Questions tagged [mod-security]
ModSecurity supplies an array of request and response filtering rules and other security features to the Apache HTTP Server. ModSecurity is an open source web application layer firewall.
344
questions
0
votes
0
answers
36
views
Getting a substatus 0 on 403 IIS error - after login with cookie
[Not a server admin]
I have just moved an existing site to a new server 2019, running IIS 10.
The site is an old .asp website, using a login with cookies.
When trying to login (and successfully ...
0
votes
0
answers
78
views
Modsecurity blocks blocks my legit XHR POST request (403 forbidden)
I'm new to modsecurity topic so maybe the answer is trivial but...
I have setup modsecurity on my new nginx/1.24.0 server with default set of recommended rules: coreruleset-3.3.0 and since then my ...
0
votes
1
answer
290
views
why does grep stop matching and error with binary file matches
QUESTION
Why does my grep command match some lines and then stop with this error
grep: /var/log/apache2/modsec_audit.log: binary file matches
My grep command:
grep '^[' /var/log/apache2/modsec_audit....
0
votes
0
answers
26
views
libmodsecurity + owasp crs + nginx: regex for hyphen in name of a POST parameter in custom exclude rule
a paranoia_level = 3 of modsecurity forbids non-printable characters to be uploaded with POST payloads (application/x-www-form-urlencoded) in phase 2 using rule 920272 of owasp crs version 3.3.4
But, ...
0
votes
0
answers
143
views
ModSecurity runtime rule exclusion failing with error "ModSecurity: Missing target for id"
I read Folini's great tutorial for ModSecurity with Apache.
I am trying to set a runtime exclusion rule, that should disable rule 920420 (Request content type is not allowed by policy) but only for ...
0
votes
0
answers
150
views
Newbie: How to add mod_sec rule exception for specific use-case
maybe someone with experience or basic knowledge that knows what they're doing (unlike me :)) can help....
Currently, I have Ubuntu 20.04 installation with OpenLitespeed and Cyberpanel.
I've installed ...
1
vote
1
answer
272
views
Is Apache mod_evasive really worthful
I read an article saying that apache mod_evasive is an old outdated module and does not real protection against Dos attack. After testing a scenario of load requests to a apache webpage it seems like ...
0
votes
1
answer
294
views
How enable modsecurity only one site? in edit .htaccess?
nano /etc/apache2/mods-enabled/security2.conf
<IfModule security2_module>
SecDataDir /var/cache/modsecurity
IncludeOptional /etc/modsecurity/*.conf
IncludeOptional /usr/...
1
vote
1
answer
202
views
bypassing mod_security for coding blog on dreamhost
I've written my own simple blog software to display syntax-highlighted code, and it all works perfectly on my localhost, but I'm having trouble with mod_security on my Dreamhost server.
[Wed Aug 02 06:...
0
votes
0
answers
68
views
Filtering Amazon servers by IP range AND URL
My server is often attacked by bots hosted on Amazon servers.
So I configured iptables to block the largest ip ranges from Amazon.
My problem is that let's encrypt use also Amazon servers to issue new ...
0
votes
0
answers
183
views
Modsecurity Nginx breaking Wordpress Woocommerce checkout page. Can't find working rule exclusions
I am running an Ubuntu 20.04 based LEMP server on a Raspberry Pi 4.
I am working on a Wordpress Woocommerce website at https://www.mcmo.is. Currently on iOS using Safari or Google Chrome, I can't get ...
0
votes
0
answers
562
views
Modsecurity block access from all countries except from a specific IP or specific remote host
I have the below 3 rules in modsecurity.
Rule 1: Block all countries defined as high risk except US:
SecAction \
"id:900600,\
phase:1,\
nolog,\
pass,\
t:none,\
setvar:'tx....
1
vote
0
answers
370
views
modsecurity regex not always matching simple rule
Im trying to create a simple modsecurity regex rule that stops processing the rules when a match is found and just returns status 200 on a POST request so that it doesnt continue and get blocked by ...
0
votes
1
answer
163
views
ModSecurity : How prevent the body to be displayed in the JSON output?
Using Modsecurity, I write the catched requests in a log, in a JSON format. The body field is too verbose for my ELK index, and generates a lot of parsing errors.
Can I disable the presence of the ...
0
votes
0
answers
34
views
Tx-Variable does not increment in modSecure
I use Apache2.4 and mod_security 2.
SecRuleEngine On
SecRule REQUEST_METHOD "@streq put" "id:12345,phase:1,pass,log,t:lowercase,chain,logdata:'TX:PUT_COUNT=%{tx.put_count}'"
...
0
votes
1
answer
296
views
ModSecurity : PCRE limit settings do not have any effects
I'm facing Rule execution error - PCRE limits exceeded (-8): (null). errors when I ask ModSecurity to analyse body data (using the SecRequestBodyAccess On directive).
