ModSecurity supplies an array of request filtering and other security features to the Apache HTTP Server. ModSecurity is a web application layer firewall.

learn more… | top users | synonyms

0
votes
0answers
33 views

How can I exclude all arguments except for a list from a ModSecurity rule at runtime?

I have a web service that handles requests from clients that I have no way to control, and only communicate with me when they call that service. A number of these clients' requests run afoul of some ...
1
vote
1answer
90 views

What exactly does the ModSecurity SecCollectionTimeout directive?

I am having a little bit of trouble with a recurring "Failed deleting collection" error message from ModSecurity (see this discussion @ GitHub for some context). In the discussion of this error it is ...
0
votes
1answer
88 views

Modsecurity: Whitelist requests, Block all else?

I'm just reading up about - and experimenting with - modsecurity and hoping someone can educate a little about the method behind the madness. The approach I'd ordinarily take with any firewall is to ...
0
votes
1answer
181 views

whitelist URI on mod_security enabled apache reverse proxy

I have an apache 2.2.29-1.4 with mod_security 2.8.0-5.25 which is a reverse proxy with mod_proxy_http for a local java application. I have false positive on some urls and would like to whitelist some ...
14
votes
5answers
8k views

mod_security block requests by http-host header

The last few days I noticed some servers being hammered with unknown requests. Most of them are like the following: 60.246.*.* - - [03/Jan/2015:20:59:16 +0200] "GET ...
1
vote
3answers
847 views

How do I remove the ServerSignature added by mod_fcgid?

I'm running Mod_Security and I'm using the SecServerSignature to customize the Server header that Apache returns. This part works fine, however I'm also running mod_fcgid which appends ...
6
votes
1answer
8k views

Disable modsecurity For a Specific Directory

How do you disable modsecurity for just a specific directory. I'm getting errors in phpMyAdmin that are caused by modsecurity tripping based on rules. I have the following files set up: # ...
4
votes
1answer
1k views

modsecurity: block IP address that visited 404 pages more than 10 times in a minute

We're using mod_security and we have currently issues with some bots. I would like to block IP Address that visited 404 pages more than 10 times in a minute. How can this be done? How can I poll the ...
2
votes
0answers
300 views

How to filter POST data with mod_security when type is text/xml?

I'm trying to craft a rule which would match certain regex in POST requests. Rule I have so far looks like; SecRule REQUEST_FILENAME "form.php" \ "id:'12345',chain,deny,status:406,log,msg:'foobar ...
3
votes
1answer
557 views

What do the audit log records for ModSecurity actually mean?

We have ModSecurity setup to log to modsec_audit.log for Apache2. Today we have had 2259 entries created in this log with a referrer of: Mozilla/5.0 (compatible; bingbot/2.0; ...
1
vote
1answer
230 views

How could I exclude mod_security from sub-directories on Amazon EC2 with LAMP?

I never activated before the mod_security or edit Virtual Hosts, so it's a new challenge for me, I tried to follow this tutorial but seems that most of the tutorials around the web are not reflecting ...
3
votes
2answers
2k views

mod_security 960015 blocks Google and other good bots

mod_security rule 960015 keeps catching Google and other good bots. I have the following in the vhost to prevent good bots from being caught: SecRule REQUEST_HEADERS:User-Agent "Mail.ru" log,allow ...
1
vote
2answers
756 views

mod_security never tells what the problem is

Normally I would just pester my provider to disable the rule. And while he certainly deserves pestering, I've done that way too often already for the low service price. (Like always this is about a ...
1
vote
2answers
238 views

PHP and Text Area Triggering Mod_Security

I have some text areas in a form that are posted back and stored using PHP / MySQL. However, if a user presses return for a new line in the text area, mod_security is blocking it with the below log ...
1
vote
1answer
112 views

mod_security RBL - apparent false positive

I'm struggling with an RBL rule in mod_security under apache 2.2 that seems to be giving me a false positive. I see the following in the audit log (IP address redacted): Message: RBL lookup of ...
0
votes
0answers
235 views

mod_security and CSF protection for Wordpress - ban release issues

We're using mod_sec and CSF to protect client Wordpress logins from brute force attacks. System admin is using the popular 0134 / 0135 rule in mod_sec: SecAction ...
1
vote
2answers
445 views

What web application firewall do you use? What should I use? [closed]

