ModSecurity supplies an array of request filtering and other security features to the Apache HTTP Server. ModSecurity is a web application layer firewall.

learn more… | top users | synonyms

1
vote
0answers
174 views

How to solve UNIQUE_ID variable issue in modsecurity_crs_16_session_hijacking.conf ubuntu 10.04

I have been trying to harden ubuntu 10.04 using modsecurity and its core rules from owasp version 2.2.5. I have used the package from their github . After the symbolic link of the files in the ...
0
votes
0answers
158 views

mod_security2 rules for WordPress

Are there any standard (?!) mod_security2 rules for servers with WordPress websites? I want to make clear that I do not want to disable mod_security2 (it exists for a good reason). I just want to make ...
3
votes
2answers
4k views

mod_security not actually blocking requests despite rule trigger & returning 403

I've pulled my finger out and installed mod_security to protect our WHMCS installation (a PHP based billing system) from some of the more obvious SQL injection attacks to try and minimise our ...
-1
votes
2answers
5k views

How to turn off mod_security 2 on apache cpanel?

Preface I have been banging my head searching and trying to figure out why I am getting a 406 error on some occasions: Not Acceptable: An appropriate representation of the requested resource / could ...
1
vote
1answer
299 views

Configuring mod_security on Ubuntu 10.04

After spending ~24 hours trying and failing to setup mod_security in Ubuntu 10.04 LTS, I've finally decided that I'm going to need some help. I've tried pretty much every tutorial I can find with a ...
2
votes
2answers
84 views

How to use Modsec rules to certain page?

i want to block proxy(x-forwarded) ip certain page(wp-comments-post.php) using Apache Mod_security. my current mod_security rule: SecRule REQUEST_HEADERS_NAMES "^x-forwarded-for" ...
-1
votes
1answer
780 views

how to whitelist a certain cookie string in ModSecurity

We are getting a lot of False Positives from using 3rd part software on our server. They themselves can't seem to fix it and I'm trying to work out how to allow cookies through that contain ...
1
vote
0answers
65 views

ModSecurity: What do MULTIPART_DATA_BEFORE and MULTIPART_DATA_AFTER mean?

I'm getting the following ModSecurity error when posting form data to a LiquidWeb server: Multipart request body failed strict validation: PE 0, BQ 0, BW 0, DB 1, DA 1, HF 0, LF 0, SM 0, IQ 0, IP 0, ...
-3
votes
1answer
63 views

how i configuration mod_security? [closed]

when i setup mod_security default configuration then if anyone go wordpress admin panel and change any code or some modified then his ip block. why? my all customer complain for this problem. how i ...
0
votes
1answer
86 views

How to block/ban clients that try to access some paths / urls?

Some spambots hammer my server with nonexisting paths like /user/pass?=asdfdasfas How could I block any access to /user/pass?=* ? Is there a better tool than iptables or csf for catching such crap?
4
votes
2answers
179 views

Why bother reverse proxying applications if you aren't using mod_security or TMG/UAG?

Common wisdom is that internal applications that live inside of the trusted network, such as Exchange, should be reverse proxies whenever they are exposed to the Internet. Microsoft recommends using ...
4
votes
2answers
10k views

How do I find out if mod_security is installed on my apache server?

How can I find out if mod_security is installed on my apache server? I would also like to learn its version. I'm having some upload issues and I tried to disable mod_security using .htaccess. But ...
1
vote
0answers
145 views

nginx with fail2ban and mod_security

I forgot to update my fail2ban config for nginx. I just moved to nginx from apache. Today, I got a lot of cals from a single IP. IP tried to access login pages with post and get methods IP tried to ...
1
vote
0answers
317 views

How do I handle apache2 modsecurity2 warnings like Match of “rx ^OPTIONS$” against “REQUEST_METHOD” required?

