This must be a very bad joke! So many false positive rules are gone—that's really frustrating. I never thought I’d need to back this up as well. Please focus on quality control instead of unnecessary features! Now I have extra work to keep an eye on this again. Grrrrrrr

 

[Azurel]

For all those who stumble across the topic in time. Under /var/lib/psa/dumps there is the file mysql.daily.dump.8.gz and in it I found my old rules. Search for

INSERT INTO `WebServerSettingsParameters` VALUES (1,'configPreset','fast'),(1,'filterById','HERE-ARE-YOUR-RULES'),(1,'ruleEngine','On'),(1,'ruleSet','comodo_free')

 

[Sebahat.hadzhi]

The behavior was recognized as a bug identified with ID PPP-67814. Thank you for bringing our attention to it, @KlausO . At this point, I cannot provide an ETA on when a fix will be released. You can monitor the change log here.

Please focus on quality control instead of unnecessary features!

I understand the potential negative impact of overriding the excluded rules could have and I am sorry for any possible inconvenience caused. However, the misconception that our team is neglecting existing issues or compromising quality control just because they are introducing new features is a bit unfair. I can assure you that automated and manual testing is in place. Unfortunately, there isn't a bulletproof method that will eliminate all possible software bugs.

 

[Azurel]

Mistakes happen, but in this case, a crucial check was clearly missed – this urgently needs a hotfix. Comodo is good, but I had to disable around 20 rules because they were blocking hundreds of visitors due to false-positives. Now, I have to not only reapply the filters daily but also check if issues arise again. This is not just a minor typo.

 

[pleskpanel]

Quite slow on pushing out this rather critical issue; hopefully there is an update in very short order.

 

[Sebahat.hadzhi]

Our team is already working on introducing a hotfix (PPP-67896) for this issue, which is scheduled for release in the upcoming week.

 

[pleskpanel]

Plesk Obsidian 18.0.68 Update 2 rolling out today:

Fixed Product Issues​

Linux​

• Enabling or disabling ModSecurity rule set updates no longer resets the rule IDs specified in the “Security rule IDs” textbox to their default values. (PPPM-14876)