The mod-security tag has no wiki summary.
0
votes
1answer
39 views
apt-get update Error
I get the following error when typing:
# apt-get update
W: Failed to fetch http://etc.inittab.org/~agi/debian/libapache-mod-security2/etch/Packages 404 Not Found [IP: 80.28.139.208 80]
E: Some ...
-1
votes
0answers
15 views
how to monitor/filter whm/cpanel using mod_security?
I want to monitor whm not included website within it with the help mod_Security
I've installed in on my server but yet I don't know how can I make mod_security available to monitor whm/cpanel also.
...
1
vote
1answer
43 views
What do the audit log records for ModSecurity actually mean?
We have ModSecurity setup to log to modsec_audit.log for Apache2. Today we have had 2259 entries created in this log with a referrer of:
Mozilla/5.0 (compatible; bingbot/2.0; ...
0
votes
1answer
32 views
Mod Security log monitoring
Is there a web based log management utility present for Mod Security? As parsing the logs of Mod Security is a big headache. I can only see traditional log monitoring systems but not any, which is ...
2
votes
1answer
79 views
Where I can find ModSecurity Rules for Specific Applications
Where I can find ModSecurity Rules for Specific Applications specially joomla, wordpress, mambo ?
1
vote
1answer
83 views
Why does mod_security require an ACCEPT HTTP header field?
After some debugging, I found that the core ruleset of mod_security blocks requests that don't have the (optional!) ACCEPT header field.
This is what I find in the logs:
ModSecurity: Warning. ...
0
votes
0answers
70 views
mod_security configuration with virtual host
Prologue: I am very new to Apache, ModSecurity & web admin stuff in general. But I want desperately to learn, so if I mess up nomenclature or technologies please let me know and I will fix it. ...
-3
votes
1answer
70 views
mod_security: How to allow ssh/http access for admin?
I am going to be installing mod_security on my AWS EC2 Linux instance tonight and need a little help/reassurance. The only thing I am truly worried about right now is making sure my (admin) access to ...
3
votes
1answer
131 views
modsecurity: block ips, that visited 404 pages more than 10 times in a minute
we're using mod_security and we have currently issues with some bots.
i would like to block ips, that visited 404 pages more than 10 times in a minute.
How can this be done? How can i poll the 404 ...
1
vote
2answers
57 views
error: libxml2 is required (modsecurity)
I am trying to install mod_security from source. when i run ./configure I get this error:
configure: error: libxml2 is required
After that error, I executed this command:
yum install libxml2
It ...
3
votes
2answers
387 views
mod_security - PCRE limits exceeded
Just about on every request I am getting the following error:
Rule execution error - PCRE limits exceeded (-8): (null).
After a bunch of googling the only solutions seem to be
a) Add the following ...
0
votes
1answer
107 views
installing mod_security causing apache service start to fail
I installed mod security using this tutorial http://www.linuxmaza.... . After installing I got the error described and followed the steps to solve it. The only thing I did differently was updating ...
-1
votes
1answer
58 views
gotroot mod_security rules
Are the gotroot mod_security rules any good?
I've heard that you will get a lot of false positives and before I try and use them on a live box just wanted to know if anyone else has experience with ...
0
votes
0answers
83 views
Syntax for excluding certain file extensions from Modsecurity Rule?
I'm trying to exclude CSS and JS files from a certain ModSecurity rule and have not met with success with the following entered in my crs_69_customrules.conf:
<FilesMatch "\.(css|js)$">
...
0
votes
0answers
39 views
Mod_proxy working with Mod_security
I have a weird problem, i have multiple proxy-passes set on one vhost, and mod_sec only seems to care for the very last proxy-rule. is that a desired or configurable behavior?
Thanks!
Alessandro
0
votes
0answers
30 views
how do i exclusivly log requests of phpscripts with mod-security?
how do i only log (audit) requests (get and post parameters) to php scripts with modsecurity?
i dont want the static content to fill up my logs
Right now i m having everything logged.
i tried ...
1
vote
1answer
190 views
Configuring mod_security on Ubuntu 10.04
After spending pretty much a non-stop 24 hours trying and failing to setup mod_security in Ubuntu 10.04 LTS - I've finally decided that I'm going to need some help (and so asked here).
I've tried ...
