Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to add the following line into my .htaccess file in order to get my website working with mod_security

SecFilterScanPOST Off

but then I get an error

Internal Server Error

The server encountered an internal error or misconfiguration and was unable to complete your request.

In my WebHost manager I see the following message: mod_security is installed and running!

I do not know what I did wrong?

share|improve this question

migrated from stackoverflow.com Jan 15 '10 at 12:52

This question came from our site for professional and enthusiast programmers.

2  
Check apache logs for details –  Ivan Nevostruev Jan 13 '10 at 16:29
    
In the logs I get the following message [Wed Jan 13 18:29:12 2010] [alert] [client .............] /home/..../public_html/.htaccess: Invalid command 'secfilterscanpost', perhaps mis-spelled or defined by a module not included in the server configuration –  Roland Jan 13 '10 at 16:32
add comment

5 Answers

That module is probably not loaded. Try it within a <IfModule> block to avoid such error:

<IfModule mod_security.c>
    SecFilterScanPOST Off
</IfModule>

But note that this doesn’t solve your problem. It just avoids that internal error.

To solve your problem, make sure that the mod_security module is loaded. This is done with the LoadModule directive.

share|improve this answer
    
In my WebHost manager I see the following message: mod_security is installed and running! –  Roland Jan 13 '10 at 16:35
    
@Roland: Then your mod_security module is probably not intended to be used in a .htaccess file. Maybe it’s just allowed in the server/virtual host configuration. –  Gumbo Jan 13 '10 at 16:46
add comment

You said in your comments than in your log file you can read "invalid command 'secfilterscanpost', perhaps mis-spelled or defined"

If you are using mod_security2, the SecFilterScanPOST is obsolete and you should migrate it to SecRequestBodyAccessas , this is explained in the migration document.

http://www.modsecurity.org/documentation/ModSecurity-Migration-Matrix.pdf

share|improve this answer
    
Very helpful link! –  Elliot B. Oct 30 '13 at 17:57
add comment

Check your apache error log (on linux it is usually in /var/log/http/error_log or similar).

share|improve this answer
add comment

You can check if the SecFilterScanPOST directive is allowed in .htaccess files (probably via an AllowOverride option in your Apache or VirtualHost config file).

share|improve this answer
add comment

If your mod_security version is 2 or greater you can't put directives in a .htaccess file - only httpd.conf will do. I suppose they'll add this to the FAQ sooner or later.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.