ModSecurity supplies an array of request and response filtering rules and other security features to the Apache HTTP Server. ModSecurity is an open source web application layer firewall.

learn more… | top users | synonyms

0
votes
0answers
3 views

modsecurity Does not contain custom REDQUEST_HEADER_NAMES

Trying to build a rule that will 403 any incoming traffic that doesn't contain the header X-CFKey and match a specific of X-CFKey. I've got modsecurity testing X-CFKey value successfully but fails ...
0
votes
1answer
10 views

mod_security: How to log POST requests for specific URI?

I'm trying to set up mod_security to log POST requests payload for a specific URI, as it seems that a customers webpage is used as a spam relay and these requests corrupt the server side cache. I ...
0
votes
1answer
15 views

mod_security: What's the point of action auditlog?

I'm fiddling around with mod_security to log POST request payloads for a specific URI. As stated in this response http://serverfault.com/a/729079/292993 to a similar question mod_security's ...
0
votes
0answers
11 views

Mosecurity with Nginx logs the 127.0.0.1 as destination

I am using Modsecurity with Nginx. It works and everything is fine unless the modsecurity logs the destination as 127.0.0.1. How can I set the destination with Nginx $proxy_host variable or whatever ...
0
votes
0answers
13 views

Nginx set_real_ip_from clears source port

I am using Modsecurity with Nginx behind another proxy (reverse cache proxy). To have the correct IP addresses of the clients am using ngx_http_realip_module using directives: set_real_ip_from ...
0
votes
1answer
11 views

Modsecurity Whitelist and keep logging

I am white listing a tag and I am curious if there is a way to white list this and keep the logging to this at the same time. SecRuleUpdateTargetByTag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION" ...
0
votes
1answer
18 views

Modsecurity Ignore/Whitelist IP

I have looked around on the net and have seen many common answers for this , however, none of them are working. I am trying to use this to ignore whenever our scans kick off in the morning. SecRule ...
0
votes
0answers
16 views

Modsecurity: How can I consolidate all SecRules to ignore aparameter

How can I consolidate all or any secrule to ignore a parameter with modsecurity? I have a form that will always flag as XSS, unfortunately, my rule list is getting rather large as the site grows. I ...
0
votes
1answer
53 views

SecChrootDir Jailing apache 2.2.X on Centos 6.7

I was trying to do apache jailing on centos 6.7 with modsec. I already built everything even the jail directory and remodeled the config files. httpd(apache) says it started nicely, however its dead. ...
0
votes
1answer
29 views

security2_module for apache with owsap modsecurity crs base rules is causing the “Forbidden You don't have permission to access / on this server”

I installed the security2 module to my apache server with owasp mod security base rules by adding these following lines to my httpd.conf: <IfModule security2_module> Include ...
0
votes
1answer
39 views

SecRuleEngine Off not working on a single domain in virtual host

I have modSecurity installed and working on a server with multiple hosts and I want to disable some rules for one host only. This is what is what I put in the virtual host file: <IfModule ...
-1
votes
1answer
44 views

Nginx with mod_security on EC2 [closed]

I am looking to get some ideas and see what others are doing in terms of managing/keeping updated Nginx + mod_security on EC2 instances. The catch with this is that mod_security needs to be compiled ...
1
vote
1answer
17 views

Apache 2: Limit Ressources

I'm running some web pages on apache 2.4. At the moment I can see a lot of connections like these on status-page: Srv PID Acc M CPU SS Req Conn Child Slot Client VHost Request 2-0 - ...
0
votes
0answers
91 views

Remove double content-length header

Server configuration: CentOS 7, Apache 2.4.18, PHP 5.6.16, NginX 1.8.0 as reverse proxy, mod_security and rules latest version and DirectAdmin 1.49.1. The problem is: mod_security is adding double ...
0
votes
0answers
43 views

Apache mod-security - Deny access from IP addresses listed in a blacklist file

I want to deny access from IP addresses listed in a blacklist file (not realy matters, but the file is /etc/csf/csf.deny). This is my custom rule (at the moment..): SecRule REQUEST_URI ...
1
vote
1answer
90 views

modsecurity whitelisting certian types of cookies

I am seeing cookies being generated on our server which appear to be from 3rd party objects in the site and don't show themselves when one logs in or navigates through the site. The cookies are ...
0
votes
1answer
65 views

workaround for modsecurity false positive?

