0

Does a mod_security execution/rule error or errors in general block users from visiting my website? Ive got many rule and execution errors, Ive just whitelisted these rules but maybe I could just ignore them.

The website is in production with visitors so I don't want to try and see if I do get blocked, if I enable modsec in "sharp" mode.

Thanks in advance.

Improve this question

1 Answer 1

Reset to default
0

Depends how the rules are written but in general, yes rules are written to block.

Other than that can't really answer unless you give more specifics on what rules you're running. Most common are the OWASP Core Rule Set, most of which are designed to block depending which detection mode you are running that in.

Best practice is to run ModSecurity in DetectionOnly mode initially and fine tune rules with overrides to remove the inevitable false positives, before you switch to the blocking "On" mode.

DetectionOnly mode should not allow any "disruptive actions" like blocking, with a couple of important things to be aware of:

1) Rules can override this with a Ctl action to switch from DetectionOnly to On. Not aware of any CRS rules which do this.

2) "Allow" counts as a disruptive action. This action is used to whitelist certain actions or calls - for example to reduce unnecessary calling of ModSecurity rules for static resources. In DetectionOnly mode this action is ignored and all subsequent following rules are run. In On mode this action would kick in and ModSecurity would skip the rest of the request. I think this is counter intuitive and allow should not be considered a "disruptive action" so DetectionOnly more close resembles On mode without the blocking. Therefore when I add any rules with "allow" action I also add "ctl:ruleEngine=On" to force the allow even in DetectionOnly mode.

Adding appropriate "allow" whitelisting can be very important for performance for high load servers and I would encourage its use. The CRS has a couple of these as optional rules but in my opinion they don't go far enough.

Improve this answer
5
  • Thanks for your answer. DetectionOnly is what i'm running now to fine-tune everything. What I meant with "sharp" mode is just what I called it when you set it to "on" instead of "DetectionOnly". When it blocks. Yes Im running OWASP Core Rule Set, and ive got a few rules that just gets an execution error, "Rule Processing failed", "PCRE limits exceeded" for instance. I got two now recently that didn't even specify which rule, it's just "ModSecurity: Exec: Execution failed while reading output: /bin/runAV (End of file found)" and "ModSecurity: Rule processing failed."
    – Krazos
    May 7, 2015 at 23:59
  • I added further detail to my answer, explaining DetectionOnly mode. The only one of those particular errors I recognise is "PCRE limits exceeded" and I see that for a few, really complex, queries with large or many parameters. You can increase these limits but think that requires a recompile. The others could also be that Mod Security/Apache is getting overwhelmed. See my comments about adding "allow" rules in my answer. I think (though not 100% sure) that Mod Security doesn't block on these types of errors and only if an explicit rule was auctioned to block.
    – Barry Pollard
    May 8, 2015 at 6:28
  • Thank you. As i'm running DetectionOnly now nothing gets blocked, and I've fine-tuned everything. So the only thing I really meant was that if i turn ruleEngine to "on" will these execution errors block my visitors?
    – Krazos
    May 8, 2015 at 13:35
  • "PCRE limits exceeded" doesn't block. "Rule Processing failed" should only appear in debug logs. Do you have debug on? If so turn that off as that takes up an awful lot of processing and log files. Only turn on to debug rules. "ModSecurity: Exec: Execution failed while reading output: /bin/runAV (End of file found)" I've never seen before but I don't run the AV rules so maybe something to do with that.
    – Barry Pollard
    May 8, 2015 at 13:49
  • Yes it seems that mod_security can't find Clamav, And I can't find any info at all how to set up my AV with modsec.
    – Krazos
    May 10, 2015 at 17:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .