ModSecurity supplies an array of request and response filtering rules and other security features to the Apache HTTP Server. ModSecurity is an open source web application layer firewall.

learn more… | top users | synonyms

0
votes
0answers
20 views

ModSecurity shows server ip as source instead of attacker ip

after upgrade to PHP 5.5 and everything works well i found that mod security is logging all attacks with the server ip itself instead of attacker ip !! before upgrade it was showing the attacker ip ...
3
votes
2answers
4k views

mod_security 960015 blocks Google and other good bots

mod_security rule 960015 keeps catching Google and other good bots. I have the following in the vhost to prevent good bots from being caught: SecRule REQUEST_HEADERS:User-Agent "Mail.ru" log,allow ...
1
vote
0answers
125 views

How install PHP 5.4, mod_security and mod_evasive together without conflict

I need create webserver with PHP 5.4, and install mod_security and mod_evasive. But when I try to join the php 5.4 and the mods on an EC2 server, it returns an error of conflict between the versions ...
0
votes
1answer
58 views

mod_security installation not creating /usr/share/modsecurity-crs/

I have a server running ubuntu 14 lamp I´ve installed mod_security: apt-get install libapache2-modsecurity then decided to uninstall using this command: sudo apt-get remove ...
0
votes
1answer
228 views

Syntax error on line 23 of /etc/httpd/conf.d/modsecurity.conf [duplicate]

I'm try install and configure Mod_Security on Amazon EC2 Linux 64 bits, but one error happens Syntax error on line 23 of /etc/httpd/conf.d/modsecurity.conf: ModSecurity: Found another rule with the ...
0
votes
0answers
211 views

After install mod_security and mod_evasive, php not working

I followed this tutorial ( tutorial.centos.com.my/?p=69 ) and got success to install mod_security and mod_evasive. But php does not run, displays the code in the browser. Insert an index.php file in ...
5
votes
2answers
172 views

How to include ModSecurity request final action in the Apache access.log

I'm currently using ModSecurity 2.7 and Apache 2.4.7 on Ubuntu Trusty. I would like to use Apache's LogFormat and CustomLog directives so that I can include a field indicating whether ModSecurity ...
0
votes
1answer
284 views

VPS server restarting MOD_SECURITY?

My VPS server has been acting up lately, for example last weekend the PHP module Imagemagick simply stopped working and I had to do a PERC uninstall / reinstall. Today my server has been totally ...
0
votes
1answer
205 views

Jetmon being blocked by ModSecurity, how to write override rule?

I have a WordPress site on a VPC and I'm trying to tweak ModSecurity to reduce the false positives. I have Jetpack monitoring which is being denied when ModSecurity is active. Log from Apache ...
3
votes
2answers
7k views

ModSecurity block specific string in request

I want a ModSecurity rule, which block the access to any url or any Body request Post/Get, if it contains a specific string. For example i want to block this string : "km0ae9gr6m" I have this rule ...
0
votes
1answer
560 views

security2_module for apache is causing the “Forbidden You don't have permission to access / on this server” message

I installed the security2 module to my apache server by adding these following lines to my httpd.conf: <IfModule security2_module> Include ...
0
votes
2answers
24 views

Modsecurity rule to not scan URIs

Good Morning, I am currently on creating a new mod security 2.5 rule. My deployment: I have an Apache server in reverse proxy mode. This Apache server does not host the websites. Instead, I proxy ...
2
votes
1answer
92 views

ModSecurity rule to not scan URI

I am having difficulty creating a new mod security 2.5 rule. My deployment: Apache server, Setup as a reverse proxy. (so the apache webserver __does not_ host the website. Instead, I proxy the ...
5
votes
1answer
653 views

ModSecurity on Apache (Debian Wheezy), Authentication logging

I am new to ModSecurity, it works great on the server, but I would like to control the way it logs things. For example as I am troubleshooting my website in order to whitelist or correct php coding ...
0
votes
1answer
91 views

WAF at Transparent Mode

I want to use Mod Security as transparent mode. Mod security web application firewall (WAF) should be between server and client and client provided with only server's IP address to access the site. ...
0
votes
1answer
465 views

mod-security not blocking POST request

I have a mod-security compiled from source and installed on Ubuntu Server 12.04, Apache 2.2.22. I loaded the OWASP core rule set, and I can see them getting triggered on the log file ...
-1
votes
2answers
41 views

Modsecurity: no action id present

I have not been doing anything with my site for a while and recently upgraded Ubuntu from 12.04 to 14.04 LTS, but now I am getting errors like: Modsecurity: no action id present I looked around ...
4
votes
1answer
1k views

How to get mod_security to log all POST data?