I was pasting "drwxr-xr-x. 2 root root 6 Sep 24 04:35 images" into a dokuwiki page That triggered modsecurity and I got a HTTP error. How can this rule be modified to avoid this kind of false ...
1
vote
1answer
30 views

How can I decrease mod-security severity?

Actually the module blocks calls with "notice" level. How can I decrease the severity level and take it to "warning"?
0
votes
1answer
57 views

Already enabled x-forwarded for in haproxy, but mod_remoteip 2.2 backport still doesn't work

I'm using haproxy to forward requests to Apache 2.2 bundled with modsecurity 2.7 and OWASP_CRS. I have enabled insertion of the X-Forwarded-For header in the haproxy config: defaults: option ...
0
votes
0answers
22 views

ModSecurity - Matching multiple occurences in XML body

I have the following XML request body: <myMethod> <struct> <member> <name>Member_1</name> ...
0
votes
1answer
96 views

mod_security behind reverse proxy and clients IP

client -> haproxy -> mod_security boxes -> backends Problem: mod_security boxes use mod_rpaf with ip of haproxy in 'RPAFproxy_ips'. Apache logging shows clients real ip but mod_security ...
0
votes
2answers
99 views

What rule can I use in ModSecurity to log POST payload for a specific site?

I need to inspect POST payload for a specific website (the server is rather busy and I wouldn't turn on POST logging for the entire server). The server is LiteSpeed 5.0.7. SecRequestBodyAccess is set ...
1
vote
1answer
80 views

mod_security - How to process text/xml request_body

I'm trying to process REQUEST_BODY of web request, which has Content-Type: text/xml and some XML inside it. Let say I have the following request: curl -v -d " <?xml version="1.0" ...
0
votes
1answer
49 views

Change Mod Security Rule for Deny ( 401 Status Page )

I Used a mod security rule for deny wp login attept. <LocationMatch /wp-login.php> SecRule REQUEST_METHOD "@streq POST" \ "phase:5,chain,t:none,auditlog,pass,msg:'Login Failure Detection: ...
0
votes
0answers
49 views

enable PUT with ModSecurity

I'm hosted in a VPS with Inmotionhosting, and I need to expose PUT and DELETE method for a REST API I'm programming. They tell me that if I want to use PUT, I need to disable ModSecurity. I think ...
0
votes
0answers
13 views

ModSecurity shows server ip as source instead of attacker ip

after upgrade to PHP 5.5 and everything works well i found that mod security is logging all attacks with the server ip itself instead of attacker ip !! before upgrade it was showing the attacker ip ...
-2
votes
1answer
77 views

ModSecurity error on wordpress wp-login rules

I have made i ModSecurity rule for apache for cPanel server to protect wordpress, but it have some error, so please suggest me some modification to work it fine. # This has to be global, cannot exist ...
1
vote
0answers
58 views

How install PHP 5.4, mod_security and mod_evasive together without conflict

I need create webserver with PHP 5.4, and install mod_security and mod_evasive. But when I try to join the php 5.4 and the mods on an EC2 server, it returns an error of conflict between the versions ...
0
votes
1answer
46 views

mod_security installation not creating /usr/share/modsecurity-crs/

I have a server running ubuntu 14 lamp I´ve installed mod_security: apt-get install libapache2-modsecurity then decided to uninstall using this command: sudo apt-get remove ...
0
votes
0answers
131 views

After install mod_security and mod_evasive, php not working

I followed this tutorial ( tutorial.centos.com.my/?p=69 ) and got success to install mod_security and mod_evasive. But php does not run, displays the code in the browser. Insert an index.php file in ...
0
votes
1answer
133 views

Syntax error on line 23 of /etc/httpd/conf.d/modsecurity.conf [duplicate]

I'm try install and configure Mod_Security on Amazon EC2 Linux 64 bits, but one error happens Syntax error on line 23 of /etc/httpd/conf.d/modsecurity.conf: ModSecurity: Found another rule with the ...
0
votes
1answer
206 views

VPS server restarting MOD_SECURITY?

My VPS server has been acting up lately, for example last weekend the PHP module Imagemagick simply stopped working and I had to do a PERC uninstall / reinstall. Today my server has been totally ...
5
votes
2answers
152 views

How to include ModSecurity request final action in the Apache access.log

I'm currently using ModSecurity 2.7 and Apache 2.4.7 on Ubuntu Trusty. I would like to use Apache's LogFormat and CustomLog directives so that I can include a field indicating whether ModSecurity ...
0
votes
1answer
144 views

Jetmon being blocked by ModSecurity, how to write override rule?

