Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a directory/site set-up like this on my Apache/2.2.19 (Win32) Server using mod_security + core ruleset/2.2.1

/website1/login.php
/website2/login.php
/website3/login.php
/websiteN/login.php

In my modsecurity_crs_10_config.conf I have

setvar:'tx.brute_force_protected_urls=login.php'

The problem is that it won't work unless I type in the full path for each of the login.php pages, like so:

setvar:'tx.brute_force_protected_urls=/website1/login.php /website2/login.php andSoOn'

I have tried other ways with RegEx to work around it (e.g. /(.*)/login.php) but I can't seem to get it.

So, question is basically; how do you enforce BFP on all pages called login.php on the server?

Thanks.

share|improve this question
add comment

2 Answers

Try this:

setvar:'tx.brute_force_protected_urls=/login.php'

If it doesn't work, I suggest you enabling debug to see what the logs say.

share|improve this answer
    
I can't see anything of interest in the log, just says it's checking against the url (/login.php) and does not return with a valid hit. I was trying to use .htaccess to configure, which would make life easier, but it won't work with v2 for security reasons. –  PadraigD Sep 8 '11 at 10:15
    
When code setvar:tx.brute_force_protected_urls=/login.php code the log states code Warning. Match of "within %{tx.brute_force_protected_urls}" against "REQUEST_FILENAME" required code –  PadraigD Sep 8 '11 at 10:51
add comment
up vote 0 down vote accepted

I got it working. In 'modsecurity_crs_11_brute_force.conf' I had to change line 39:

SecRule REQUEST_FILENAME "!@within %{tx.brute_force_protected_urls}"  ...

to

SecRule REQUEST_FILENAME "!@contains %{tx.brute_force_protected_urls}" ...

and in 'modsecurity_crs_10_config.conf', have:

setvar:'tx.brute_force_protected_urls=/login.php' ...

Thanks for the help.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.