ModSecurity supplies an array of request filtering and other security features to the Apache HTTP Server. ModSecurity is a web application layer firewall.

learn more… | top users | synonyms

0
votes
1answer
338 views

How do I include a rule set with ModSecurity on IIS?

I'm using ModSecurity 2.7.1 on IIS 7.5 / Windows 2008 R2. I've reference my base set up conf file in my Web.Staging.config of a site like so: <ModSecurity enabled="true" ...
1
vote
1answer
210 views

Does ModSecurity 2.7.1 work with ASP.NET MVC 3?

I'm trying to get ModSecurity 2.7.1 to work with an ASP.NET MVC 3 website. The installation ran without errors and looking at the event log, ModSecurity is starting up successfully. I am using the ...
0
votes
2answers
928 views

ModSecurity compile error on nginx

I'm trying to install ModSecurity on nginx with the following instructions : wget https://github.com/SpiderLabs/ModSecurity/archive/master.zip unzip master cd ModSecurity-master ./autogen.sh ...
0
votes
1answer
128 views

Side effects of using owasp mod_sec rules [closed]

I was looking at all the owasp rules for mod_security. How badly does it slow your loading time down if you use them all? What would be the recommended packages to use? I want to mostly block bad UA, ...
0
votes
1answer
181 views

Mod_security questions and on User-Agent types

Very new to mod_sec I want to block a UA string and I noticed there are a few types: SecRule HTTP_User-Agent SecRule REQUEST_HEADERS:User-Agent What is the real difference between them? My block: ...
1
vote
0answers
414 views

mod_security2.so: undefined symbol: ap_unixd_set_gl

service httpd restart Stopping httpd: [ OK ] Starting httpd: httpd: Syntax error on line 205 of /etc/httpd/conf/httpd.conf: Cannot load ...
0
votes
1answer
84 views

Installing mod_security [closed]

I have apache and suphp running. How hard is it to install modsecurity? Also, where can I find some light weight/generic rule-sets to not bog apache down?
0
votes
1answer
252 views

CPANEL ModSec2 not working with SecFilterSelective

Ok, I have cPanel/WHM latest on a Dedi, here are my specs on apache: Server version: Apache/2.2.23 (Unix) Server built: Oct 13 2012 19:33:23 Cpanel::Easy::Apache v3.14.13 rev9999 I just ran a ...
3
votes
2answers
219 views

Mod_security Logging

Im trying to run mod_security as standalone service with nginx as reverse proxy everything works fine except logging. Mod_security logs reverse proxys ip addres instead of clients ip address. I would ...
0
votes
1answer
546 views

Nginx with mod_security support

I have compiled nginx with mod_security support. In error log I can see the support for mod_security 2012/08/27 11:13:11 [info] 602096#0: ModSecurity for nginx/2.7.0-rc2 ...
1
vote
1answer
202 views

mod_security: track user to check if redirected to login failed page

I have to log when a user fails to log in to a web application. Unfortunately, this web application is not able to do this out of the box and I can not change it. Now I'm experimenting with ...
0
votes
2answers
2k views

ModSecurity block specific string in request

I want a ModSecurity rule, which block the access to any url or any Body request Post/Get, if it contains a specific string. For example i want to block this string : "km0ae9gr6m" I have this rule ...
0
votes
0answers
48 views

Error 403 when URL parameters are set twice

I am seeing strange behavior on an Apache server. When a parameter is set twice in the URL (e.g., https://example.com/xxx/xxx.cgi?toto=1&toto=1), I get a 403 error from Apache. I know ...
0
votes
1answer
439 views

ModSecurity not enabled

I have similar problem like question How do I enable mod_security in Ubuntu 10.04? , but i do not have the "minimal" file with me which i can replace and make it work. My configuration is also ...
3
votes
1answer
68 views

Modifying Apache configuration via a Web Interface

I would like to create a website on my server, which runs Apache2, to allow a user to fill in a form containing a desired subdomain name to be created on the server. For example, a user could go to ...
5
votes
1answer
2k views

What are PCRE limits?