I have a WordPress site on a VPC and I'm trying to tweak ModSecurity to reduce the false positives. I have Jetpack monitoring which is being denied when ModSecurity is active. Log from Apache ...
0
votes
1answer
343 views

security2_module for apache is causing the “Forbidden You don't have permission to access / on this server” message

I installed the security2 module to my apache server by adding these following lines to my httpd.conf: <IfModule security2_module> Include ...
0
votes
2answers
19 views

Modsecurity rule to not scan URIs

Good Morning, I am currently on creating a new mod security 2.5 rule. My deployment: I have an Apache server in reverse proxy mode. This Apache server does not host the websites. Instead, I proxy ...
2
votes
1answer
74 views

ModSecurity rule to not scan URI

I am having difficulty creating a new mod security 2.5 rule. My deployment: Apache server, Setup as a reverse proxy. (so the apache webserver __does not_ host the website. Instead, I proxy the ...
-1
votes
2answers
34 views

Modsecurity: no action id present

I have not been doing anything with my site for a while and recently upgraded Ubuntu from 12.04 to 14.04 LTS, but now I am getting errors like: Modsecurity: no action id present I looked around ...
0
votes
0answers
59 views

Apache hangs after on heavy load

I am using apache 2.4.7 in ubuntu14.04 . I am using mod mpm_event in the apache and due to some DOS attack my server got hang after certain time. I am using this default setting for it. StartServers ...
-2
votes
1answer
88 views

Apache server crashes due to bandwidth spike issue [closed]

The problem I am facing is that my Website (hosted on a dedicated VPS) was working fine for last 6 months. However from last two days, it gets huge spikes of DATA coming in and this causes server to ...
3
votes
1answer
835 views

How to get mod_security to log all POST data?

I currently have a CentOS system that is successfully logging relevant mod_security actions to the audit log file. The following is my configuration: <IfModule mod_security2.c> SecRuleEngine ...
0
votes
0answers
79 views

Apache header order

I am working on a private server application for a web based mobile game that uses php to generate responses. In order to do this I am trying to replicate the behavior of the main server as closely as ...
0
votes
0answers
235 views

mod_fcgid - Cannot allocate memory

I discovered yesterday some Errors on Apache2 Log and looking how to solve it somehow. My Problem is that I do not know where to start. As a Noob I am it is a little bit hard for me to get it solved. ...
0
votes
0answers
35 views

ModSecurity: Output filter: Response body data memory allocation failed

Can anybody tell me what this errors means? Could not find a really good results for it. [Sat May 09 11:15:42 2015] [error] [client 52.1.123.91] ModSecurity: Output filter: Response body data memory ...
0
votes
1answer
268 views

Does a mod_security error block a visitor?

Does a mod_security execution/rule error or errors in general block users from visiting my website? Ive got many rule and execution errors, Ive just whitelisted these rules but maybe I could just ...
1
vote
1answer
732 views

Apache with modsec “collections_remove_stale: Failed to access DBM file” [closed]

I seem to getting alot of these lately in my apache error log: Message: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ip": Resource deadlock avoided Server Version: ...
1
vote
1answer
139 views

Can mod_security only log triggered rules if the request was blocked?

I've installed mod_security and I'm currently running in DetectionOnly mode as I monitor logs and configure to suit my servers needs. I've set it up for anomaly scoring and tweaked my scores ...
1
vote
0answers
66 views

Test for length of ARG parameter in SecRule - Mod Security

What is the most efficient way to limit the length of a http request parameter using Mod Security? For example, to limit WordPress comment length : SecRule ARGS:comment "^.{65530}" Would this regex ...
0
votes
0answers
239 views

ModSecurity + Nginx “SecRule” startup error

I've installed Nginx (1.8.0) + ModSecurity (2.9.0) from source on OpenBSD (5.6), without problems. But when I try to configure modsecurity with the default config, upon starting nginx I get: ...
1
vote
2answers
180 views

Passwords in modsec log files

Are there any best practices or approaches I can take to prevent certain data (e.g. passwords) from being logged into mod-security's log files? We've a call coming into our Apache server (and onto ...