Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a blog which has a post with the following as url

/blog/insert-into-tablea-select-fields-from-tableb-for-specific-values-only/

This was working well until recently.

I got a different HTTP Status like 412 Precondition Failed which is not caused by request i am sure of it. They just want to send a status code.

All other urls are working except this.

When i questioned them they said that they have added mod security and that would have prevented. And they removed mod security for my user profile yesterday and the page is loading well.

The same has been done for mysql... certain queries are failing and they answered that mod security would have prevented it.

Besides, before three or four months the hosting company has hosted with softlayer and not it is a different server in India.

My questions are

  1. do other servers use mod security to filter vulnerable queries and requests?
  2. where to get a list of vulnerable requests and sql queries? so that i can make sure that my queries and requests pass mod security instead of getting blocked.
  3. Is it possible for the server to remove or lower the restriction used mod security? is so then i can suggest them.

???

share|improve this question

closed as off topic by Michael Hampton, Ward, mdpc, Mathias R. Jessen, Khaled Jan 12 '13 at 7:26

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

    
You really need to talk to your provider about this -- As you are not the system administrator there's nothing you can do, and nothing we can advise you other than "Talk to your provider" –  voretaq7 Jan 11 '13 at 20:13

1 Answer 1

  1. I'm working at a bank, and we're using mod_security.
  2. There's a standard ruleset, but your provider may have made some changes to it, so it'ds best to ask them for their ruleset. (See below.)
  3. mod_security is configurable, so it's possible for your provider to alter what restrictions are applied to your server. Of course, that doesn't mean that they're actually willing to do so, since it'll increase their workload to keep several different rulesets up to date.

There's more information, including about the core ruleset, at the modsecurity website

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.