Questions tagged [mod-security]

ModSecurity supplies an array of request and response filtering rules and other security features to the Apache HTTP Server. ModSecurity is an open source web application layer firewall.

Filter by
Sorted by
Tagged with
0 votes
0 answers
36 views

Getting a substatus 0 on 403 IIS error - after login with cookie

[Not a server admin] I have just moved an existing site to a new server 2019, running IIS 10. The site is an old .asp website, using a login with cookies. When trying to login (and successfully ...
kneidels's user avatar
  • 131
0 votes
0 answers
78 views

Modsecurity blocks blocks my legit XHR POST request (403 forbidden)

I'm new to modsecurity topic so maybe the answer is trivial but... I have setup modsecurity on my new nginx/1.24.0 server with default set of recommended rules: coreruleset-3.3.0 and since then my ...
Picard's user avatar
  • 101
0 votes
1 answer
290 views

why does grep stop matching and error with binary file matches

QUESTION Why does my grep command match some lines and then stop with this error grep: /var/log/apache2/modsec_audit.log: binary file matches My grep command: grep '^[' /var/log/apache2/modsec_audit....
user3223819's user avatar
0 votes
0 answers
26 views

libmodsecurity + owasp crs + nginx: regex for hyphen in name of a POST parameter in custom exclude rule

a paranoia_level = 3 of modsecurity forbids non-printable characters to be uploaded with POST payloads (application/x-www-form-urlencoded) in phase 2 using rule 920272 of owasp crs version 3.3.4 But, ...
mpr's user avatar
  • 11
0 votes
0 answers
143 views

ModSecurity runtime rule exclusion failing with error "ModSecurity: Missing target for id"

I read Folini's great tutorial for ModSecurity with Apache. I am trying to set a runtime exclusion rule, that should disable rule 920420 (Request content type is not allowed by policy) but only for ...
nulll's user avatar
  • 507
0 votes
0 answers
150 views

Newbie: How to add mod_sec rule exception for specific use-case

maybe someone with experience or basic knowledge that knows what they're doing (unlike me :)) can help.... Currently, I have Ubuntu 20.04 installation with OpenLitespeed and Cyberpanel. I've installed ...
VforVendetta's user avatar
1 vote
1 answer
272 views

Is Apache mod_evasive really worthful

I read an article saying that apache mod_evasive is an old outdated module and does not real protection against Dos attack. After testing a scenario of load requests to a apache webpage it seems like ...
Cris_Al's user avatar
  • 11
0 votes
1 answer
294 views

How enable modsecurity only one site? in edit .htaccess?

nano /etc/apache2/mods-enabled/security2.conf <IfModule security2_module> SecDataDir /var/cache/modsecurity IncludeOptional /etc/modsecurity/*.conf IncludeOptional /usr/...
dr.ipkins's user avatar
1 vote
1 answer
202 views

bypassing mod_security for coding blog on dreamhost

I've written my own simple blog software to display syntax-highlighted code, and it all works perfectly on my localhost, but I'm having trouble with mod_security on my Dreamhost server. [Wed Aug 02 06:...
maganthro's user avatar
  • 111
0 votes
0 answers
68 views

Filtering Amazon servers by IP range AND URL

My server is often attacked by bots hosted on Amazon servers. So I configured iptables to block the largest ip ranges from Amazon. My problem is that let's encrypt use also Amazon servers to issue new ...
Fabrice Kimmel's user avatar
0 votes
0 answers
183 views

Modsecurity Nginx breaking Wordpress Woocommerce checkout page. Can't find working rule exclusions

I am running an Ubuntu 20.04 based LEMP server on a Raspberry Pi 4. I am working on a Wordpress Woocommerce website at https://www.mcmo.is. Currently on iOS using Safari or Google Chrome, I can't get ...
DanRan's user avatar
  • 123
0 votes
0 answers
562 views

Modsecurity block access from all countries except from a specific IP or specific remote host

I have the below 3 rules in modsecurity. Rule 1: Block all countries defined as high risk except US: SecAction \ "id:900600,\ phase:1,\ nolog,\ pass,\ t:none,\ setvar:'tx....
BradG's user avatar
  • 101
1 vote
0 answers
370 views

modsecurity regex not always matching simple rule

Im trying to create a simple modsecurity regex rule that stops processing the rules when a match is found and just returns status 200 on a POST request so that it doesnt continue and get blocked by ...
Tim's user avatar
  • 203
0 votes
1 answer
163 views

ModSecurity : How prevent the body to be displayed in the JSON output?

