ModSecurity supplies an array of request and response filtering rules and other security features to the Apache HTTP Server. ModSecurity is an open source web application layer firewall.

learn more… | top users | synonyms

0
votes
0answers
7 views

Not getting the 503 error forbidden with mod_security on CentOS 7

I downloaded and installed modsecurity, besides this also change my dns, the problem I have is that when I want to access my website by IP address, it should send the message forbidden error (503) but ...
1
vote
0answers
29 views

Install Mod_Security for Nginx without need to recompile

I've got LEMP all setup. Now I would like to add mod_security. I tried to research but all I could find are instructions on how to recompile nginx. Is there a way to add mod_security without needing ...
0
votes
1answer
36 views

Remove IP from modsecurity blacklist

I have a CentOS 7.2 server with apache. I installed and configured modsecurity and I did some tests from my home and now my IP si blocked. Where is stored the blacklist for modsecurity? I stopped the ...
1
vote
1answer
32 views

Linux, apache2, modsecurity blocks Google reCAPTCHA variables

I have a Debian Jessie box, Apache 2.4 and default mod_security enabled with base rules activated. When I try to implement a Google reCAPTCHA solution in a PHP code, modsecurity blocks page with ...
1
vote
1answer
22 views

Steps to find the specific rule for Mod_security

I am running an web portal on Lamp stack. I am facing an issue with a export button functionality when i click on the button it redirects to Apache test page. When i comment the #Include modsecurity.d/...
0
votes
1answer
44 views

Modsecurity check REQUEST_URI without query parameters

Currently, I am using Modsecurity XSS prevention, but I'm having a hard time understanding how exactly I can restrict what I'm checking for in the REQUEST_URI variable. My Example: # # -=[ XSS ...
1
vote
0answers
54 views

mod_security forcing to redirect to Apache test page

i have installed drupal and installed couple of modules to provide the admin export to excel feature. when i click on the export button the page is getting redirected to Apache test page. I have done ...
2
votes
0answers
52 views

Any versions of ModSecurity that works with recent versions of Nginx?

I'm building Nginx and ModSecurity together in order to use the OWASP- Core Rule Set Project. According to the modsecurity download page, the latest version of modsecurity (2.9.1) is not stable when ...
0
votes
1answer
63 views

Disabling ModSecurity's SQL injection Rule

I've been trying to disable mod_security sql injection rule by adding this to the conf file SecRuleRemoveById 981172 SecRuleRemoveById 981243 SecRuleRemoveById 981173 SecRuleRemoveById 981249 ...
-1
votes
1answer
40 views

Clone http traffic to another port on same server transparently

I am experimenting with following setup. Clone/copy (but not redirect) all incoming HTTP requests from port 80 to another port say 8080 on same machine. I have a simple NGINX + Lua based WAF which is ...
0
votes
0answers
40 views

convert modsecurity apache specific rules for nginx

Using ModSecurity with Apache and OWASP CRS there are some rules which use apache specific directives like (in modsecurity_crs_55_application_defects.conf file): Header edit Set-Cookie "^((?i:(_?(...
0
votes
0answers
12 views

Is there a way around Apache HTTPS redirect filtering blocks?

I am currently using a mod_security HTTPS redirect in order to maintain PCI requirements. However, I have noticed that many commercial web filters (i.e. websense) are blocking the site due to a proxy ...
0
votes
2answers
105 views

mod_security too strict rule? [closed]

i just installed mod_security on my server but every page gets blocked with a forbidden error. i feel the rules are to strict, no? how can change it? this is the last line on my log Message: Access ...
0
votes
1answer
197 views

Chrooting Apache 2.4 on Debian Jessie with mod_security

I have been advised to chroot my apache2 installation to better secure the sensitive content on the rest of the server. I have installed and setup mod_security properly and can see in the logs that it ...
0
votes
1answer
56 views

mod_security unable to add OWASP CRS - CentOS 7

My website has been under constant attack from hackers since the day I set up the virtual server and installed WordPress. I was able to install mod_security, however, I am unable to add the OWASP CSR. ...
1
vote
0answers
9 views

modsecurity Does not contain custom REDQUEST_HEADER_NAMES

Trying to build a rule that will 403 any incoming traffic that doesn't contain the header X-CFKey and match a specific of X-CFKey. I've got modsecurity testing X-CFKey value successfully but fails ...
0
votes
1answer
46 views

mod_security: How to log POST requests for specific URI?