I currently have a CentOS system that is successfully logging relevant mod_security actions to the audit log file. The following is my configuration: <IfModule mod_security2.c> SecRuleEngine ...
0
votes
0answers
79 views

Apache hangs after on heavy load

I am using apache 2.4.7 in ubuntu14.04 . I am using mod mpm_event in the apache and due to some DOS attack my server got hang after certain time. I am using this default setting for it. StartServers ...
-2
votes
1answer
117 views

Apache server crashes due to bandwidth spike issue [closed]

The problem I am facing is that my Website (hosted on a dedicated VPS) was working fine for last 6 months. However from last two days, it gets huge spikes of DATA coming in and this causes server to ...
0
votes
0answers
110 views

Apache header order

I am working on a private server application for a web based mobile game that uses php to generate responses. In order to do this I am trying to replicate the behavior of the main server as closely as ...
0
votes
1answer
374 views

Does a mod_security error block a visitor?

Does a mod_security execution/rule error or errors in general block users from visiting my website? Ive got many rule and execution errors, Ive just whitelisted these rules but maybe I could just ...
1
vote
2answers
3k views

Blocking repeated http requests in Apache behind a load balancer

I have a number of EC2 servers on AWS running apache behind a load balancer (ELB). Every now and then some IP address abuses the API hosted on the EC2 servers and causes a denial of service. I have no ...
1
vote
1answer
940 views

Apache with modsec “collections_remove_stale: Failed to access DBM file” [closed]

I seem to getting alot of these lately in my apache error log: Message: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ip": Resource deadlock avoided Server Version: ...
1
vote
1answer
165 views

Can mod_security only log triggered rules if the request was blocked?

I've installed mod_security and I'm currently running in DetectionOnly mode as I monitor logs and configure to suit my servers needs. I've set it up for anomaly scoring and tweaked my scores ...
2
votes
3answers
3k views

mod_security: another rule with same ID

I have installed httpd 2.2.15 on CentOS 6.5 (minimal installation with no cPanel) with modsecurity 2.8. When I am starting httpd I am getting this error: Starting httpd: Syntax error on line 23 of ...
1
vote
0answers
91 views

Test for length of ARG parameter in SecRule - Mod Security

What is the most efficient way to limit the length of a http request parameter using Mod Security? For example, to limit WordPress comment length : SecRule ARGS:comment "^.{65530}" Would this regex ...
1
vote
1answer
369 views

Apache server fault after configure mod-security2

I configured mod-security, from https://www.digitalocean.com/community/tutorials/how-to-set-up-mod_security-with-apache-on-debian-ubuntu . After that a restart apache service but i caught error: The ...
1
vote
0answers
239 views

apache mod_evasive with mpm_prefork settings to work

I have tried to find all the information I could on this and I understand the problem with mod_evasive not working when the server is in the mpm_prefork mode (instead of worker). However, I was able ...
0
votes
2answers
80 views

Modsecurity oddity

my mod security is loading fine but when I set the server token like so SecServerSignature "Infodous Webserver" it returns "Infodous Webserver mod_fcgid/2.3.6 PHP/5.4.39-0+deb7u1 proxy_html/3.0.1 ...
-1
votes
1answer
181 views

Blocking request with query string

I'm an under a DDoS attack though I have cloud flare.. I found out that the attacker is accessing the server using query strings "?a=randomnumber" I don't use query strings in my website so I need ...
1
vote
1answer
1k views

Simple DoS protection with mod_security? [closed]

I have mod security2 in ubuntu 14.04 LTS server. I saw the below tutorial: http://blog.cherouvim.com/simple-dos-protection-with-mod_security/ The above sadly do not work on me apache error : * ...
-1
votes
2answers
504 views

block php file access (modsecurity)

How can I block all access to a PHP file? File name is similar to sm6######.php where #### can be any random digit. How can I do it using mod_sec?
0
votes
1answer
1k views

modsecurity whitelist to allow file downloads?

