ModSecurity supplies an array of request and response filtering rules and other security features to the Apache HTTP Server. ModSecurity is an open source web application layer firewall.

learn more… | top users | synonyms

-1
votes
2answers
34 views

Modsecurity: no action id present

I have not been doing anything with my site for a while and recently upgraded Ubuntu from 12.04 to 14.04 LTS, but now I am getting errors like: Modsecurity: no action id present I looked around ...
3
votes
1answer
835 views

How to get mod_security to log all POST data?

I currently have a CentOS system that is successfully logging relevant mod_security actions to the audit log file. The following is my configuration: <IfModule mod_security2.c> SecRuleEngine ...
0
votes
0answers
59 views

Apache hangs after on heavy load

I am using apache 2.4.7 in ubuntu14.04 . I am using mod mpm_event in the apache and due to some DOS attack my server got hang after certain time. I am using this default setting for it. StartServers ...
-2
votes
1answer
88 views

Apache server crashes due to bandwidth spike issue [closed]

The problem I am facing is that my Website (hosted on a dedicated VPS) was working fine for last 6 months. However from last two days, it gets huge spikes of DATA coming in and this causes server to ...
0
votes
0answers
79 views

Apache header order

I am working on a private server application for a web based mobile game that uses php to generate responses. In order to do this I am trying to replicate the behavior of the main server as closely as ...
0
votes
0answers
235 views

mod_fcgid - Cannot allocate memory

I discovered yesterday some Errors on Apache2 Log and looking how to solve it somehow. My Problem is that I do not know where to start. As a Noob I am it is a little bit hard for me to get it solved. ...
0
votes
0answers
35 views

ModSecurity: Output filter: Response body data memory allocation failed

Can anybody tell me what this errors means? Could not find a really good results for it. [Sat May 09 11:15:42 2015] [error] [client 52.1.123.91] ModSecurity: Output filter: Response body data memory ...
0
votes
1answer
268 views

Does a mod_security error block a visitor?

Does a mod_security execution/rule error or errors in general block users from visiting my website? Ive got many rule and execution errors, Ive just whitelisted these rules but maybe I could just ...
1
vote
2answers
2k views

Blocking repeated http requests in Apache behind a load balancer

I have a number of EC2 servers on AWS running apache behind a load balancer (ELB). Every now and then some IP address abuses the API hosted on the EC2 servers and causes a denial of service. I have no ...
1
vote
1answer
732 views

Apache with modsec “collections_remove_stale: Failed to access DBM file” [closed]

I seem to getting alot of these lately in my apache error log: Message: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ip": Resource deadlock avoided Server Version: ...
1
vote
1answer
139 views

Can mod_security only log triggered rules if the request was blocked?

I've installed mod_security and I'm currently running in DetectionOnly mode as I monitor logs and configure to suit my servers needs. I've set it up for anomaly scoring and tweaked my scores ...
2
votes
3answers
2k views

mod_security: another rule with same ID

I have installed httpd 2.2.15 on CentOS 6.5 (minimal installation with no cPanel) with modsecurity 2.8. When I am starting httpd I am getting this error: Starting httpd: Syntax error on line 23 of ...
1
vote
0answers
66 views

Test for length of ARG parameter in SecRule - Mod Security

What is the most efficient way to limit the length of a http request parameter using Mod Security? For example, to limit WordPress comment length : SecRule ARGS:comment "^.{65530}" Would this regex ...
1
vote
1answer
283 views

Apache server fault after configure mod-security2

I configured mod-security, from https://www.digitalocean.com/community/tutorials/how-to-set-up-mod_security-with-apache-on-debian-ubuntu . After that a restart apache service but i caught error: The ...
0
votes
0answers
239 views

ModSecurity + Nginx “SecRule” startup error

I've installed Nginx (1.8.0) + ModSecurity (2.9.0) from source on OpenBSD (5.6), without problems. But when I try to configure modsecurity with the default config, upon starting nginx I get: ...
1
vote
0answers
184 views

apache mod_evasive with mpm_prefork settings to work

I have tried to find all the information I could on this and I understand the problem with mod_evasive not working when the server is in the mpm_prefork mode (instead of worker). However, I was able ...
0
votes
2answers
68 views

