up vote 1 down vote favorite
share [g+] share [fb]

I get this error from web server - is this known issue. There is plenty of questions on google -- but not clear solution.

[error] [client ] ModSecurity: Warning. Operator LT matched 20 at TX:inbound_anomaly_score. [file "/etc/httpd/modsecurity.d/base_rules/modsecurity_crs_60_correlation.conf"] [line "31"] [msg "Inbound Anomaly Score (Total Inbound Score: 5, SQLi=, XSS=): Host header is a numeric IP address"] [hostname ""]
link|improve this question
75% accept rate
1  
Are you accessing the machine via IP instead of DNS? This is designed behavior if so, as mod_security is outputting this message in response to the machine being accessed via IP. If you don't want the error you could comment out the rule in the file listed in your error. – Joshua Enfield Sep 15 '10 at 16:02
yes,i'm using ipaddressto access the machine..thanks,dude,I'll try and comment out that line and post the results here. – lakshmipathi Sep 16 '10 at 5:33
1  
For some background info, the reason the rule exists in the default configuration is because in most web sites you have a DNS associated name. So your customer base should be using that name. Lots of malicious bots like to "attack" or find vulnerable machines, by simply incrementing through IP ranges. By blocking these requests by IP at the outset you arguably lower risk. Make sure to remember to restart Apache after the change. – Joshua Enfield Sep 16 '10 at 16:03
I'll keep security risk details in mind,thanks,it worked. – lakshmipathi Sep 17 '10 at 5:49
I'll move my comments into an answer. So you can accept the question. Glad it worked :) – Joshua Enfield Sep 17 '10 at 13:55
feedback

1 Answer

up vote 2 down vote accepted

Are you accessing the machine via IP instead of DNS? This is designed behavior if so, as mod_security is outputting this message in response to the machine being accessed via IP. If you don't want the error you could comment out the rule in the file listed in your error.

For some background info, the reason the rule exists in the default configuration is because in most web sites you have a DNS associated name. So your customer base should be using that name. Lots of malicious bots like to "attack" or find vulnerable machines, by simply incrementing through IP ranges. By blocking these requests by IP at the outset you arguably lower risk. Make sure to remember to restart Apache after the change.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.