iRedAdmin-rule-exclusions-plugin

This plugin contains rule exclusions to fix false positives when using iRedMail's iRedAdmin with the OWASP Core Rule Set.

Note

This plugin hasn't been tested against iRedAdmin Pro/Enterprise I don't have access to a paid licence to test these editions. Any issues/PRs are welcome for paid editions, but don't expect this plugin to work flawlessly. iRedAdmin OSE should work without issue.

Requirements

• CRS Version 4.0 or newer
• ModSecurity compatable Web Application Firewall

Installation

For full and up to date instructions on installing plugins, please refer to How to Install a Plugin in the official CRS documentation.

Conditionally enable plugins for multi-application environments

For full and up to date instructions on how to conditionally enable/disable this plugin on a multisite environment, please refer to Conditionally enable plugins for multi-application environments in the official CRS documentation.

Configuration

By default, iRedAdmin's base URL is set to /iredadmin/ which is also the default base URL supported by this plugin. If you've changed iRedAdmin's base URL, then this plugin can be configured to use a different base url such as /admin/ or a random string to obfuscate iRedAdmin's location by editing rule 9519001 in iredadmin-rule-exclusions-config.conf.

Warning

It's not recommended to set the base url to /, which means the plugin will run on all URL paths. Most iRedMail installations will include other web applications such as RoundCube or SOGo hosted under the same domain name, in such cases if a bypass is found in this plugin, then other web apps unrelated to iRedAdmin will be impacted.

Disabling the plugin

The plugin can be disabled by uncommenting rule 9521000 inside plugins/iredadmin-rule-exclusions-config.conf or by removing the includes for this plugin.

Reporting false positives

If you find a false positive that this plugin does not cover then please open a new issue or pull request, if creating an issue then please include the following details:

1. CRS Version
2. ModSecurity/Coraza Version
3. modsec audit logs
4. what caused the false positive

License

Copyright (c) 2023-2026 Esad Cetiner

This plugin is distributed under GNU General Public License V2 (GPLv2), please see the included LICENSE file for details.