IDS/IPS vs WAP.

Hello,
An IDS/IPS like Suricata-IDS can't protect a web server like Apache?



Is a WAF mandatory to protect a website?

Thank you.

Is your website running webapps that can be run in users browsers? Then a WAF can help protect it.
Most websites will not get a lot of benefit from a WAF since they are only doing basic things, like let letting people login and post questions/answers.
If the website is used like a portal to access other servers, then a WAF between the web server and the others will help protect them.

Originally Posted by uteck Is your website running webapps that can be run in users browsers? Then a WAF can help protect it. Most websites will not get a lot of benefit from a WAF since they are only doing basic things, like let letting people login and post questions/answers. If the website is used like a portal to access other servers, then a WAF between the web server and the others will help protect them.

Yes, it is a WordPress website. When people can login and post, then some attacks like XSS and SQL Injection happen!

A WAF sits between the webserver and other application servers or databases, so will not help you much in this case since things are all on the same server. Odds are the attacks are coming from security holes in a plugin you installed.

You need some sort of intrusion detection system. If your server has SELinux, you could try setting it to enforcing mode which may prevent exploitation from the plugin exploits. Or better yet, remove the plugin that is causing the breach.

A WAF sits between the webserver and other application servers or databases...

Can you show me an example of the application servers?
About SELinux:

$ ls -Z /var/www/
    system_u:object_r:httpd_sys_content_t:s0 apache_pb.svg.bak
system_u:object_r:httpd_sys_script_exec_t:s0 cgi-bin
    system_u:object_r:httpd_sys_content_t:s0 html
 system_u:object_r:httpd_sys_rw_content_t:s0 wp
$ ls -Z /var/www/wp/
    system_u:object_r:httpd_sys_rw_content_t:s0 cgi-bin
    system_u:object_r:httpd_sys_rw_content_t:s0 error_log
    system_u:object_r:httpd_sys_rw_content_t:s0 googlee4e6cdb3b56c49dd.html
   system_u:object_r:httpd_sys_script_exec_t:s0 index.php
unconfined_u:object_r:httpd_sys_rw_content_t:s0 license.txt
    system_u:object_r:httpd_sys_rw_content_t:s0 readme.html
    system_u:object_r:httpd_sys_rw_content_t:s0 ssl
   system_u:object_r:httpd_sys_script_exec_t:s0 wordfence-waf.php
   system_u:object_r:httpd_sys_script_exec_t:s0 wp-activate.php
    system_u:object_r:httpd_sys_rw_content_t:s0 wp-admin
   system_u:object_r:httpd_sys_script_exec_t:s0 wp-blog-header.php
   system_u:object_r:httpd_sys_script_exec_t:s0 wp-comments-post.php
   system_u:object_r:httpd_sys_script_exec_t:s0 wp-config.php
unconfined_u:object_r:httpd_sys_rw_content_t:s0 wp-config-sample.php
    system_u:object_r:httpd_sys_rw_content_t:s0 wp-content
   system_u:object_r:httpd_sys_script_exec_t:s0 wp-cron.php
    system_u:object_r:httpd_sys_rw_content_t:s0 wp-includes
   system_u:object_r:httpd_sys_script_exec_t:s0 wp-links-opml.php
   system_u:object_r:httpd_sys_script_exec_t:s0 wp-load.php
   system_u:object_r:httpd_sys_script_exec_t:s0 wp-login.php
   system_u:object_r:httpd_sys_script_exec_t:s0 wp-mail.php
   system_u:object_r:httpd_sys_script_exec_t:s0 wp-settings.php
   system_u:object_r:httpd_sys_script_exec_t:s0 wp-signup.php
    system_u:object_r:httpd_sys_rw_content_t:s0 wp-statistics.log
   system_u:object_r:httpd_sys_script_exec_t:s0 wp-trackback.php
   system_u:object_r:httpd_sys_script_exec_t:s0 xmlrpc.php
    system_u:object_r:httpd_sys_rw_content_t:s0 zhupclient_key.1567309333.html
    system_u:object_r:httpd_sys_rw_content_t:s0 zhupclient_key.1567317901.html

Is it OK?