ModSecurity supplies an array of request filtering and other security features to the Apache HTTP Server. ModSecurity is a web application layer firewall.
0
votes
0answers
5 views
Proxying while preserving URI with mod_security2
I'm using a proxy: action in mod_security2. I'd like to preserve the full URL of the original request, however, and it seems to be rewriting that to the url in my proxy: action.
So a request to ...
1
vote
0answers
43 views
short Apache outages (VPS, ModSecurity)
I have a problem with my site recently hosted at Liquidweb, none of their techs seems to be able to solve this issue even after days. Was hoping I could get some help here.
Occasionally, my site's ...
0
votes
0answers
12 views
Loading JavaScript with query param triggers mod_security
When accessing http://domain.com/js/scriptaculous.js?load=effects it results in a mod_security warning:
Message: Warning. Match of "eq 1" against "&ARGS:CSRF_TOKEN" required.
[file ...
0
votes
1answer
29 views
Apache vhost-specific logging
I have the following apache setting (in conf.d/owasp-modsecurity.conf):
SecAuditLog "/var/www/vhosts/${lowercase:%{SERVER_NAME}}/statistics/logs/modsec_audit.log"
When I do httpd -t I get the ...
1
vote
1answer
39 views
Limit mod_security rule to one vhost only
I run several domains (via vhosts) with the same apache installation. Some domains require different mod_security rules than the others. In a seperate exceptions.conf file I collect all those rules ...
0
votes
1answer
60 views
Blocking bad bots
I found this script and was wondering if this is just overkill and even worth using?
Is it better for me to just use mod_security?
# Generated using http://solidshellsecurity.com services
# Begin ...
0
votes
0answers
52 views
Mod-security Ip address mismatch
[Tue Apr 09 06:05:38 2013] [error] [client 27.251.237.74] ModSecurity: Access denied with code 403 (phase 1). Match of "streq %{SESSION.IP_HASH}" against "TX:ip_hash" required. [file ...
1
vote
1answer
19 views
Mod_security2 and clamav to catch malicious files on upload
Is there a clear documentation to describe the solution?
It's very common and also necessary.
1
vote
0answers
29 views
log/dump response body
Is there any way to log response body in Apache 2?
I need the exact content that will be sent to user browser.
I tried mod_security audit logging, but it won't log response body for all requests.
...
0
votes
0answers
12 views
I can see libxml2.so.2 instead of libxml2.so, are they different
According to a tutorial related to Directadmin security, described at http://forum.directadmin.com/showthread.php?t=22587, the extension libxml2.so should be loaded, but now I can see that the file ...
0
votes
0answers
25 views
Apache encoding and mod-security
Occassionally mod-security is preventing the submission of a form with perfectly normal input. Looking at the mod-security audit log, this seems to be related to a problem with character encodings.
...
2
votes
1answer
98 views
Enable Mod_Security for only one website
Is there a way to dis-able mod-security for all websites? except one?
i have more than 500 websites hosted, only want to turn it on for one website, which is having attacks on it.
0
votes
0answers
123 views
How to reinstall mod_security for Apache
Today I tried to update my PHP version in EasyApache but on enable ModSecurity it throw an error in last step of rebuilding. I like to enable mod_security for security reasons, of course. :P But I ...
0
votes
1answer
131 views
Dropping incoming requests for a specific file with iptables
Server is a standard LAMP stack configured via cpanel on CentOS 5.9.
We have one file, call it bad.php, on one of our domains that is mistakenly being accessed about 10 times a second by a service ...
-1
votes
1answer
44 views
hosting provider web server blocks certain url string by using mod security [closed]
I have a blog which has a post with the following as url
/blog/insert-into-tablea-select-fields-from-tableb-for-specific-values-only/
This was working well until recently.
I got a different ...
2
votes
0answers
53 views
.htaccess ignored two layers deep on only some hosting plans [closed]
I have one .htaccess file doing this:
RewriteRule ^system(.*)$ /system/app/$1 [QSA,L]
...and then underneath /system/app, I have another .htaccess file doing this:
RewriteCond %{REQUEST_FILENAME} ...
0
votes
1answer
157 views
How do I include a rule set with ModSecurity on IIS?
I'm using ModSecurity 2.7.1 on IIS 7.5 / Windows 2008 R2.