Using Modsecurity, I write the catched requests in a log, in a JSON format. The body field is too verbose for my ELK index, and generates a lot of parsing errors. Can I disable the presence of the ...
Jean's user avatar
  • 123
0 votes
0 answers
34 views

Tx-Variable does not increment in modSecure

I use Apache2.4 and mod_security 2. SecRuleEngine On SecRule REQUEST_METHOD "@streq put" "id:12345,phase:1,pass,log,t:lowercase,chain,logdata:'TX:PUT_COUNT=%{tx.put_count}'" ...
Paflow's user avatar
  • 187
0 votes
1 answer
296 views

ModSecurity : PCRE limit settings do not have any effects

I'm facing Rule execution error - PCRE limits exceeded (-8): (null). errors when I ask ModSecurity to analyse body data (using the SecRequestBodyAccess On directive). I've read about the problem, and ...
Jean's user avatar
  • 123
0 votes
0 answers
55 views

mod-security replace characters in POST body

I want to replace all the non-alphanumerical characters in the request body (not in the parameters themselves, but their values) with nothing using mod-security. For example: # Initial request param-1=...
Kavishka Gihan's user avatar
1 vote
1 answer
658 views

ModSecurity breaking the Wordpress Theme Editor - cannot write proper exclusion rules

This is a duplicate of a question I've just asked on StackOverflow, before realizing this was maybe a better place where to ask it. I have ModSecurity 2.9.3 and the OWASP CRS 3.3.2 security rules ...
nonhocapito's user avatar
0 votes
1 answer
1k views

Modsecurity Rule that Would Block the IP After a Certain Amount of 403 Errors

I am trying to figure out how to write a ModSecurity rule that would block the IP from the server for a period of time when that IP is generating a certain amount of 403 errors, and I am struggling ...
Hojat Sajadinia's user avatar
1 vote
0 answers
171 views

How to disable mod_security for a subdomain?

I'm trying to disable mod_security for a custom subdomain. I tried to include the following in modsec/modsec2.user.conf. SecRule SERVER_NAME "desktop.xyz.com" phase:1,nolog,allow,ctl:...
Brian Millot's user avatar
0 votes
1 answer
1k views

modsecurity wont start with an apache server

I have a Debian server where apache2 is running. I want to use modsecurity for throttling. apache2 info $ apache2ctl -v Server version: Apache/2.4.29 (Debian) Server built: 2018-01-14T11:01:58 I ...
Hussain Nagri's user avatar
0 votes
2 answers
561 views

How to block IPs making requests to specific domain?

I have a server with CSF and ModSecurity enabled. I'd like to set up a rule or configuration that will automatically block (for a specified amount of time) any IP that makes incoming requests to a ...
inspirednz's user avatar
0 votes
0 answers
144 views

Drop connection without sending packets

I would like to prevent default virtual host behaviour by dropping the connection, so that visitors who navigate to my server via IP or fqdn that isn't included in my virtual hosts get no indication ...
jackar's user avatar
  • 11
-1 votes
1 answer
150 views

Is ModSecurity intended for authentication or WAF?

