ModSecurity supplies an array of request and response filtering rules and other security features to the Apache HTTP Server. ModSecurity is an open source web application layer firewall.

learn more… | top users | synonyms

1
vote
0answers
327 views

Apache mod_security crs blocking PDF files

I've just installed CRS for Apache mod_security and it's reporting all PDF files as possible attacks. Specificaly, it's the modsecurity_crs_20_protocol_violations.conf that's causing the trouble ...
1
vote
1answer
182 views

mod_security to Inspect Post Variables

Can mod_security be used to inspect post variables? It looks like I can through turning SecRequestBodyAccess. I would like to check the username POST field from a form in wp-login.php. If it's value ...
1
vote
1answer
324 views

How to debug modsecurity_audit_log

I was accessing www.example.com/RestAPI/index.php/tweets.json in my server. The modsec_audit.log showed the following error, but there is no related errors/warnings in modsec_debug.log. I could see ...
0
votes
0answers
249 views

prevent phpbb bruteforcing with mod_security

Update: I edited this and added a fail2ban tag. Perhaps that might be another way to handle this issue. I'm running phpbb 3.0.13-PL1 and I would like to protect the login page from bruteforcing. I'm ...
1
vote
1answer
1k views

how to control apache mod-security for IP-address

I have mod security installed on my server. It is working for all IP addresses. Now I need to EXCLUDE specific IP addresses from applying this mod-security. How can I do so? Is there a way to control ...
1
vote
2answers
8k views

how I can know which version of mod security that I had on the server? and how I can update it? [closed]

I'm using cpanel (11.25 Stable 46156) with mod security installed. How can I know the version of mod security that installed in the server? How can I update mod security manually or make it update ...
5
votes
2answers
3k views

Why does modsecurity require Content-Length in POST requests?

I have a RESTful web service that accepts a POST request to a resource without an entity body, e.g. an empty POST request. The default modsecurity configuration requires that all POST requests have a ...
1
vote
2answers
281 views

ModSecurity Error Entries

Recently, I was passed some error logs to take a look into, since we'd had some network spikes recently. However, I've never worked with modsecurity (I'm a programmer just doing this since we don't ...
0
votes
1answer
5k views

Mod_security - Syntax error

I have a password protected directory on my web server. To protect that from brute force attack, I tried to add the IP-Based BLocking config as below in the apache2 config file. But everytime I ...
1
vote
1answer
287 views

What exactly does the ModSecurity SecCollectionTimeout directive?

I am having a little bit of trouble with a recurring "Failed deleting collection" error message from ModSecurity (see this discussion @ GitHub for some context). In the discussion of this error it is ...
0
votes
1answer
204 views

Modsecurity: Whitelist requests, Block all else?

I'm just reading up about - and experimenting with - modsecurity and hoping someone can educate a little about the method behind the madness. The approach I'd ordinarily take with any firewall is to ...
0
votes
1answer
562 views

whitelist URI on mod_security enabled apache reverse proxy

I have an apache 2.2.29-1.4 with mod_security 2.8.0-5.25 which is a reverse proxy with mod_proxy_http for a local java application. I have false positive on some urls and would like to whitelist some ...
15
votes
5answers
12k views

mod_security block requests by http-host header

The last few days I noticed some servers being hammered with unknown requests. Most of them are like the following: 60.246.*.* - - [03/Jan/2015:20:59:16 +0200] "GET /announce.php?info_hash=%80%85%8e%...
1
vote
3answers
931 views

How do I remove the ServerSignature added by mod_fcgid?

I'm running Mod_Security and I'm using the SecServerSignature to customize the Server header that Apache returns. This part works fine, however I'm also running mod_fcgid which appends "mod_fcgid/2.3....
2
votes
0answers
567 views

How to filter POST data with mod_security when type is text/xml?

I'm trying to craft a rule which would match certain regex in POST requests. Rule I have so far looks like; SecRule REQUEST_FILENAME "form.php" \ "id:'12345',chain,deny,status:406,log,msg:'foobar ...
3
votes
1answer
771 views

What do the audit log records for ModSecurity actually mean?