After upgrade from squeeze to wheezy I get loads of these messages in my apache errorlog when I open a webpage on myserver, (changed to myserver.de here): [Sat Oct 19 01:06:21 2013] [error] [client ...
1
vote
2answers
464 views

Blocking bad bots

I found this script and was wondering if this is just overkill and even worth using? Is it better for me to just use mod_security? # Generated using http://solidshellsecurity.com services # Begin ...
1
vote
0answers
612 views

ModSecurity: collections_remove_stale: Failed deleting collection

Environment: Ubuntu Server 12.04 64Bit with Apache/2.2.22 (Ubuntu) and Worker mpm with modsecurity 2.7.5 and OWASP CRS latest. Problem: When server is under a load of 1500 concurrent users ...
0
votes
1answer
37 views

Find excluded keywords for $_POST/$_GET content with ModSecurity? [closed]

Our client has ModSecurity 2.0 with Rule Set 2.0.5 but he told us that minor detail at the end of the development. I need to audit all the application code and make sure it does not interfere with ...
0
votes
0answers
158 views

apache DirectoryMatch matching filenames

I have the following code in my security.conf file of apache <DirectoryMatch "/(albums|attachment(s)?|upload(s)?)"> Options -ExecCGI <IfModule php5_module> php_flag engine off ...
-1
votes
1answer
215 views

You don't have permission to access /on this server

I created a form in joomla with 2000 fields but when I submit the form it gives me: error-- You don't have permission to access /en/soccer-player-update on this server. Additionally, a 404 Not Found ...
1
vote
2answers
1k views

ModSecurity compile error on nginx

I'm trying to install ModSecurity on nginx with the following instructions : wget https://github.com/SpiderLabs/ModSecurity/archive/master.zip unzip master cd ModSecurity-master ./autogen.sh ...
0
votes
1answer
1k views

Blocking repeated http requests in Apache behind a load balancer

I have a number of EC2 servers on AWS running apache behind a load balancer (ELB). Every now and then some IP address abuses the API hosted on the EC2 servers and causes a denial of service. I have no ...
0
votes
1answer
547 views

modsecurity whitelist to allow file downloads?

I have a site that has modsecurity enabled but I am receiving 403 Forbidden when trying to access PDF documents on the server through the web site. Is there a way to whitelist pdf files to allowed to ...
1
vote
0answers
66 views

mod_security to Inspect Post Variables

Can mod_security be used to inspect post variables? It looks like I can through turning SecRequestBodyAccess. I would like to check the username POST field from a form in wp-login.php. If it's value ...
-1
votes
2answers
431 views

How to prevent from uploading shell

What is the best way to prevent from uploading c99shell,r57shell and another php sheller? i want when an attacker upload a shell the sheller don't show for him. I use mod_security ver 1.x Thanks in ...
0
votes
1answer
87 views

Proxying while preserving URI with mod_security2

I'm using a proxy: action in mod_security2. I'd like to preserve the full URL of the original request, however, and it seems to be rewriting that to the url in my proxy: action. So a request to ...
0
votes
1answer
473 views

Apache 2.2.4: problems chroot with modsecurity

I've been installed mod_security. If i simply include in the httpd the configuration files of mod_security, it starts normally. Indeed, if i try to add SecChrootDir /mnt/chr , httpd will start, but at ...
1
vote
1answer
462 views

Mod_security2 and clamav to catch malicious files on upload

Is there a clear documentation to describe the solution? It's very common and also necessary.
1
vote
0answers
869 views

How to reinstall mod_security for Apache

Today I tried to update my PHP version in EasyApache but on enable ModSecurity it throw an error in last step of rebuilding. I like to enable mod_security for security reasons, of course. :P But I ...
1
vote
0answers
518 views

short Apache outages (VPS, ModSecurity)

I have a problem with my site recently hosted at Liquidweb, none of their techs seems to be able to solve this issue even after days. Was hoping I could get some help here. Occasionally, my site's ...
2
votes
1answer
2k views

Why Is ModSecurity Unable to Access the Data Directory?

Update I think we've solved this; the problem appears to have been a result of the /modsec_storage directory having an incorrect value for its SELinux context type. However, we're still not sure, ...
0
votes
1answer
323 views

Apache vhost-specific logging

I have the following apache setting (in conf.d/owasp-modsecurity.conf): SecAuditLog "/var/www/vhosts/${lowercase:%{SERVER_NAME}}/statistics/logs/modsec_audit.log" When I do httpd -t I get the ...
1
vote
1answer
538 views

Limit mod_security rule to one vhost only

I run several domains (via vhosts) with the same apache installation. Some domains require different mod_security rules than the others. In a seperate exceptions.conf file I collect all those rules ...
1
vote
0answers
105 views

log/dump response body

Is there any way to log response body in Apache 2? I need the exact content that will be sent to user browser. I tried mod_security audit logging, but it won't log response body for all requests. ...
3
votes
1answer
1k views

Enable Mod_Security for only one website

Is there a way to dis-able mod-security for all websites? except one? i have more than 500 websites hosted, only want to turn it on for one website, which is having attacks on it.
1
vote
1answer
508 views

Dropping incoming requests for a specific file with iptables

Server is a standard LAMP stack configured via cpanel on CentOS 5.9. We have one file, call it bad.php, on one of our domains that is mistakenly being accessed about 10 times a second by a service ...
1
vote
1answer
276 views

Does ModSecurity 2.7.1 work with ASP.NET MVC 3?