I've read about the problem, and ...
0
votes
0
answers
55
views
mod-security replace characters in POST body
I want to replace all the non-alphanumerical characters in the request body (not in the parameters themselves, but their values) with nothing using mod-security. For example:
# Initial request
param-1=...
1
vote
1
answer
658
views
ModSecurity breaking the Wordpress Theme Editor - cannot write proper exclusion rules
This is a duplicate of a question I've just asked on StackOverflow, before realizing this was maybe a better place where to ask it.
I have ModSecurity 2.9.3 and the OWASP CRS 3.3.2 security rules ...
0
votes
1
answer
1k
views
Modsecurity Rule that Would Block the IP After a Certain Amount of 403 Errors
I am trying to figure out how to write a ModSecurity rule that would block the IP from the server for a period of time when that IP is generating a certain amount of 403 errors, and I am struggling ...
1
vote
0
answers
171
views
How to disable mod_security for a subdomain?
I'm trying to disable mod_security for a custom subdomain.
I tried to include the following in modsec/modsec2.user.conf.
SecRule SERVER_NAME "desktop.xyz.com" phase:1,nolog,allow,ctl:...
0
votes
1
answer
1k
views
modsecurity wont start with an apache server
I have a Debian server where apache2 is running. I want to use modsecurity for throttling.
apache2 info
$ apache2ctl -v
Server version: Apache/2.4.29 (Debian)
Server built: 2018-01-14T11:01:58
I ...
0
votes
2
answers
561
views
How to block IPs making requests to specific domain?
I have a server with CSF and ModSecurity enabled.
I'd like to set up a rule or configuration that will automatically block (for a specified amount of time) any IP that makes incoming requests to a ...
0
votes
0
answers
144
views
Drop connection without sending packets
I would like to prevent default virtual host behaviour by dropping the connection, so that visitors who navigate to my server via IP or fqdn that isn't included in my virtual hosts get no indication ...
-1
votes
1
answer
150
views
Is ModSecurity intended for authentication or WAF?
What's the designed purpose of modsecurity for Apache/Nginx?
Does it play the role of authentication (Basic/Forms/Cookie)?
From my research, it appears to be a Web Application Firewall feature. The ...
3
votes
0
answers
75
views
Efficient and comfortable mod_security monitoring with sentry.io or similar tools? [closed]
When using mod_security one might drown in error reports.
sentry is a comfortable tool to monitor software errors, sort them, ignore unimportant ones and so on.
I was wondering if it is possible to ...
1
vote
0
answers
97
views
ModSecurity: Block all IPs except for a list of defined IPs
I have an apache server with ModSecurity. I need to block all IPs except for a few ones.
The list of IPs is like this:
194.83.128.0/21
191.143.32.0/19
145.126.72.0/21
101.28.248.0/22
40.64.64.0/22
180....
1
vote
1
answer
840
views
Nginx and Modsec version mismatch
I have installed nginx and modsec roughly following this tutorial https://www.linuxcapable.com/how-to-install-modsecurity-with-nginx-on-ubuntu-20-04/.
After a couple of months working perfectly I am ...
0
votes
0
answers
288
views
Mod_Security prevent brute force for Joomla
I am trying to find/create a Mod_Security rule to detect & block multiple login failures on the latest version of Joomla. I found an answer from March 2015 here: https://serverfault.com/a/646608/...
0
votes
1
answer
465
views
ModSecurity 403, COMODO WAF detects XSS while trying to access phpMyAdmin
I have a copy of phpMyAdmin in one of my server in a subdomain 'pma' and inside a directory in it named 'app' (manual installed from zip archive, not via yum), which I use for DB related management ...
0
votes
0
answers
48
views
Modsecurity Not working with beautified URLs
I have modsecurity on nginx and everything works except for URL like below:
https://example.com/input_1.3=6111163&id=1' and 1=1 --
But it works for this one:
https://example.com?input_1.3=6111163&...
0
votes
0
answers
248
views
How to use modsecurity on AWS EC2 with ELB
Query attacks from outside are too frequent since AWS EC2 was used. AWS WAF is too expensive and burdensome. I'm trying to install modsecurity inside the server, but it's not working properly because ...
0
votes
1
answer
79
views
Which protections can I use on the server
I have read about server protection and I know how to work with fewalld protection because it is not demanding.
My question is:
Which of the following protections is best for the server and which of ...
1
vote
1
answer
776
views
How to get the remote hostname resolved through DNS when using Nginx and ModSecurity?
The question mod_security with OWASP CRS: Custom rule for whitelisting googlebot provides the following rule as the answer to verify the client's hostname:
SecRule REMOTE_HOST “@rx google(bot|)\.com$” ...
