Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

How do you disable modsecurity for just a specific directory. I'm getting errors in phpMyAdmin that are caused by modsecurity tripping based on rules. I have the following files set up:

# /etc/httpd/modsecurity.d/modsecurity_crs_15_customrules.conf
<LocationMatch “^/phpMA/”>
    SecRuleEngine Off
</LocationMatch>

# /etc/httpd/modsecurity.d/modsecurity_crs_60.custom.conf
<LocationMatch '^/phpMA/*'>
    SecRuleRemoveById 950004
    SecRuleRemoveById 950005
    SecRuleRemoveById 950006
    SecRuleRemoveById 960010
    SecRuleRemoveById 960012
</LocationMatch>

From what I can find the first file should disable it, but it still trips, so I tried adding the rule IDs it is tripping to the 60 file, but it still complains.

I'm running the following packages on CentOS 5.3:

  • mod_security-2.5.0-jason.2
  • httpd-2.2.8-jason.3
  • mod-php5-apache2-zend-ce-5.2.10-65
share|improve this question

1 Answer 1

up vote 4 down vote accepted

SecRuleEngine Off must work . Have you tried to put SecRuleEngine inside Directory:

<Directory /var/www/site/phpMA>
SecRuleEngine Off
</Directory>

instead of LocationMatch ?

share|improve this answer
    
Tried adding that to the 15 file and still getting the same errors being caught in modsecurity_audit.log –  dragonmantank Aug 21 '09 at 16:15
    
Are the files modsecurity_crs_15_customrules.conf and modsecurity_crs_60.custom.conf included (not commented) in your /etc/httpd/conf.d/mod_security.conf ? –  HD. Aug 21 '09 at 16:28
    
facepalm No, they weren't. That took care of it. –  dragonmantank Aug 21 '09 at 17:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.