I have a site that has modsecurity enabled but I am receiving 403 Forbidden when trying to access PDF documents on the server through the web site. Is there a way to whitelist pdf files to allowed to ...
1
vote
1answer
556 views

mod_security not working at all

I'm trying to make the mod_security work, I searched a lot on the web, and followed this tutorial to configure mod_security (all my configuration files are the same as the tutorial), and when I run ...
1
vote
0answers
91 views

ModSecurity on Apache 2.2 in EC2 - HTTP Status 413 messages dropped

Hi I am running Mod_Security on Ubuntu instances in EC2 behind an Elastic Loadbalancer. The app is a Ruby App. I have set SecRequestBodyLimit 293601280 When I upload files below that size, they ...
1
vote
1answer
1k views

How do I include a rule set with ModSecurity on IIS?

I'm using ModSecurity 2.7.1 on IIS 7.5 / Windows 2008 R2. I've reference my base set up conf file in my Web.Staging.config of a site like so: <ModSecurity enabled="true" ...
4
votes
3answers
5k views

Why does mod_security require an ACCEPT HTTP header field?

After some debugging, I found that the core ruleset of mod_security blocks requests that don't have the (optional!) ACCEPT header field. This is what I find in the logs: ModSecurity: Warning. ...
1
vote
1answer
116 views

Changing ModSecurity Logging on a Per Transaction Basis

I am trying to trace all requests being made to a website on a shared hosting server. Packet capture is just going to be too cumbersome. We use Mod Security (2.8) with good effect, although due to ...
0
votes
2answers
809 views

Nginx, ModSecurity, IP Tables blocking WordPress dos/ddos attack

For the past 14 days I have had my website being hit by millions of WordPress installs over the world which .htaccess is kind of coping with but I am trying to get something to kick them before ...
2
votes
0answers
128 views

ModSecurity phase not working?

I have installed modsecurity (2.8). So I made my first rule to block a referrer spam with the following: SecRule REQUEST_HEADERS:Referer "buttons\-for\-website\.com" ...
-2
votes
2answers
138 views

How to Disable ModSecurity without any Errors

I've enabled Mod_Security on my VPS which runs an Ubuntu OS with an apache web server. Now, I want to disable it because I setup another firewall to protect my server. I've tried preforming the steps ...
1
vote
0answers
304 views

Apache mod_security crs blocking PDF files

I've just installed CRS for Apache mod_security and it's reporting all PDF files as possible attacks. Specificaly, it's the modsecurity_crs_20_protocol_violations.conf that's causing the trouble ...
1
vote
1answer
448 views

Does ModSecurity 2.7.1 work with ASP.NET MVC 3?

I'm trying to get ModSecurity 2.7.1 to work with an ASP.NET MVC 3 website. The installation ran without errors and looking at the event log, ModSecurity is starting up successfully. I am using the ...
1
vote
1answer
166 views

mod_security to Inspect Post Variables

Can mod_security be used to inspect post variables? It looks like I can through turning SecRequestBodyAccess. I would like to check the username POST field from a form in wp-login.php. If it's value ...
1
vote
1answer
314 views

How to debug modsecurity_audit_log

I was accessing www.example.com/RestAPI/index.php/tweets.json in my server. The modsec_audit.log showed the following error, but there is no related errors/warnings in modsec_debug.log. I could see ...
3
votes
1answer
1k views

mod_security ruleset for Joomla! admin

I run several hosting servers and recently I have experienced a lot of bruteforce attacks against joomla-based websites. Attackers seem to try a bruteforce against administrator/index.php page. I ...
0
votes
0answers
234 views

prevent phpbb bruteforcing with mod_security

Update: I edited this and added a fail2ban tag. Perhaps that might be another way to handle this issue. I'm running phpbb 3.0.13-PL1 and I would like to protect the login page from bruteforcing. I'm ...
1
vote
1answer
1k views

how to control apache mod-security for IP-address

I have mod security installed on my server. It is working for all IP addresses. Now I need to EXCLUDE specific IP addresses from applying this mod-security. How can I do so? Is there a way to control ...
1
vote
2answers
8k views

how I can know which version of mod security that I had on the server? and how I can update it? [closed]

I'm using cpanel (11.25 Stable 46156) with mod security installed. How can I know the version of mod security that installed in the server? How can I update mod security manually or make it update ...