Question: What is the purpose of the backend?

[thomas-mc-work]

The backend referenced in the docker-compose.yml:

traefik-modsecurity-plugin/docker-compose.yml

Line 30 in bba1950

- BACKEND=http://dummy

What's the purpose of it?

If I stop it's container then every request is replied by an engine nginx error page. (beyond that: In terms of security I'd recommend the nginx server to stay anonymous and serve a neutral error page, even if the scenario isn't very common).

[john8329]

I agree it's confusing, it's not really a middleware if it can only forward to a single backend. It's not really useful, having a double proxy is better at this point. The whole purpose of a plugin is avoiding having both traefik and a separate WAF, but if it has to forward it then it's the same as doing two cascading proxies (waf and traefik). It's also more secure since the entry point is a hardened one.

[sjmf]

I know this is an old question, but I've been looking at the code for this a lot recently so I think I can answer it for any future visitors. To my understanding, dummy is just a workaround for the way nginx is configured in the upstream container: proxy_pass needs a destination to forward traffic to, or nginx startup will fail.

This question actually relates to the owasp/modsecurity-crs container, which is pulled in the compose file. The documentation for its environment variables is here:

https://github.com/coreruleset/modsecurity-crs-docker/blob/main/README.md#common-env-variables

BACKEND: Partial URL for the remote server of the ProxyPass (httpd) and proxy_pass (nginx) directives

So $BACKEND is used in the proxy_pass directive. $BACKEND is one of the many environment vars which get replaced in that container at runtime by the script /docker-entrypoint.d/20-envsubst-on-templates.sh. You can verify this (here in the nginx case):

docker run -it --entrypoint /bin/sh owasp/modsecurity-crs:nginx-alpine
$ grep -rn "BACKEND" /etc/nginx/
./templates/includes/proxy_backend.conf.template:17:proxy_pass ${BACKEND};

After those scripts run, the variable gets interpolated to:

/etc/nginx $ grep -rn "dummy" .
./includes/proxy_backend.conf:17:proxy_pass http://dummy;

That gets included in default.conf:

./conf.d/default.conf:26:        include includes/proxy_backend.conf;

It's likely possible to work-around providing $BACKEND by overriding /etc/nginx/conf.d/default.conf at runtime to remove the include directive for the proxy backend.

I suspect that the OWASP CRS Docker Image owasp/modsecurity-crs is usually configured as the front-end reverse proxy, but in the use case for this plugin, it's simpler to provide the additional dummy container than it is to create a whole new docker image. It's also problematic mounting files into the container over the top of the original nginx conf, because the scripts in /docker-entrypoint.d expect the existing ones. You'd have to override both the scripts and the config.

This question could perhaps be answered in more depth by the owasp/modsecurity-crs container maintainers, as it is a feature of that container, rather than the traefik-modsecurity-plugin.

I'm also not certain this repository is maintained any more.

[acouvreur]

I'm also not certain this repository is maintained any more.

I am not actively developping fixes or features.
But I'll gladly review and merge pull requests!