I'm trying to get ModSecurity 2.7.1 to work with an ASP.NET MVC 3 website. The installation ran without errors and looking at the event log, ModSecurity is starting up successfully. I am using the ...
1
vote
3answers
2k views

modsecurity inbound_anomaly_score

I get this error from web server - is this known issue. There is plenty of questions on google -- but not clear solution. [error] [client ] ModSecurity: Warning. Operator LT matched 20 at ...
0
votes
1answer
2k views

What is the difference between an Audit Log and a regular Log (In the context of mod_security)?

I am using mod_security What is the difference between and audit log (audit trail) and a normal log? I read on wikipedia that an audit log is a log of user activity, if this is the case what would ...
-1
votes
1answer
63 views

hosting provider web server blocks certain url string by using mod security [closed]

I have a blog which has a post with the following as url /blog/insert-into-tablea-select-fields-from-tableb-for-specific-values-only/ This was working well until recently. I got a different ...
0
votes
1answer
584 views

How do I include a rule set with ModSecurity on IIS?

I'm using ModSecurity 2.7.1 on IIS 7.5 / Windows 2008 R2. I've reference my base set up conf file in my Web.Staging.config of a site like so: <ModSecurity enabled="true" ...
1
vote
2answers
2k views

How do I enable mod_security in Ubuntu 10.04?

A quick run through of what I've done: apt-get install libapache-mod-security a2enmod mod-security create /etc/apache2/mod_security_rules/ with base_rules and optional_rules from the latest core ...
2
votes
0answers
70 views

.htaccess ignored two layers deep on only some hosting plans [closed]

I have one .htaccess file doing this: RewriteRule ^system(.*)$ /system/app/$1 [QSA,L] ...and then underneath /system/app, I have another .htaccess file doing this: RewriteCond %{REQUEST_FILENAME} ...
0
votes
1answer
642 views

installing mod_security causing apache service start to fail

I installed mod security using this tutorial http://www.linuxmaza.... . After installing I got the error described and followed the steps to solve it. The only thing I did differently was updating ...
7
votes
1answer
2k views

What are PCRE limits?

In ModSecurity there are PCRE limits exceeded errors. I know I can fix this by setting rules such as: SecPcreMatchLimit 150000 SecPcreMatchLimitRecursion 150000 But, what are these rules actually ...
0
votes
1answer
153 views

Side effects of using owasp mod_sec rules [closed]

I was looking at all the owasp rules for mod_security. How badly does it slow your loading time down if you use them all? What would be the recommended packages to use? I want to mostly block bad UA, ...
0
votes
1answer
387 views

CPANEL ModSec2 not working with SecFilterSelective

Ok, I have cPanel/WHM latest on a Dedi, here are my specs on apache: Server version: Apache/2.2.23 (Unix) Server built: Oct 13 2012 19:33:23 Cpanel::Easy::Apache v3.14.13 rev9999 I just ran a ...
0
votes
1answer
360 views

Mod_security questions and on User-Agent types

Very new to mod_sec I want to block a UA string and I noticed there are a few types: SecRule HTTP_User-Agent SecRule REQUEST_HEADERS:User-Agent What is the real difference between them? My block: ...
0
votes
1answer
97 views

Installing mod_security [closed]

I have apache and suphp running. How hard is it to install modsecurity? Also, where can I find some light weight/generic rule-sets to not bog apache down?
3
votes
2answers
293 views

Mod_security Logging

Im trying to run mod_security as standalone service with nginx as reverse proxy everything works fine except logging. Mod_security logs reverse proxys ip addres instead of clients ip address. I would ...
0
votes
1answer
756 views

Nginx with mod_security support

I have compiled nginx with mod_security support. In error log I can see the support for mod_security 2012/08/27 11:13:11 [info] 602096#0: ModSecurity for nginx/2.7.0-rc2 ...