Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Update I think we've solved this; the problem appears to have been a result of the /modsec_storage directory having an incorrect value for its SELinux context type.

However, we're still not sure, because although after I changed the SELinux context type value, Apache was able to create files in that directory for the global and ip collections (global.dir/global.pag and ip.dir/ip.pag), the new files still have zero bytes.

I'm new to ModSecurity and am not sure if the files are empty because something is wrong with the configuration or if ModSecurity has simply determined it doesn't need to store IP addresses persistently after each transaction ends.

Anyone able to offer guidance here?


I've recently installed ModSecurity (v2.5.12 / CRS v2.0.8) on our production server, and everything works great, except for these errors that it keeps writing to the Apache error log:

Failed to access DBM file "/modsec_storage/global": Permission denied [hostname "www.internationalstudent.com"] [uri "/includes/soc_bookmarks/images/delicious.png"] [unique_id "LZ6jc38AAAEAAFO6408AAABO"]
Failed to access DBM file "/modsec_storage/ip": Permission denied [hostname "www.internationalstudent.com"] [uri "/includes/soc_bookmarks/images/delicious.png"] [unique_id "LZ6jc38AAAEAAFO6408AAABO"]

After following the instructions for file permission settings in the ModSecurity handbook by Ivan Ristic, with no success, I created a /modsec_storage directory, set the owner & group to apache, and set the permissions for the directory recursively to 777.

However, ModSecurity is still reporting the same permission errors, so I am stumped. Can anyone tell me how to fix this?

share|improve this question

1 Answer 1

Try setenforce 0

It's very possible it's an SELinux issue in which case I believe you may need to assign an httpd context to the folder. If the above fixes it you might try:

chcon -R system_u:object_r:httpd_sys_content_t /modsec_storage

Is the folder modesec_storage under your root folder?

share|improve this answer
    
It is a top-level directory (e.g. /modsec_storage). –  tommytwoeyes Oct 13 '10 at 21:20
    
Thanks, that did enable Apache to create the files ModSecurity needed to store data; however, they still have 0 bytes after hundreds of transactions have been logged today. No, it's not under /root - it is: /modsec_storage –  tommytwoeyes Oct 13 '10 at 21:30
    
Are you seeing any new errors in the logs/did the old errors go away? –  Joshua Enfield Oct 14 '10 at 20:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.