I've reference my base set up conf file in my Web.Staging.config of a site like so:
<ModSecurity enabled="true" ...
1
vote
1answer
102 views
Does ModSecurity 2.7.1 work with ASP.NET MVC 3?
I'm trying to get ModSecurity 2.7.1 to work with an ASP.NET MVC 3 website.
The installation ran without errors and looking at the event log, ModSecurity is
starting up successfully.
I am using the ...
-2
votes
1answer
255 views
mod security problems [closed]
Upgraded to 5.4.9 PHP today on a cPanel + NGINX + CloudLinux but getting the below:
root@server [/etc/httpd/modsecurity.d]# /etc/init.d/httpd configtest
ModSecurity: WARNING Using transformations in ...
0
votes
2answers
371 views
ModSecurity compile error on nginx
I'm trying to install ModSecurity on nginx with the following instructions :
wget https://github.com/SpiderLabs/ModSecurity/archive/master.zip
unzip master
cd ModSecurity-master
./autogen.sh
...
0
votes
0answers
80 views
mod_security RESPONSE_BODY not catching
I am trying to get RESPONSE_BODY to work with mod_security2 on a cpanel server. I know it works (mod_security that is) because this rule trips modsec:
SecRule ARGS {php}
That one trips it and works ...
0
votes
0answers
43 views
mod_security2 print error message to user
I am trying to print out an error message on rule trip in mod_sec2. I use to have it working but never wrote it down and now I can't figure out how to get it to print X error message for me when ...
0
votes
0answers
71 views
Is modSecurity really a must? [closed]
This is not a question about a specific problem. This question is about the utility of mod-security.
I am, let's say, an average Linux user and a beginner in server administration. We deployed ...
0
votes
1answer
71 views
Side effects of using owasp mod_sec rules [closed]
I was looking at all the owasp rules for mod_security. How badly does it slow your loading time down if you use them all?
What would be the recommended packages to use? I want to mostly block bad UA, ...
0
votes
0answers
65 views
Disable modsec2 blacklist rule for specific hostname
I have a server running Apache2 with mod_security2. In modsec2.user.conf, there is a blacklist rule:
###BLACKLIST###
SecRule REQUEST_URI "mkdir"
I need to disable that rule for just one hostname on ...
0
votes
1answer
82 views
Mod_security questions and on User-Agent types
Very new to mod_sec
I want to block a UA string and I noticed there are a few types:
SecRule HTTP_User-Agent
SecRule REQUEST_HEADERS:User-Agent
What is the real difference between them?
My block:
...
1
vote
0answers
196 views
mod_security2.so: undefined symbol: ap_unixd_set_gl
service httpd restart
Stopping httpd: [ OK ]
Starting httpd: httpd: Syntax error on line 205 of /etc/httpd/conf/httpd.conf: Cannot load ...
0
votes
1answer
71 views
Installing mod_security [closed]
I have apache and suphp running. How hard is it to install modsecurity? Also, where can I find some light weight/generic rule-sets to not bog apache down?
0
votes
1answer
137 views
CPANEL ModSec2 not working with SecFilterSelective
Ok, I have cPanel/WHM latest on a Dedi, here are my specs on apache:
Server version: Apache/2.2.23 (Unix)
Server built: Oct 13 2012 19:33:23
Cpanel::Easy::Apache v3.14.13 rev9999
I just ran a ...
0
votes
0answers
81 views
PCRE limits exceeded, but triggering rules are SQL related
[Mon Oct 15 17:12:13 2012] [error] [client xx.xx.xx.xx] ModSecurity: Rule 1d4ad30 [id "300014"][file "/usr/local/apache/conf/modsec2.user.conf"][line "349"] - Execution error - PCRE limits exceeded ...
3
votes
2answers
159 views
Mod_security Logging
Im trying to run mod_security as standalone service with nginx as reverse proxy everything works fine except logging. Mod_security logs reverse proxys ip addres instead of clients ip address.
I would ...
0
votes
1answer
336 views
Nginx with mod_security support
I have compiled nginx with mod_security support. In error log I can see the support for mod_security
2012/08/27 11:13:11 [info] 602096#0: ModSecurity for nginx/2.7.0-rc2
...
1
vote
1answer
163 views
mod_security: track user to check if redirected to login failed page
I have to log when a user fails to log in to a web application. Unfortunately, this web application is not able to do this out of the box and I can not change it.