What web application firewall do you use? I'm primarily interested in something I can deploy on the perimeter that can protect multiple Apache and IIS servers, but I'd like to hear all answers. Tell ...
3
votes
3answers
336 views

Block traffic behind AWS ELB

My web servers are behind ELB, I want to block traffic from some specific user agent which is a DDOS attack. Apache always see ip address of ELB as an end user so I tried below attempts: Blocking IP ...
0
votes
0answers
65 views

Modsec XSS Filter Issue

Modsecurity is denying a particular email address and I can't figure out why. This rule has never been triggered before for me and the form where this data comes from is used hundreds of times per ...
2
votes
1answer
387 views

Mod Security ctl:ruleEngine=Off Whitelist Fails in Phase 1

Background info : cPanel server with atomicorp ruleset, plus our own custom rules and whitelists in separate .conf files - Apache 2.2, modsec 2.8 Whitelist rule: SecRule REMOTE_ADDR ...
0
votes
1answer
484 views

mod_security not blocking empty useragent requests

I can't get mod_security to block empty useragent requests. I am not very saavy with it so after searching I found this rule: SecMarker BEGIN_UA_CHECK SecRule &REQUEST_HEADERS:User-Agent "@eq 0" ...
0
votes
3answers
1k views

Test whether mod_security is actually working

I'm running this on my staging server for the first time and I think I did everything correctly. I can see entries in modsec_audit.log when I run nikto2 against it, but for the life of me I can't ...
0
votes
0answers
59 views

Server wont let me save URLs to MySQL database?

I am posting here because all other forum say it's a server environ issue. I have a site with the ModX CMS on it hosted on a GoDaddy server (not sure about the specific setup is as client has ...
1
vote
0answers
53 views

ModSecurity on IIS: Single threaded?

I installed ModSecurity on a web server running IIS 8.5, and noticed the response time has increased 15 times (0.15 ms/request vs. 2.2 ms/request), even with SecEngine set to off. It seems that IIS is ...
1
vote
1answer
172 views

Proper SSL config for SSL - Apache2 ignores DocumentRoot

So here's my current config: <VirtualHost *:443> DocumentRoot "/var/www/keypad" ServerName keypad.io SSLOptions +StrictRequire <Directory /> SSLRequireSSL ...
0
votes
1answer
56 views

Fine-grained control over mod_security logging

I installed mod_security2 on several dozen servers (each with several dozen VHosts) and don't have the time to configure it for every VHost. In the default configuration, it produces copious amounts ...
1
vote
2answers
3k views

mod_security configuration issue: Error parsing actions: Unknown action: ver

I am trying to install / configure mod-sec using this tutorial, which uses the OWASP ModSecurity Core Rule Set. However when I go to restart apache, I get the following error: Syntax error on line 53 ...
0
votes
0answers
28 views

What is /stop in my server logs?

Why do my server logs show GET requests to /stop? I believe this is due to modsecurity but cannot determine why or the importance.
1
vote
1answer
848 views

mod_security2.so: undefined symbol: ap_unixd_set_gl

service httpd restart Stopping httpd: [ OK ] Starting httpd: httpd: Syntax error on line 205 of /etc/httpd/conf/httpd.conf: Cannot load ...
0
votes
1answer
141 views

How i can block requests for a specific page?

I would like to completely delete or block access to a specific page in my site. More specifically, I have seen this exploit "Joomla COM_MEDIA Exploit" : ...
0
votes
1answer
47 views

Mod Security2 deactivation rule only from a specified IP addresses

Is it possible to disable a rule by Mod Security2, only for one specified IP addresses? Only for one specified IP addresses & only for one specified path ( /administrator ) ? I tried this: ...
0
votes
1answer
258 views

Modsecurity Preventing Access to WSDL

I have installed mod_security with the OWASP rule set and it is now blocking my ability to call a web service using a WSDL. When my code tries to make the web service call, I see the below in the mod ...
1
vote
1answer
188 views

Apache error_log filled with modsec blocks

Ever since I enabled Apache modsecurity I've been checking the logs and been seeing the following constantly like 24/7: [Wed Jun 25 12:40:07 2014] [error] [client 112.215.65.61] ModSecurity: Access ...
2
votes
2answers
1k views

modsecurity apache mod-security.conf missing [closed]

Greetings Serverfaultians. I'm not a server guy as you can see from my noob score of 1 point. But maybe those more versed can help me. I'm using Ubuntu v13.10 32-bit Server and Apache2 v2.4.6 and I'm ...
0
votes
0answers
149 views