0
votes
2answers
113 views
How to use RegEx for mod_security
I have a directory/site set-up like this on my Apache/2.2.19 (Win32) Server using mod_security + core ruleset/2.2.1
/website1/login.php
/website2/login.php
/website3/login.php
/websiteN/login.php
...
-1
votes
1answer
316 views
Apache2 mod_security simple default deny rules for specific directory
How to configure the simplest useful default-deny rule set for mod_security?
I want to configure mod_security to allow only very specific queries to single directory:
In short: I use Apache as a ...
0
votes
1answer
326 views
sources.list entry for mod_security testing release?
I have a debian "squeeze" installation, but the mod_security delivered with this release is quite old. So I'm thinking of adding an additional line to my sources.list to get the "wheezy" version ...
2
votes
2answers
1k views
mod_unique_id: unable to find IPv4 address of FQDN despite setting etc/hosts and Apache ServerName
I'm trying to get mod_security and hit the very common hostname error of
[alert] (EAI 2)Name or service not known: mod_unique_id: unable to find IPv4 address of "computername.domain.com"
This ...
0
votes
0answers
148 views
I want fail2ban to block what modsecurity has blocked 3 times, not what appears in the audit log 3 times
I'm trying to get fail2ban to block IPs that mod_security blocks three times. However, fail2ban is instead blocking anything which simply shows up in the mod_security log three times.
This is all ...
0
votes
1answer
324 views
HAProxy health check is logged as TCP_MISS/000 in Squid
We have a HAProxy front-end, load balancing a layer of Squid servers, which handles data from an Apache ModSecurity layer, and which ultimately serves up data from IIS cluster. Each Squid server is ...
3
votes
1answer
155 views
Looking for a good web penetration testing client
I'm implementing mod_security on an apache server. In order to test the effectiveness of the protection, I am looking for a client that can generate a set of predefined malicious HTTP requests. I will ...
1
vote
2answers
197 views
what is the impact of increasing the SecResponseBodyLimit from default value (512k) to (5M)?
I installed the mod_security version 2.5.13 with apache2 and I'm facing problem with SecResponseBodyLimit:
( ModSecurity: Output filter: Response body too large (over limit of 524288, total not ...
1
vote
1answer
615 views
How do I enable mod_security in Ubuntu 10.04?
A quick run through of what I've done:
apt-get install libapache-mod-security
a2enmod mod-security
create /etc/apache2/mod_security_rules/ with base_rules and optional_rules from the latest core ...
1
vote
1answer
301 views
mod_security never tells what the problem is
Normally I would just pester my provider to disable the rule. And while he certainly deserves pestering, I've done that way too often already for the low service price.
(Like always this is about a ...
1
vote
2answers
194 views
Where does Ubuntu 10.04 store the configuration file of mod-security?
I've installed libapache-mod-security on Ubuntu 10.04. The only configuration file I've been able to find is this one:
cat /var/lib/dpkg/info/libapache-mod-security.conffiles
...
1
vote
2answers
216 views
mod_security IP collection key not being set correctly
I'm using an IP collection in a load balanced setup, I therefor want mod_security to act on the x-forwarded for header instead of the REMOTE_ADDR. Here is my rule:
SecAction ...
0
votes
2answers
568 views
Why doesn't my mod_security catch / log anything?
I installed mod_security on my Ubuntu GNU/Linux server but when I send some simple requests to the web server that should match even the simplest rules, I fail to see any alerts or any log files that ...
0
votes
1answer
291 views
What is this mod_security rule trying to prevent?
Today my IP was blocked by my server. I was told it was because of a mod_security rule that got triggered. I'm told that the regex that got triggered was
^((?:(?:POS|GE)T|OPTIONS|HEAD))
I don't ...
1
vote
1answer
241 views
What web application firewall do you use? What should I use?
What web application firewall do you use? I'm primarily interested in something I can deploy on the perimeter that can protect multiple Apache and IIS servers, but I'd like to hear all answers. Tell ...
2
votes
1answer
144 views
why use apache's LoadFile?
Installing mod_security, the instructions direct us to add:
LoadFile /usr/lib/libxml2.so
LoadFile /usr/lib/liblua5.1.so
to httpd.conf.
I'm wondering why they might prefer LoadFile to linking with ...
