ModSecurity supplies an array of request filtering and other security features to the Apache HTTP Server. ModSecurity is a web application layer firewall.

learn more… | top users | synonyms

0
votes
1answer
13 views

Jetmon being blocked by ModSecurity, how to write override rule?

I have a WordPress site on a VPC and I'm trying to tweak ModSecurity to reduce the false positives. I have Jetpack monitoring which is being denied when ModSecurity is active. Log from Apache ...
0
votes
1answer
58 views

security2_module for apache is causing the “Forbidden You don't have permission to access / on this server” message

I installed the security2 module to my apache server by adding these following lines to my httpd.conf: <IfModule security2_module> Include ...
0
votes
2answers
13 views

Modsecurity rule to not scan URIs

Good Morning, I am currently on creating a new mod security 2.5 rule. My deployment: I have an Apache server in reverse proxy mode. This Apache server does not host the websites. Instead, I proxy ...
2
votes
1answer
28 views

ModSecurity rule to not scan URI

I am having difficulty creating a new mod security 2.5 rule. My deployment: Apache server, Setup as a reverse proxy. (so the apache webserver __does not_ host the website. Instead, I proxy the ...
-1
votes
2answers
19 views

Modsecurity: no action id present

I have not been doing anything with my site for a while and recently upgraded Ubuntu from 12.04 to 14.04 LTS, but now I am getting errors like: Modsecurity: no action id present I looked around ...
0
votes
0answers
30 views

Apache hangs after on heavy load

I am using apache 2.4.7 in ubuntu14.04 . I am using mod mpm_event in the apache and due to some DOS attack my server got hang after certain time. I am using this default setting for it. StartServers ...
-2
votes
1answer
51 views

Apache server crashes due to bandwidth spike issue [closed]

The problem I am facing is that my Website (hosted on a dedicated VPS) was working fine for last 6 months. However from last two days, it gets huge spikes of DATA coming in and this causes server to ...
2
votes
1answer
135 views

How to get mod_security to log all POST data?

I currently have a CentOS system that is successfully logging relevant mod_security actions to the audit log file. The following is my configuration: <IfModule mod_security2.c> SecRuleEngine ...
0
votes
0answers
28 views

Apache header order

I am working on a private server application for a web based mobile game that uses php to generate responses. In order to do this I am trying to replicate the behavior of the main server as closely as ...
0
votes
0answers
84 views

mod_fcgid - Cannot allocate memory

I discovered yesterday some Errors on Apache2 Log and looking how to solve it somehow. My Problem is that I do not know where to start. As a Noob I am it is a little bit hard for me to get it solved. ...
0
votes
0answers
24 views

ModSecurity: Output filter: Response body data memory allocation failed

Can anybody tell me what this errors means? Could not find a really good results for it. [Sat May 09 11:15:42 2015] [error] [client 52.1.123.91] ModSecurity: Output filter: Response body data memory ...
0
votes
1answer
57 views

Does a mod_security error block a visitor?

Does a mod_security execution/rule error or errors in general block users from visiting my website? Ive got many rule and execution errors, Ive just whitelisted these rules but maybe I could just ...
0
votes
1answer
221 views

Apache with modsec “collections_remove_stale: Failed to access DBM file” [closed]

I seem to getting alot of these lately in my apache error log: Message: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ip": Resource deadlock avoided Server Version: ...
1
vote
1answer
55 views

Can mod_security only log triggered rules if the request was blocked?

I've installed mod_security and I'm currently running in DetectionOnly mode as I monitor logs and configure to suit my servers needs. I've set it up for anomaly scoring and tweaked my scores ...
1
vote
0answers
26 views

Test for length of ARG parameter in SecRule - Mod Security

What is the most efficient way to limit the length of a http request parameter using Mod Security? For example, to limit WordPress comment length : SecRule ARGS:comment "^.{65530}" Would this regex ...
0
votes
0answers
127 views

ModSecurity + Nginx “SecRule” startup error

I've installed Nginx (1.8.0) + ModSecurity (2.9.0) from source on OpenBSD (5.6), without problems. But when I try to configure modsecurity with the default config, upon starting nginx I get: ...
1
vote
2answers
67 views