In ModSecurity there are PCRE limits exceeded errors. I know I can fix this by setting rules such as: SecPcreMatchLimit 150000 SecPcreMatchLimitRecursion 150000 But, what are these rules actually ...
1
vote
3answers
1k views

How to drop all requests using mod_security

I have an apache2 server with several sites enabled on it, including the default one (000default). The default server is catching lots of spammy requests that are doing nothing but consume bandwidth ...
2
votes
0answers
100 views

Custom collections with mod_security

I would like to create a mod_security collection that is based on something other than the user's IP, Session ID, or username. Specifically, based on the REQUEST_URI. However, mod_security indicates ...
0
votes
1answer
514 views

Broken URLs after enabling mod_security

For example this pdf stopped working after enabling the mod, it generates 403 error. [Wed May 30 18:47:19 2012] [error] [client xxxxxxxxxxx] ModSecurity: Warning. Match of "within ...
0
votes
1answer
216 views

apt-get update Error

I get the following error when typing: # apt-get update W: Failed to fetch http://etc.inittab.org/~agi/debian/libapache-mod-security2/etch/Packages 404 Not Found [IP: 80.28.139.208 80] E: Some ...
1
vote
1answer
310 views

What do the audit log records for ModSecurity actually mean?

We have ModSecurity setup to log to modsec_audit.log for Apache2. Today we have had 2259 entries created in this log with a referrer of: Mozilla/5.0 (compatible; bingbot/2.0; ...
0
votes
1answer
255 views

Mod Security log monitoring

Is there a web based log management utility present for Mod Security? As parsing the logs of Mod Security is a big headache. I can only see traditional log monitoring systems but not any, which is ...
2
votes
1answer
1k views

Where I can find ModSecurity Rules for Specific Applications

Where I can find ModSecurity Rules for Specific Applications specially joomla, wordpress, mambo ?
2
votes
1answer
2k views

Why does mod_security require an ACCEPT HTTP header field?

After some debugging, I found that the core ruleset of mod_security blocks requests that don't have the (optional!) ACCEPT header field. This is what I find in the logs: ModSecurity: Warning. ...
-3
votes
1answer
285 views

mod_security: How to allow ssh/http access for admin?

I am going to be installing mod_security on my AWS EC2 Linux instance tonight and need a little help/reassurance. The only thing I am truly worried about right now is making sure my (admin) access to ...
3
votes
1answer
550 views

modsecurity: block ips, that visited 404 pages more than 10 times in a minute

we're using mod_security and we have currently issues with some bots. i would like to block ips, that visited 404 pages more than 10 times in a minute. How can this be done? How can i poll the 404 ...
1
vote
2answers
719 views

error: libxml2 is required (modsecurity)

I am trying to install mod_security from source. when i run ./configure I get this error: configure: error: libxml2 is required After that error, I executed this command: yum install libxml2 It ...
4
votes
2answers
5k views

mod_security - PCRE limits exceeded

Just about on every request I am getting the following error: Rule execution error - PCRE limits exceeded (-8): (null). After a bunch of googling the only solutions seem to be a) Add the following ...
0
votes
1answer
467 views

installing mod_security causing apache service start to fail

I installed mod security using this tutorial http://www.linuxmaza.... . After installing I got the error described and followed the steps to solve it. The only thing I did differently was updating ...
-1
votes
1answer
132 views

gotroot mod_security rules

Are the gotroot mod_security rules any good? I've heard that you will get a lot of false positives and before I try and use them on a live box just wanted to know if anyone else has experience with ...
1
vote
1answer
283 views

Configuring mod_security on Ubuntu 10.04

After spending ~24 hours trying and failing to setup mod_security in Ubuntu 10.04 LTS, I've finally decided that I'm going to need some help. I've tried pretty much every tutorial I can find with a ...
0
votes
2answers
388 views

How to use RegEx for mod_security

I have a directory/site set-up like this on my Apache/2.2.19 (Win32) Server using mod_security + core ruleset/2.2.1 /website1/login.php /website2/login.php /website3/login.php /websiteN/login.php ...
-1
votes
1answer
713 views

Apache2 mod_security simple default deny rules for specific directory

How to configure the simplest useful default-deny rule set for mod_security? I want to configure mod_security to allow only very specific queries to single directory: In short: I use Apache as a ...
0
votes
1answer
440 views

sources.list entry for mod_security testing release?