I'm trying to set up mod_security to log POST requests payload for a specific URI, as it seems that a customers webpage is used as a spam relay and these requests corrupt the server side cache. I ...
0
votes
1answer
22 views

mod_security: What's the point of action auditlog?

I'm fiddling around with mod_security to log POST request payloads for a specific URI. As stated in this response http://serverfault.com/a/729079/292993 to a similar question mod_security's ...
0
votes
0answers
16 views

Mosecurity with Nginx logs the 127.0.0.1 as destination

I am using Modsecurity with Nginx. It works and everything is fine unless the modsecurity logs the destination as 127.0.0.1. How can I set the destination with Nginx $proxy_host variable or whatever ...
0
votes
0answers
27 views

Nginx set_real_ip_from clears source port

I am using Modsecurity with Nginx behind another proxy (reverse cache proxy). To have the correct IP addresses of the clients am using ngx_http_realip_module using directives: set_real_ip_from x.x.x....
0
votes
1answer
33 views

Modsecurity Whitelist and keep logging

I am white listing a tag and I am curious if there is a way to white list this and keep the logging to this at the same time. SecRuleUpdateTargetByTag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION" !ARGS:/^...
0
votes
1answer
38 views

Modsecurity Ignore/Whitelist IP

I have looked around on the net and have seen many common answers for this , however, none of them are working. I am trying to use this to ignore whenever our scans kick off in the morning. SecRule ...
0
votes
0answers
22 views

Modsecurity: How can I consolidate all SecRules to ignore aparameter

How can I consolidate all or any secrule to ignore a parameter with modsecurity? I have a form that will always flag as XSS, unfortunately, my rule list is getting rather large as the site grows. I ...
0
votes
1answer
72 views

SecChrootDir Jailing apache 2.2.X on Centos 6.7

I was trying to do apache jailing on centos 6.7 with modsec. I already built everything even the jail directory and remodeled the config files. httpd(apache) says it started nicely, however its dead. ...
0
votes
1answer
103 views

security2_module for apache with owsap modsecurity crs base rules is causing the “Forbidden You don't have permission to access / on this server”

I installed the security2 module to my apache server with owasp mod security base rules by adding these following lines to my httpd.conf: <IfModule security2_module> Include crs/owasp-...
0
votes
1answer
133 views

SecRuleEngine Off not working on a single domain in virtual host

I have modSecurity installed and working on a server with multiple hosts and I want to disable some rules for one host only. This is what is what I put in the virtual host file: <IfModule ...
-1
votes
1answer
80 views

Nginx with mod_security on EC2 [closed]

I am looking to get some ideas and see what others are doing in terms of managing/keeping updated Nginx + mod_security on EC2 instances. The catch with this is that mod_security needs to be compiled ...
1
vote
1answer
17 views

Apache 2: Limit Ressources

I'm running some web pages on apache 2.4. At the moment I can see a lot of connections like these on status-page: Srv PID Acc M CPU SS Req Conn Child Slot Client VHost Request 2-0 - ...
0
votes
0answers
68 views

Apache mod-security - Deny access from IP addresses listed in a blacklist file

I want to deny access from IP addresses listed in a blacklist file (not realy matters, but the file is /etc/csf/csf.deny). This is my custom rule (at the moment..): SecRule REQUEST_URI "wp-login.php"...
1
vote
1answer
282 views

modsecurity whitelisting certian types of cookies

I am seeing cookies being generated on our server which appear to be from 3rd party objects in the site and don't show themselves when one logs in or navigates through the site. The cookies are ...
0
votes
1answer
116 views

workaround for modsecurity false positive?

I was pasting "drwxr-xr-x. 2 root root 6 Sep 24 04:35 images" into a dokuwiki page That triggered modsecurity and I got a HTTP error. How can this rule be modified to avoid this kind of false ...
1
vote
1answer
38 views

How can I decrease mod-security severity?

Actually the module blocks calls with "notice" level. How can I decrease the severity level and take it to "warning"?
0
votes
1answer
174 views

Already enabled x-forwarded for in haproxy, but mod_remoteip 2.2 backport still doesn't work

I'm using haproxy to forward requests to Apache 2.2 bundled with modsecurity 2.7 and OWASP_CRS. I have enabled insertion of the X-Forwarded-For header in the haproxy config: defaults: option ...
0
votes
0answers
25 views

ModSecurity - Matching multiple occurences in XML body

I have the following XML request body: <myMethod> <struct> <member> <name>Member_1</name> <value><int>Value1</int><...
0
votes
1answer
213 views

mod_security behind reverse proxy and clients IP

client -> haproxy -> mod_security boxes -> backends Problem: mod_security boxes use mod_rpaf with ip of haproxy in 'RPAFproxy_ips'. Apache logging shows clients real ip but mod_security ...
0
votes
2answers
359 views

What rule can I use in ModSecurity to log POST payload for a specific site?