0
votes
1
answer
202
views
How to reduce Modsecurity disk IO
Modsecurity generates a lot of disk io operations, and the file www-data-ip.pag is read and written continuously.
Is there any solution that can effectively reduce this? Could it be moved to RAM in ...
0
votes
1
answer
608
views
How do I set the anomaly score in crs-setup.conf?
I am using v3.0.0 of CRS with ModSecurity set to DetectionOnly mode and the nginx connector.
I want to set the anomaly score to 100 or so to fine-tune the settings, but I can't see where or how to do ...
0
votes
0
answers
664
views
Can't get docker image owasp/modsecurity-crs:apache reverse proxy to work
I have an endpoint https://my-portal.nl and I wan't to place a WAF with the OWASP Core rule set before it. So I found a Docker image(owasp/modsecurity-crs:apache) that can proxy all the requests to my ...
0
votes
1
answer
158
views
Is it okay to use core ruleset v3.3 on modsecurity v2.9
I am just a beginner in the field of security. I have installed ModSecurity v2.9 on my server using this link. But GitHub repository for the core rule set in the link was outdated, so later I removed ...
0
votes
2
answers
1k
views
How do I restrict a specific client, based on their host name, with ModSecurity SecRule?
I am trying to restrict specific hosts (e.g. AWS) from accessing my webserver. I tried different variations of these but it doesn't work.
# Block AWS
SecRule REQUEST_HEADERS:Host ".*\.amazonaws\....
0
votes
1
answer
1k
views
mod_security with OWASP CRS: Custom rule for whitelisting googlebot
I am about to use OWASP CRS rules with mod_security on my WHM/cPanel enabled CentOS server (with apache). But I fear that accidentally Googlebot may be blocked by one rule or the other. After enabling ...
0
votes
1
answer
80
views
OWASP-CSR on ATS
I have some Apache Traffic Servers that use in CDN platform. Is it possible to configure OWASP-CSR on Apache Traffic Server? If yes, how can I implement it?
0
votes
1
answer
1k
views
Cannot find rule ID to whitelist an IP in ModSecurity
I have a local IP that was apparently banned. I would like to whitelist it. The subnet is already in my /etc/modsecurity/modsecurity.conf file:
SecRule REMOTE_ADDR "@ipMatch 192.168.0.0/19" &...
0
votes
1
answer
45
views
My centOS 7 minimal font screwed up when trying to tail modsecurity audit log
My font display was completely normal. But right after i cat or tail /var/log/modsec_audit.log, my font becomes like this. Any solution?
Image link:
https://i.stack.imgur.com/XkIyj.png
1
vote
2
answers
206
views
Apache modsec + ssl proxy loop
I have a server where we have the following setup:
http://example.com -(REDIRECT)-> https://example.com
Now we would like to add a simple ssl proxy(on the same machine where the A record is also ...
0
votes
1
answer
509
views
Which actions are retained on SecRuleUpdateActionById changes from the original rule?
So, SecruleUpdateActionById
requires relisting action flags. At least that's my reading of "actions that can appear only once are overwritten".
Which is fairly obvious for most of them, but ...
3
votes
0
answers
482
views
How to make mod_remoteip and mod_evasive work together
I have several Cento7 machines running Apache 2.4. They are behind a load balancer. The load balancer pass X-Forwarded-For header with client IP. In order to have mod_evasive to use the real client IP,...
0
votes
0
answers
673
views
Compile ModSecurity 3.3 with YAJL
anyone could help? I'm stucked on this.
I already compiled ModSecurity 3.3 on this machine (followed these instructions). Now I'm trying to compile with YAJL (Yet Another JSON Library) to be able to ...
0
votes
1
answer
690
views
apache server responding 403 to some clients, for a wordpress site
I rented a barebone server, installed Centos 7, then centos web panel, with server set to apache only, using apache 2.4.4x and php 7.
I set up a wordpress site on one of the vhost, after editing for a ...
1
vote
1
answer
2k
views
REQUEST_URI exact match modsecurity
I need deny a portion of an url with modsecurity , example:
index.php?page_num=users
I have implemented this rule:
SecRule REQUEST_URI "/index\.php\?page_num=users" "id:10000100,phase:1,...
0
votes
1
answer
1k
views
Why don't the CRS rules in ModSecurity block all threats?
I'm in the process of configuring the new Ngnix v1.18.0 server together with ModSecurity-nginx v1.0.1. I've added OWASP CRS 3.3.0 rules to the configuration. Unfortunately, I can't clearly tell if the ...
2
votes
2
answers
926
views
mod_security 403 forbidden response is returning homepage content with WordPress mod_rewrite
I'm using mod_security on various websites, some WordPress and some not.
I notice that on a non WordPress website the following:
https://test-site.com/?exec=/bin/bash
returns a 403 forbidden error ...