I have a debian "squeeze" installation, but the mod_security delivered with this release is quite old. So I'm thinking of adding an additional line to my sources.list to get the "wheezy" version ...
2
votes
2answers
5k views

mod_unique_id: unable to find IPv4 address of FQDN despite setting etc/hosts and Apache ServerName

I'm trying to get mod_security and hit the very common hostname error of [alert] (EAI 2)Name or service not known: mod_unique_id: unable to find IPv4 address of "computername.domain.com" This ...
0
votes
1answer
687 views

HAProxy health check is logged as TCP_MISS/000 in Squid

We have a HAProxy front-end, load balancing a layer of Squid servers, which handles data from an Apache ModSecurity layer, and which ultimately serves up data from IIS cluster. Each Squid server is ...
3
votes
1answer
352 views

Looking for a good web penetration testing client

I'm implementing mod_security on an apache server. In order to test the effectiveness of the protection, I am looking for a client that can generate a set of predefined malicious HTTP requests. I will ...
2
votes
2answers
747 views

what is the impact of increasing the SecResponseBodyLimit from default value (512k) to (5M)?

I installed the mod_security version 2.5.13 with apache2 and I'm facing problem with SecResponseBodyLimit: ( ModSecurity: Output filter: Response body too large (over limit of 524288, total not ...
1
vote
2answers
1k views

How do I enable mod_security in Ubuntu 10.04?

A quick run through of what I've done: apt-get install libapache-mod-security a2enmod mod-security create /etc/apache2/mod_security_rules/ with base_rules and optional_rules from the latest core ...
1
vote
1answer
579 views

mod_security never tells what the problem is

Normally I would just pester my provider to disable the rule. And while he certainly deserves pestering, I've done that way too often already for the low service price. (Like always this is about a ...
1
vote
2answers
280 views

Where does Ubuntu 10.04 store the configuration file of mod-security?

I've installed libapache-mod-security on Ubuntu 10.04. The only configuration file I've been able to find is this one: cat /var/lib/dpkg/info/libapache-mod-security.conffiles ...
1
vote
2answers
564 views

mod_security IP collection key not being set correctly

I'm using an IP collection in a load balanced setup, I therefor want mod_security to act on the x-forwarded for header instead of the REMOTE_ADDR. Here is my rule: SecAction ...
0
votes
2answers
3k views

Why doesn't my mod_security catch / log anything?

I installed mod_security on my Ubuntu GNU/Linux server but when I send some simple requests to the web server that should match even the simplest rules, I fail to see any alerts or any log files that ...
0
votes
1answer
506 views

What is this mod_security rule trying to prevent?

Today my IP was blocked by my server. I was told it was because of a mod_security rule that got triggered. I'm told that the regex that got triggered was ^((?:(?:POS|GE)T|OPTIONS|HEAD)) I don't ...
1
vote
1answer
385 views

What web application firewall do you use? What should I use?

What web application firewall do you use? I'm primarily interested in something I can deploy on the perimeter that can protect multiple Apache and IIS servers, but I'd like to hear all answers. Tell ...
2
votes
1answer
486 views

why use apache's LoadFile?

Installing mod_security, the instructions direct us to add: LoadFile /usr/lib/libxml2.so LoadFile /usr/lib/liblua5.1.so to httpd.conf. I'm wondering why they might prefer LoadFile to linking with ...
0
votes
2answers
291 views

Alternatives to ModSecurity for Postdata-filtering

I've found using ModSecurity cumbersome for logging/denying regex matches in postdata but I'm having trouble finding alternatives. I looked into various proxy solutions, but I can't seem to find any ...
0
votes
2answers
532 views

mod_security on an OWA front end

When using mod_security (installed from EPEL) with apache 2 on a centos box, sometimes users are unable to send messages - im having trouble tracing the rule back, the only place i get to is 'inbound ...
2
votes
1answer
1k views

Why Is ModSecurity Unable to Access the Data Directory?

Update I think we've solved this; the problem appears to have been a result of the /modsec_storage directory having an incorrect value for its SELinux context type. However, we're still not sure, ...
0
votes
2answers
1k views

Web Application Firewall: alternatives to mod_security

mod_security seems to be no longer on Debian repositories. The installation seems quite complicated. The only one I could find is Zorp, which seems even more complicated. Hence I'd like to ask for up ...