Nginx and dynamic X-Forwarded-For blocklist

I am running Nginx behind a proxy. I am getting visitors' real IP addresses through X-Forwarded-For HTTP request header. I'd like to block individual IPs based on a dynamic block list, up to 10000+ ...
0
votes
1answer
751 views

csf lfd denied by desktop because of mod_security

I have a WHM/Cpanel server with CSF/LFD installed and mod_security enabled. I used to login to WHM/cpanel from one of my local windows box through a linux (Centos 5)NAT gateway(with a public IP ...
0
votes
1answer
586 views

apache2 reverse proxy broken after modsecurity is installed ubuntu on 12.04.1

this is the first time I have run into issue like this one. I have a java application setting behind a apache2 using mod_ajp on 8009. I have noticed that I could not get the client's IP so I have ...
0
votes
0answers
159 views

Nginx + mod_security without a backend server

I want to start using mod_security for Nginx. However, I have read the official doc and something got my atention: ...
1
vote
0answers
406 views

Curl Sourced DDoS: How to detect it & how to stop?

Okay, an Ubuntu server I manage fell victim to a DDoS attack today. Usually this is unpleasant but not that big a deal. A few high server load moments & then it passes. Today was clearly ...
0
votes
1answer
526 views

Apache/ModSecurity - Blocking HTML Textarea with 403 when it contains a linebreak (enter key)?

I have a contact form, within this contact form is a textarea. If i fill out the contact form and in the test area, i enter one line of text, e.g. Example The form completes and i am notified via ...
0
votes
0answers
144 views

Modsec: Set env variable based on User-agent

Relatively new to Apache modsec. Trying to do something simple and hitting a wall. I want to set an environment variable based on the User-Agent, and test it by setting a header. I have this: ...
1
vote
0answers
209 views

How to solve UNIQUE_ID variable issue in modsecurity_crs_16_session_hijacking.conf ubuntu 10.04

I have been trying to harden ubuntu 10.04 using modsecurity and its core rules from owasp version 2.2.5. I have used the package from their github . After the symbolic link of the files in the ...
4
votes
2answers
5k views

mod_security not actually blocking requests despite rule trigger & returning 403

I've pulled my finger out and installed mod_security to protect our WHMCS installation (a PHP based billing system) from some of the more obvious SQL injection attacks to try and minimise our ...
1
vote
1answer
300 views

Configuring mod_security on Ubuntu 10.04

After spending ~24 hours trying and failing to setup mod_security in Ubuntu 10.04 LTS, I've finally decided that I'm going to need some help. I've tried pretty much every tutorial I can find with a ...
2
votes
2answers
113 views

How to use Modsec rules to certain page?

i want to block proxy(x-forwarded) ip certain page(wp-comments-post.php) using Apache Mod_security. my current mod_security rule: SecRule REQUEST_HEADERS_NAMES "^x-forwarded-for" ...
-1
votes
1answer
1k views

how to whitelist a certain cookie string in ModSecurity

We are getting a lot of False Positives from using 3rd part software on our server. They themselves can't seem to fix it and I'm trying to work out how to allow cookies through that contain ...
1
vote
0answers
89 views

ModSecurity: What do MULTIPART_DATA_BEFORE and MULTIPART_DATA_AFTER mean?

I'm getting the following ModSecurity error when posting form data to a LiquidWeb server: Multipart request body failed strict validation: PE 0, BQ 0, BW 0, DB 1, DA 1, HF 0, LF 0, SM 0, IQ 0, IP 0, ...
-3
votes
1answer
66 views

how i configuration mod_security? [closed]

when i setup mod_security default configuration then if anyone go wordpress admin panel and change any code or some modified then his ip block. why? my all customer complain for this problem. how i ...
0
votes
1answer
97 views

How to block/ban clients that try to access some paths / urls?

Some spambots hammer my server with nonexisting paths like /user/pass?=asdfdasfas How could I block any access to /user/pass?=* ? Is there a better tool than iptables or csf for catching such crap?
4
votes
2answers
198 views

Why bother reverse proxying applications if you aren't using mod_security or TMG/UAG?

Common wisdom is that internal applications that live inside of the trusted network, such as Exchange, should be reverse proxies whenever they are exposed to the Internet. Microsoft recommends using ...