Now I'm experimenting with ...
0
votes
2answers
692 views
ModSecurity block specific string in request
I want a ModSecurity rule, which block the access to any url or any Body request Post/Get, if it contains a specific string.
For example i want to block this string : "km0ae9gr6m"
I have this rule ...
0
votes
0answers
34 views
Error 403 when URL parameters set twice
I have a strange behavior on an Apache server. When a parameter is set twice in the URL (ex :
https://xxx.com/xxx/xxx.cgi?toto=1&toto=1), i get a 403 error from Apache.
I know mod_security is ...
0
votes
1answer
324 views
ModSecurity not enabled
I have similar problem like question How do I enable mod_security in Ubuntu 10.04? , but i do not have the "minimal" file with me which i can replace and make it work.
My configuration is also ...
3
votes
1answer
62 views
Modifying Apache configuration via a Web Interface
I would like to create a website on my server, which runs Apache2, to allow a user to fill in a form containing a desired subdomain name to be created on the server. For example, a user could go to ...
1
vote
1answer
675 views
What are PCRE limits?
In ModSecurity there are PCRE limits exceeded errors.
I know I can fix this by setting rules such as:
SecPcreMatchLimit 150000
SecPcreMatchLimitRecursion 150000
But, what are these rules actually ...
1
vote
3answers
448 views
How to drop all requests using mod_security
I have an apache2 server with several sites enabled on it, including the default one (000default). The default server is catching lots of spammy requests that are doing nothing but consume bandwidth ...
2
votes
0answers
73 views
Custom collections with mod_security
I would like to create a mod_security collection that is based on something other than the user's IP, Session ID, or username. Specifically, based on the REQUEST_URI. However, mod_security indicates ...
0
votes
1answer
238 views
Broken URLs after enabling mod_security
For example this pdf stopped working after enabling the mod, it generates 403 error.
[Wed May 30 18:47:19 2012] [error] [client xxxxxxxxxxx] ModSecurity: Warning.
Match of "within ...
0
votes
1answer
183 views
apt-get update Error
I get the following error when typing:
# apt-get update
W: Failed to fetch http://etc.inittab.org/~agi/debian/libapache-mod-security2/etch/Packages 404 Not Found [IP: 80.28.139.208 80]
E: Some ...
1
vote
1answer
204 views
What do the audit log records for ModSecurity actually mean?
We have ModSecurity setup to log to modsec_audit.log for Apache2. Today we have had 2259 entries created in this log with a referrer of:
Mozilla/5.0 (compatible; bingbot/2.0; ...
0
votes
1answer
181 views
Mod Security log monitoring
Is there a web based log management utility present for Mod Security? As parsing the logs of Mod Security is a big headache. I can only see traditional log monitoring systems but not any, which is ...
2
votes
1answer
490 views
Where I can find ModSecurity Rules for Specific Applications
Where I can find ModSecurity Rules for Specific Applications specially joomla, wordpress, mambo ?
2
votes
1answer
862 views
Why does mod_security require an ACCEPT HTTP header field?
After some debugging, I found that the core ruleset of mod_security blocks requests that don't have the (optional!) ACCEPT header field.
This is what I find in the logs:
ModSecurity: Warning. ...
-3
votes
1answer
207 views
mod_security: How to allow ssh/http access for admin?
I am going to be installing mod_security on my AWS EC2 Linux instance tonight and need a little help/reassurance. The only thing I am truly worried about right now is making sure my (admin) access to ...
3
votes
1answer
363 views
modsecurity: block ips, that visited 404 pages more than 10 times in a minute
we're using mod_security and we have currently issues with some bots.
i would like to block ips, that visited 404 pages more than 10 times in a minute.
How can this be done? How can i poll the 404 ...
1
vote
2answers
344 views
error: libxml2 is required (modsecurity)
I am trying to install mod_security from source. when i run ./configure I get this error:
configure: error: libxml2 is required
After that error, I executed this command:
yum install libxml2
It ...
4
votes
2answers
3k views
mod_security - PCRE limits exceeded
Just about on every request I am getting the following error:
Rule execution error - PCRE limits exceeded (-8): (null).
After a bunch of googling the only solutions seem to be
a) Add the following ...