Passwords in modsec log files

Are there any best practices or approaches I can take to prevent certain data (e.g. passwords) from being logged into mod-security's log files? We've a call coming into our Apache server (and onto ...
1
vote
0answers
63 views

mod_security rule to block GET requests via querystring or referer

In the last days in my VPS there are many many GET requests on 1 file that cause a high memory load (all came from a single refer url, with different IPs). Until now I've blocked these requests via ...
0
votes
0answers
82 views

apache mod_evasive with mpm_prefork settings to work

I have tried to find all the information I could on this and I understand the problem with mod_evasive not working when the server is in the mpm_prefork mode (instead of worker). However, I was able ...
0
votes
2answers
35 views

Modsecurity oddity

my mod security is loading fine but when I set the server token like so SecServerSignature "Infodous Webserver" it returns "Infodous Webserver mod_fcgid/2.3.6 PHP/5.4.39-0+deb7u1 proxy_html/3.0.1 ...
0
votes
1answer
36 views

WAF at Transparent Mode

I want to use Mod Security as transparent mode. Mod security web application firewall (WAF) should be between server and client and client provided with only server's IP address to access the site. ...
-2
votes
2answers
53 views

How to Disable ModSecurity without any Errors

I've enabled Mod_Security on my VPS which runs an Ubuntu OS with an apache web server. Now, I want to disable it because I setup another firewall to protect my server. I've tried preforming the steps ...
0
votes
0answers
108 views

prevent phpbb bruteforcing with mod_security

Update: I edited this and added a fail2ban tag. Perhaps that might be another way to handle this issue. I'm running phpbb 3.0.13-PL1 and I would like to protect the login page from bruteforcing. I'm ...
0
votes
0answers
35 views

How can I exclude all arguments except for a list from a ModSecurity rule at runtime?

I have a web service that handles requests from clients that I have no way to control, and only communicate with me when they call that service. A number of these clients' requests run afoul of some ...
1
vote
1answer
169 views

mod_security not working at all

I'm trying to make the mod_security work, I searched a lot on the web, and followed this tutorial to configure mod_security (all my configuration files are the same as the tutorial), and when I run ...
1
vote
1answer
302 views

How could I exclude mod_security from sub-directories on Amazon EC2 with LAMP?

I never activated before the mod_security or edit Virtual Hosts, so it's a new challenge for me, I tried to follow this tutorial but seems that most of the tutorials around the web are not reflecting ...
0
votes
1answer
215 views

whitelist URI on mod_security enabled apache reverse proxy

I have an apache 2.2.29-1.4 with mod_security 2.8.0-5.25 which is a reverse proxy with mod_proxy_http for a local java application. I have false positive on some urls and would like to whitelist some ...
0
votes
1answer
100 views

Modsecurity: Whitelist requests, Block all else?

I'm just reading up about - and experimenting with - modsecurity and hoping someone can educate a little about the method behind the madness. The approach I'd ordinarily take with any firewall is to ...
1
vote
1answer
99 views

What exactly does the ModSecurity SecCollectionTimeout directive?

I am having a little bit of trouble with a recurring "Failed deleting collection" error message from ModSecurity (see this discussion @ GitHub for some context). In the discussion of this error it is ...
1
vote
1answer
99 views

Apache server fault after configure mod-security2

I configured mod-security, from https://www.digitalocean.com/community/tutorials/how-to-set-up-mod_security-with-apache-on-debian-ubuntu . After that a restart apache service but i caught error: The ...
0
votes
0answers
274 views

mod_security and CSF protection for Wordpress - ban release issues

We're using mod_sec and CSF to protect client Wordpress logins from brute force attacks. System admin is using the popular 0134 / 0135 rule in mod_sec: SecAction ...
15
votes
5answers
9k views

mod_security block requests by http-host header

The last few days I noticed some servers being hammered with unknown requests. Most of them are like the following: 60.246.*.* - - [03/Jan/2015:20:59:16 +0200] "GET ...
2
votes
0answers
95 views

ModSecurity phase not working?