I need to inspect POST payload for a specific website (the server is rather busy and I wouldn't turn on POST logging for the entire server). The server is LiteSpeed 5.0.7. SecRequestBodyAccess is set ...
1
vote
1answer
167 views

mod_security - How to process text/xml request_body

I'm trying to process REQUEST_BODY of web request, which has Content-Type: text/xml and some XML inside it. Let say I have the following request: curl -v -d " <?xml version="1.0" encoding="UTF-...
0
votes
1answer
65 views

Change Mod Security Rule for Deny ( 401 Status Page )

I Used a mod security rule for deny wp login attept. <LocationMatch /wp-login.php> SecRule REQUEST_METHOD "@streq POST" \ "phase:5,chain,t:none,auditlog,pass,msg:'Login Failure Detection: ...
0
votes
0answers
104 views

enable PUT with ModSecurity

I'm hosted in a VPS with Inmotionhosting, and I need to expose PUT and DELETE method for a REST API I'm programming. They tell me that if I want to use PUT, I need to disable ModSecurity. I think ...
0
votes
0answers
22 views

ModSecurity shows server ip as source instead of attacker ip

after upgrade to PHP 5.5 and everything works well i found that mod security is logging all attacks with the server ip itself instead of attacker ip !! before upgrade it was showing the attacker ip ...
-3
votes
1answer
124 views

ModSecurity error on wordpress wp-login rules

I have made i ModSecurity rule for apache for cPanel server to protect wordpress, but it have some error, so please suggest me some modification to work it fine. # This has to be global, cannot exist ...
1
vote
0answers
141 views

How install PHP 5.4, mod_security and mod_evasive together without conflict

I need create webserver with PHP 5.4, and install mod_security and mod_evasive. But when I try to join the php 5.4 and the mods on an EC2 server, it returns an error of conflict between the versions ...
0
votes
1answer
61 views

mod_security installation not creating /usr/share/modsecurity-crs/

I have a server running ubuntu 14 lamp I´ve installed mod_security: apt-get install libapache2-modsecurity then decided to uninstall using this command: sudo apt-get remove libapache2-...
0
votes
0answers
231 views

After install mod_security and mod_evasive, php not working

I followed this tutorial ( tutorial.centos.com.my/?p=69 ) and got success to install mod_security and mod_evasive. But php does not run, displays the code in the browser. Insert an index.php file in ...
0
votes
1answer
260 views

Syntax error on line 23 of /etc/httpd/conf.d/modsecurity.conf [duplicate]

I'm try install and configure Mod_Security on Amazon EC2 Linux 64 bits, but one error happens Syntax error on line 23 of /etc/httpd/conf.d/modsecurity.conf: ModSecurity: Found another rule with the ...
0
votes
1answer
298 views

VPS server restarting MOD_SECURITY?

My VPS server has been acting up lately, for example last weekend the PHP module Imagemagick simply stopped working and I had to do a PERC uninstall / reinstall. Today my server has been totally ...
5
votes
2answers
177 views

How to include ModSecurity request final action in the Apache access.log

I'm currently using ModSecurity 2.7 and Apache 2.4.7 on Ubuntu Trusty. I would like to use Apache's LogFormat and CustomLog directives so that I can include a field indicating whether ModSecurity ...
0
votes
1answer
223 views

Jetmon being blocked by ModSecurity, how to write override rule?

I have a WordPress site on a VPC and I'm trying to tweak ModSecurity to reduce the false positives. I have Jetpack monitoring which is being denied when ModSecurity is active. Log from Apache error....
0
votes
1answer
626 views

security2_module for apache is causing the “Forbidden You don't have permission to access / on this server” message

I installed the security2 module to my apache server by adding these following lines to my httpd.conf: <IfModule security2_module> Include crs/owasp-modsecurity-crs/modsecurity_crs_10_setup....
0
votes
2answers
27 views

Modsecurity rule to not scan URIs

Good Morning, I am currently on creating a new mod security 2.5 rule. My deployment: I have an Apache server in reverse proxy mode. This Apache server does not host the websites. Instead, I proxy ...