Modsecurity oddity

my mod security is loading fine but when I set the server token like so SecServerSignature "Infodous Webserver" it returns "Infodous Webserver mod_fcgid/2.3.6 PHP/5.4.39-0+deb7u1 proxy_html/3.0.1 ...
-1
votes
1answer
170 views

Blocking request with query string

I'm an under a DDoS attack though I have cloud flare.. I found out that the attacker is accessing the server using query strings "?a=randomnumber" I don't use query strings in my website so I need ...
1
vote
1answer
1k views

Simple DoS protection with mod_security? [closed]

I have mod security2 in ubuntu 14.04 LTS server. I saw the below tutorial: http://blog.cherouvim.com/simple-dos-protection-with-mod_security/ The above sadly do not work on me apache error : * ...
-1
votes
2answers
479 views

block php file access (modsecurity)

How can I block all access to a PHP file? File name is similar to sm6######.php where #### can be any random digit. How can I do it using mod_sec?
0
votes
1answer
1k views

modsecurity whitelist to allow file downloads?

I have a site that has modsecurity enabled but I am receiving 403 Forbidden when trying to access PDF documents on the server through the web site. Is there a way to whitelist pdf files to allowed to ...
1
vote
1answer
433 views

mod_security not working at all

I'm trying to make the mod_security work, I searched a lot on the web, and followed this tutorial to configure mod_security (all my configuration files are the same as the tutorial), and when I run ...
1
vote
0answers
84 views

ModSecurity on Apache 2.2 in EC2 - HTTP Status 413 messages dropped

Hi I am running Mod_Security on Ubuntu instances in EC2 behind an Elastic Loadbalancer. The app is a Ruby App. I have set SecRequestBodyLimit 293601280 When I upload files below that size, they ...
0
votes
1answer
972 views

How do I include a rule set with ModSecurity on IIS?

I'm using ModSecurity 2.7.1 on IIS 7.5 / Windows 2008 R2. I've reference my base set up conf file in my Web.Staging.config of a site like so: <ModSecurity enabled="true" ...
4
votes
3answers
5k views

Why does mod_security require an ACCEPT HTTP header field?

After some debugging, I found that the core ruleset of mod_security blocks requests that don't have the (optional!) ACCEPT header field. This is what I find in the logs: ModSecurity: Warning. ...
1
vote
1answer
100 views

Changing ModSecurity Logging on a Per Transaction Basis

I am trying to trace all requests being made to a website on a shared hosting server. Packet capture is just going to be too cumbersome. We use Mod Security (2.8) with good effect, although due to ...
0
votes
2answers
757 views

Nginx, ModSecurity, IP Tables blocking WordPress dos/ddos attack

For the past 14 days I have had my website being hit by millions of WordPress installs over the world which .htaccess is kind of coping with but I am trying to get something to kick them before ...
2
votes
0answers
126 views

ModSecurity phase not working?

I have installed modsecurity (2.8). So I made my first rule to block a referrer spam with the following: SecRule REQUEST_HEADERS:Referer "buttons\-for\-website\.com" ...
-2
votes
2answers
107 views

How to Disable ModSecurity without any Errors

I've enabled Mod_Security on my VPS which runs an Ubuntu OS with an apache web server. Now, I want to disable it because I setup another firewall to protect my server. I've tried preforming the steps ...
1
vote
0answers
265 views

Apache mod_security crs blocking PDF files

I've just installed CRS for Apache mod_security and it's reporting all PDF files as possible attacks. Specificaly, it's the modsecurity_crs_20_protocol_violations.conf that's causing the trouble ...
1
vote
1answer
419 views

Does ModSecurity 2.7.1 work with ASP.NET MVC 3?

I'm trying to get ModSecurity 2.7.1 to work with an ASP.NET MVC 3 website. The installation ran without errors and looking at the event log, ModSecurity is starting up successfully. I am using the ...
1
vote
1answer
144 views

mod_security to Inspect Post Variables

Can mod_security be used to inspect post variables? It looks like I can through turning SecRequestBodyAccess. I would like to check the username POST field from a form in wp-login.php. If it's value ...
1
vote
1answer
288 views