I have installed modsecurity (2.8). So I made my first rule to block a referrer spam with the following: SecRule REQUEST_HEADERS:Referer "buttons\-for\-website\.com" ...
1
vote
0answers
84 views

SecAuditLogParts not working: mod_security keeps logging response body

I have set SecAuditLogParts in modsecurity.conf to just log ABFH, but the modsecurity audit log keeps logging -E- part (response body) which makes the audit log too big. What can I do to disable ...
3
votes
3answers
373 views

Block traffic behind AWS ELB

My web servers are behind ELB, I want to block traffic from some specific user agent which is a DDOS attack. Apache always see ip address of ELB as an end user so I tried below attempts: Blocking IP ...
1
vote
0answers
59 views

ModSecurity on Apache 2.2 in EC2 - HTTP Status 413 messages dropped

Hi I am running Mod_Security on Ubuntu instances in EC2 behind an Elastic Loadbalancer. The app is a Ruby App. I have set SecRequestBodyLimit 293601280 When I upload files below that size, they ...
0
votes
0answers
72 views

Modsec XSS Filter Issue

Modsecurity is denying a particular email address and I can't figure out why. This rule has never been triggered before for me and the form where this data comes from is used hundreds of times per ...
1
vote
1answer
125 views

mod_security RBL - apparent false positive

I'm struggling with an RBL rule in mod_security under apache 2.2 that seems to be giving me a false positive. I see the following in the audit log (IP address redacted): Message: RBL lookup of ...
3
votes
1answer
455 views

mod_security ruleset for Joomla! admin

I run several hosting servers and recently I have experienced a lot of bruteforce attacks against joomla-based websites. Attackers seem to try a bruteforce against administrator/index.php page. I ...
2
votes
1answer
430 views

Mod Security ctl:ruleEngine=Off Whitelist Fails in Phase 1

Background info : cPanel server with atomicorp ruleset, plus our own custom rules and whitelists in separate .conf files - Apache 2.2, modsec 2.8 Whitelist rule: SecRule REMOTE_ADDR ...
0
votes
1answer
518 views

mod_security not blocking empty useragent requests

I can't get mod_security to block empty useragent requests. I am not very saavy with it so after searching I found this rule: SecMarker BEGIN_UA_CHECK SecRule &REQUEST_HEADERS:User-Agent "@eq 0" ...
0
votes
3answers
2k views

Test whether mod_security is actually working

I'm running this on my staging server for the first time and I think I did everything correctly. I can see entries in modsec_audit.log when I run nikto2 against it, but for the life of me I can't ...
0
votes
0answers
64 views

Server wont let me save URLs to MySQL database?

I am posting here because all other forum say it's a server environ issue. I have a site with the ModX CMS on it hosted on a GoDaddy server (not sure about the specific setup is as client has ...
1
vote
0answers
54 views

ModSecurity on IIS: Single threaded?

I installed ModSecurity on a web server running IIS 8.5, and noticed the response time has increased 15 times (0.15 ms/request vs. 2.2 ms/request), even with SecEngine set to off. It seems that IIS is ...
1
vote
1answer
204 views

Proper SSL config for SSL - Apache2 ignores DocumentRoot

So here's my current config: <VirtualHost *:443> DocumentRoot "/var/www/keypad" ServerName keypad.io SSLOptions +StrictRequire <Directory /> SSLRequireSSL ...
0
votes
1answer
59 views

Fine-grained control over mod_security logging

I installed mod_security2 on several dozen servers (each with several dozen VHosts) and don't have the time to configure it for every VHost. In the default configuration, it produces copious amounts ...
0
votes
0answers
28 views

What is /stop in my server logs?

Why do my server logs show GET requests to /stop? I believe this is due to modsecurity but cannot determine why or the importance.
0
votes
1answer
269 views

mod-security not blocking POST request

I have a mod-security compiled from source and installed on Ubuntu Server 12.04, Apache 2.2.22. I loaded the OWASP core rule set, and I can see them getting triggered on the log file ...
0
votes
2answers
622 views

Nginx, ModSecurity, IP Tables blocking WordPress dos/ddos attack

For the past 14 days I have had my website being hit by millions of WordPress installs over the world which .htaccess is kind of coping with but I am trying to get something to kick them before ...
1
vote
1answer
58 views

Changing ModSecurity Logging on a Per Transaction Basis

I am trying to trace all requests being made to a website on a shared hosting server. Packet capture is just going to be too cumbersome. We use Mod Security (2.8) with good effect, although due to ...