What's the designed purpose of modsecurity for Apache/Nginx? Does it play the role of authentication (Basic/Forms/Cookie)? From my research, it appears to be a Web Application Firewall feature. The ...
JJS's user avatar
  • 143
3 votes
0 answers
75 views

Efficient and comfortable mod_security monitoring with sentry.io or similar tools? [closed]

When using mod_security one might drown in error reports. sentry is a comfortable tool to monitor software errors, sort them, ignore unimportant ones and so on. I was wondering if it is possible to ...
Alex's user avatar
  • 726
1 vote
0 answers
97 views

ModSecurity: Block all IPs except for a list of defined IPs

I have an apache server with ModSecurity. I need to block all IPs except for a few ones. The list of IPs is like this: 194.83.128.0/21 191.143.32.0/19 145.126.72.0/21 101.28.248.0/22 40.64.64.0/22 180....
Jacobo's user avatar
  • 111
1 vote
1 answer
840 views

Nginx and Modsec version mismatch

I have installed nginx and modsec roughly following this tutorial https://www.linuxcapable.com/how-to-install-modsecurity-with-nginx-on-ubuntu-20-04/. After a couple of months working perfectly I am ...
andygozindy's user avatar
0 votes
0 answers
288 views

Mod_Security prevent brute force for Joomla

I am trying to find/create a Mod_Security rule to detect & block multiple login failures on the latest version of Joomla. I found an answer from March 2015 here: https://serverfault.com/a/646608/...
Peter's user avatar
  • 1
0 votes
1 answer
465 views

ModSecurity 403, COMODO WAF detects XSS while trying to access phpMyAdmin

I have a copy of phpMyAdmin in one of my server in a subdomain 'pma' and inside a directory in it named 'app' (manual installed from zip archive, not via yum), which I use for DB related management ...
Nishu Ali's user avatar
0 votes
0 answers
48 views

Modsecurity Not working with beautified URLs

I have modsecurity on nginx and everything works except for URL like below: https://example.com/input_1.3=6111163&id=1' and 1=1 -- But it works for this one: https://example.com?input_1.3=6111163&...
Abadis's user avatar
  • 166
0 votes
0 answers
248 views

How to use modsecurity on AWS EC2 with ELB

Query attacks from outside are too frequent since AWS EC2 was used. AWS WAF is too expensive and burdensome. I'm trying to install modsecurity inside the server, but it's not working properly because ...
LivePark's user avatar
0 votes
1 answer
79 views

Which protections can I use on the server

I have read about server protection and I know how to work with fewalld protection because it is not demanding. My question is: Which of the following protections is best for the server and which of ...
Edgar's user avatar
  • 17
1 vote
1 answer
776 views

How to get the remote hostname resolved through DNS when using Nginx and ModSecurity?

The question mod_security with OWASP CRS: Custom rule for whitelisting googlebot provides the following rule as the answer to verify the client's hostname: SecRule REMOTE_HOST “@rx google(bot|)\.com$” ...
Ronaldo's user avatar
  • 73
0 votes
1 answer
202 views

How to reduce Modsecurity disk IO

Modsecurity generates a lot of disk io operations, and the file www-data-ip.pag is read and written continuously. Is there any solution that can effectively reduce this? Could it be moved to RAM in ...
AndreaF's user avatar
  • 225
0 votes
1 answer
608 views

How do I set the anomaly score in crs-setup.conf?

I am using v3.0.0 of CRS with ModSecurity set to DetectionOnly mode and the nginx connector. I want to set the anomaly score to 100 or so to fine-tune the settings, but I can't see where or how to do ...
richardwhitney's user avatar
0 votes
0 answers
664 views

Can't get docker image owasp/modsecurity-crs:apache reverse proxy to work

I have an endpoint https://my-portal.nl and I wan't to place a WAF with the OWASP Core rule set before it. So I found a Docker image(owasp/modsecurity-crs:apache) that can proxy all the requests to my ...
RAGI's user avatar
  • 1
0 votes
1 answer
158 views

Is it okay to use core ruleset v3.3 on modsecurity v2.9

I am just a beginner in the field of security. I have installed ModSecurity v2.9 on my server using this link. But GitHub repository for the core rule set in the link was outdated, so later I removed ...
Praveen Kumar P S's user avatar
0 votes
2 answers
1k views

How do I restrict a specific client, based on their host name, with ModSecurity SecRule?