How to debug modsecurity_audit_log

I was accessing www.example.com/RestAPI/index.php/tweets.json in my server. The modsec_audit.log showed the following error, but there is no related errors/warnings in modsec_debug.log. I could see ...
3
votes
1answer
935 views

mod_security ruleset for Joomla! admin

I run several hosting servers and recently I have experienced a lot of bruteforce attacks against joomla-based websites. Attackers seem to try a bruteforce against administrator/index.php page. I ...
0
votes
0answers
179 views

prevent phpbb bruteforcing with mod_security

Update: I edited this and added a fail2ban tag. Perhaps that might be another way to handle this issue. I'm running phpbb 3.0.13-PL1 and I would like to protect the login page from bruteforcing. I'm ...
1
vote
1answer
1k views

how to control apache mod-security for IP-address

I have mod security installed on my server. It is working for all IP addresses. Now I need to EXCLUDE specific IP addresses from applying this mod-security. How can I do so? Is there a way to control ...
1
vote
2answers
7k views

how I can know which version of mod security that I had on the server? and how I can update it? [closed]

I'm using cpanel (11.25 Stable 46156) with mod security installed. How can I know the version of mod security that installed in the server? How can I update mod security manually or make it update ...
5
votes
2answers
3k views

Why does modsecurity require Content-Length in POST requests?

I have a RESTful web service that accepts a POST request to a resource without an entity body, e.g. an empty POST request. The default modsecurity configuration requires that all POST requests have a ...
0
votes
2answers
276 views

ModSecurity Error Entries

Recently, I was passed some error logs to take a look into, since we'd had some network spikes recently. However, I've never worked with modsecurity (I'm a programmer just doing this since we don't ...
0
votes
1answer
4k views

Mod_security - Syntax error

I have a password protected directory on my web server. To protect that from brute force attack, I tried to add the IP-Based BLocking config as below in the apache2 config file. But everytime I ...
0
votes
0answers
60 views

How can I exclude all arguments except for a list from a ModSecurity rule at runtime?

I have a web service that handles requests from clients that I have no way to control, and only communicate with me when they call that service. A number of these clients' requests run afoul of some ...
1
vote
1answer
227 views

What exactly does the ModSecurity SecCollectionTimeout directive?

I am having a little bit of trouble with a recurring "Failed deleting collection" error message from ModSecurity (see this discussion @ GitHub for some context). In the discussion of this error it is ...
0
votes
1answer
171 views

Modsecurity: Whitelist requests, Block all else?

I'm just reading up about - and experimenting with - modsecurity and hoping someone can educate a little about the method behind the madness. The approach I'd ordinarily take with any firewall is to ...
0
votes
1answer
414 views

whitelist URI on mod_security enabled apache reverse proxy

I have an apache 2.2.29-1.4 with mod_security 2.8.0-5.25 which is a reverse proxy with mod_proxy_http for a local java application. I have false positive on some urls and would like to whitelist some ...
15
votes
5answers
11k views

mod_security block requests by http-host header

The last few days I noticed some servers being hammered with unknown requests. Most of them are like the following: 60.246.*.* - - [03/Jan/2015:20:59:16 +0200] "GET ...
1
vote
3answers
896 views

How do I remove the ServerSignature added by mod_fcgid?

I'm running Mod_Security and I'm using the SecServerSignature to customize the Server header that Apache returns. This part works fine, however I'm also running mod_fcgid which appends ...
7
votes
1answer
10k views

Disable modsecurity For a Specific Directory

How do you disable modsecurity for just a specific directory. I'm getting errors in phpMyAdmin that are caused by modsecurity tripping based on rules. I have the following files set up: # ...
4
votes
1answer
1k views

modsecurity: block IP address that visited 404 pages more than 10 times in a minute

We're using mod_security and we have currently issues with some bots. I would like to block IP Address that visited 404 pages more than 10 times in a minute. How can this be done? How can I poll the ...
2
votes
0answers
486 views

How to filter POST data with mod_security when type is text/xml?

I'm trying to craft a rule which would match certain regex in POST requests. Rule I have so far looks like; SecRule REQUEST_FILENAME "form.php" \ "id:'12345',chain,deny,status:406,log,msg:'foobar ...
3
votes
1answer
709 views

What do the audit log records for ModSecurity actually mean?

We have ModSecurity setup to log to modsec_audit.log for Apache2. Today we have had 2259 entries created in this log with a referrer of: Mozilla/5.0 (compatible; bingbot/2.0; ...