0
votes
2answers
209 views
Alternatives to ModSecurity for Postdata-filtering
I've found using ModSecurity cumbersome for logging/denying regex matches in postdata but I'm having trouble finding alternatives. I looked into various proxy solutions, but I can't seem to find any ...
0
votes
2answers
327 views
mod_security on an OWA front end
When using mod_security (installed from EPEL) with apache 2 on a centos box, sometimes users are unable to send messages - im having trouble tracing the rule back, the only place i get to is 'inbound ...
0
votes
2answers
688 views
Web Application Firewall: alternatives to mod_security
mod_security seems to be no longer on Debian repositories. The installation seems quite complicated. The only one I could find is Zorp, which seems even more complicated.
Hence I'd like to ask for up ...
1
vote
1answer
653 views
modsecurity inbound_anomaly_score
I get this error from web server - is this known issue. There is plenty of questions on google -- but not clear solution.
[error] [client ] ModSecurity: Warning. Operator LT matched 20 at ...
1
vote
0answers
321 views
Apache/mod_security/mod_proxy doesn't close a long-lived connection on FIN
We are using Comet that is routed via a proxy running Apache with mod_proxy and mod_security. The connections are long-lived, and have a client-side timeout.
When the connection times out, the client ...
0
votes
1answer
105 views
Frequent Server Crash due to more number of httpd processes
We are currently facing frequent server crash due to more number of httpd processes. Earlier we had frequent SYN flooding attacks. We have already enabled SYN cookies and installed both mod_security, ...
1
vote
2answers
313 views
How do I remove the ServerSignature added by mod_fcgid?
I'm running Mod_Security and I'm using the SecServerSignature to customize the Server header that Apache returns. This part works fine, however I'm also running mod_fcgid which appends ...
2
votes
1answer
328 views
Do I really need mod_security?
I'm doing a clean install of my server and I'm looking for some advice on whether or not I actually need the Apache mod_security module.
I consider myself to be a bit security paranoid when it comes ...
1
vote
1answer
128 views
Simple, current how-to install mod-security on cPanel server?
Does anyone have or know of a simple, up to date how to for installing mod-security on cPanel and configuring it after install?
Every how to on the web I've found is at least two years old and is ...
0
votes
2answers
325 views
How to secure Cpanel/WHM from malacious uploads
Recently my site's index.php file was replaced with some malicious javascript code.
I really don't know how it was added to the page.
Today when I tried to download the file via FTP, my local ...
0
votes
1answer
684 views
What is the difference between an Audit Log and a regular Log (In the context of mod_security)?
I am using mod_security:
http://www.modsecurity.org/documentation/modsecurity-apache/2.5.12/modsecurity2-apache-reference.pdf
What is the difference between and audit log (audit trail) and a normal ...
0
votes
2answers
643 views
Disable mod_security on Dreamhost, for a single cgi script
I've searched around a lot, and tried various tweaks to .htaccess files to try to turn off mod_security for a particular cgi script (uber uploader) but it doesn't seem to have any effect.
The most ...
0
votes
1answer
581 views
How to disable mod_security2 rule (false positive) for one domain on centos 5
Hi I have mod_security enabled on a centos5 server and one of the rules is keeping a user from posting some text on a form. The text is legitimate but it has the words 'create' and an html ...
0
votes
1answer
435 views
How can I have APF block script kiddies that mod_security detects?
In one of the vhosts' error_log I found thousands of lines like these, all from the same IP:
[Mon Apr 19 08:15:59 2010] [error] [client 61.147.67.206] mod_security: Access denied with code 403. ...
3
votes
2answers
250 views
Good free guide for mod_security?
I have looked at the official sites documentation, and it is a little tough to find starting points.
Is there a free comprehensive guide that is easy to understand for someone that has never dealt ...
0
votes
2answers
2k views
Necesity of ModSecurity if Apache is behind Nginx
I have my Apache installed behind Nginx. So every request that comes in is first handeled by Nginx. If there is dynamic content needed the request is send to Apache which listens on port 8080.
Pretty ...
2
votes
1answer
4k views
How do I find out if mod_security is installed on my apache server?
How can I find out if mod_security is installed on my apache server? I would also like to learn its version.
I'm having some upload issues and I tried to disable mod_security using .htaccess. But ...