I am trying to restrict specific hosts (e.g. AWS) from accessing my webserver. I tried different variations of these but it doesn't work. # Block AWS SecRule REQUEST_HEADERS:Host ".*\.amazonaws\....
David's user avatar
  • 81
0 votes
1 answer
1k views

mod_security with OWASP CRS: Custom rule for whitelisting googlebot

I am about to use OWASP CRS rules with mod_security on my WHM/cPanel enabled CentOS server (with apache). But I fear that accidentally Googlebot may be blocked by one rule or the other. After enabling ...
Kannan's user avatar
  • 101
0 votes
1 answer
80 views

OWASP-CSR on ATS

I have some Apache Traffic Servers that use in CDN platform. Is it possible to configure OWASP-CSR on Apache Traffic Server? If yes, how can I implement it?
user avatar
0 votes
1 answer
1k views

Cannot find rule ID to whitelist an IP in ModSecurity

I have a local IP that was apparently banned. I would like to whitelist it. The subnet is already in my /etc/modsecurity/modsecurity.conf file: SecRule REMOTE_ADDR "@ipMatch 192.168.0.0/19" &...
DevOpsSauce's user avatar
0 votes
1 answer
45 views

My centOS 7 minimal font screwed up when trying to tail modsecurity audit log

My font display was completely normal. But right after i cat or tail /var/log/modsec_audit.log, my font becomes like this. Any solution? Image link: https://i.stack.imgur.com/XkIyj.png
newbie01's user avatar
1 vote
2 answers
206 views

Apache modsec + ssl proxy loop

I have a server where we have the following setup: http://example.com -(REDIRECT)-> https://example.com Now we would like to add a simple ssl proxy(on the same machine where the A record is also ...
Appelpitje's user avatar
0 votes
1 answer
509 views

Which actions are retained on SecRuleUpdateActionById changes from the original rule?

So, SecruleUpdateActionById requires relisting action flags. At least that's my reading of "actions that can appear only once are overwritten". Which is fairly obvious for most of them, but ...
mario's user avatar
  • 125
3 votes
0 answers
482 views

How to make mod_remoteip and mod_evasive work together

I have several Cento7 machines running Apache 2.4. They are behind a load balancer. The load balancer pass X-Forwarded-For header with client IP. In order to have mod_evasive to use the real client IP,...
user3908406's user avatar
0 votes
0 answers
673 views

Compile ModSecurity 3.3 with YAJL

anyone could help? I'm stucked on this. I already compiled ModSecurity 3.3 on this machine (followed these instructions). Now I'm trying to compile with YAJL (Yet Another JSON Library) to be able to ...
Filipe's user avatar
  • 1
0 votes
1 answer
690 views

apache server responding 403 to some clients, for a wordpress site

I rented a barebone server, installed Centos 7, then centos web panel, with server set to apache only, using apache 2.4.4x and php 7. I set up a wordpress site on one of the vhost, after editing for a ...
Jimmy Chi Kin Chau's user avatar
1 vote
1 answer
2k views

REQUEST_URI exact match modsecurity

I need deny a portion of an url with modsecurity , example: index.php?page_num=users I have implemented this rule: SecRule REQUEST_URI "/index\.php\?page_num=users" "id:10000100,phase:1,...
Vic's user avatar
  • 11
0 votes
1 answer
1k views

Why don't the CRS rules in ModSecurity block all threats?

I'm in the process of configuring the new Ngnix v1.18.0 server together with ModSecurity-nginx v1.0.1. I've added OWASP CRS 3.3.0 rules to the configuration. Unfortunately, I can't clearly tell if the ...
nsog8sm43x's user avatar
2 votes
2 answers
926 views

mod_security 403 forbidden response is returning homepage content with WordPress mod_rewrite

I'm using mod_security on various websites, some WordPress and some not. I notice that on a non WordPress website the following: https://test-site.com/?exec=/bin/bash returns a 403 forbidden error ...
MrCarrot's user avatar
  • 355

1
2 3 4 5
7