We have ModSecurity setup to log to modsec_audit.log for Apache2. Today we have had 2259 entries created in this log with a referrer of: Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/...
2
votes
1answer
904 views

How could I exclude mod_security from sub-directories on Amazon EC2 with LAMP?

I never activated before the mod_security or edit Virtual Hosts, so it's a new challenge for me, I tried to follow this tutorial but seems that most of the tutorials around the web are not reflecting ...
1
vote
2answers
881 views

mod_security never tells what the problem is

Normally I would just pester my provider to disable the rule. And while he certainly deserves pestering, I've done that way too often already for the low service price. (Like always this is about a ...
1
vote
2answers
494 views

PHP and Text Area Triggering Mod_Security

I have some text areas in a form that are posted back and stored using PHP / MySQL. However, if a user presses return for a new line in the text area, mod_security is blocking it with the below log ...
1
vote
1answer
254 views

mod_security RBL - apparent false positive

I'm struggling with an RBL rule in mod_security under apache 2.2 that seems to be giving me a false positive. I see the following in the audit log (IP address redacted): Message: RBL lookup of 4.3....
1
vote
2answers
468 views

What web application firewall do you use? What should I use? [closed]

What web application firewall do you use? I'm primarily interested in something I can deploy on the perimeter that can protect multiple Apache and IIS servers, but I'd like to hear all answers. Tell ...
3
votes
3answers
749 views

Block traffic behind AWS ELB

My web servers are behind ELB, I want to block traffic from some specific user agent which is a DDOS attack. Apache always see ip address of ELB as an end user so I tried below attempts: Blocking IP ...
0
votes
1answer
1k views

mod_security not blocking empty useragent requests

I can't get mod_security to block empty useragent requests. I am not very saavy with it so after searching I found this rule: SecMarker BEGIN_UA_CHECK SecRule &REQUEST_HEADERS:User-Agent "@eq 0" \...
0
votes
0answers
158 views

Server wont let me save URLs to MySQL database?

I am posting here because all other forum say it's a server environ issue. I have a site with the ModX CMS on it hosted on a GoDaddy server (not sure about the specific setup is as client has ...
1
vote
1answer
419 views

Proper SSL config for SSL - Apache2 ignores DocumentRoot

So here's my current config: <VirtualHost *:443> DocumentRoot "/var/www/keypad" ServerName keypad.io SSLOptions +StrictRequire <Directory /> SSLRequireSSL &...
0
votes
1answer
109 views

Fine-grained control over mod_security logging

I installed mod_security2 on several dozen servers (each with several dozen VHosts) and don't have the time to configure it for every VHost. In the default configuration, it produces copious amounts ...
1
vote
2answers
4k views

mod_security configuration issue: Error parsing actions: Unknown action: ver

I am trying to install / configure mod-sec using this tutorial, which uses the OWASP ModSecurity Core Rule Set. However when I go to restart apache, I get the following error: Syntax error on line 53 ...
0
votes
1answer
207 views

How i can block requests for a specific page?

I would like to completely delete or block access to a specific page in my site. More specifically, I have seen this exploit "Joomla COM_MEDIA Exploit" : http://all1gat0r.blogspot.gr/2013/08/joomla-...
0
votes
1answer
58 views

Mod Security2 deactivation rule only from a specified IP addresses

Is it possible to disable a rule by Mod Security2, only for one specified IP addresses? Only for one specified IP addresses & only for one specified path ( /administrator ) ? I tried this: <...
1
vote
1answer
291 views

Apache error_log filled with modsec blocks

Ever since I enabled Apache modsecurity I've been checking the logs and been seeing the following constantly like 24/7: [Wed Jun 25 12:40:07 2014] [error] [client 112.215.65.61] ModSecurity: Access ...
3
votes
2answers
2k views

modsecurity apache mod-security.conf missing [closed]

Greetings Serverfaultians. I'm not a server guy as you can see from my noob score of 1 point. But maybe those more versed can help me. I'm using Ubuntu v13.10 32-bit Server and Apache2 v2.4.6 and I'm ...
2
votes
0answers
255 views

Nginx and dynamic X-Forwarded-For blocklist

I am running Nginx behind a proxy. I am getting visitors' real IP addresses through X-Forwarded-For HTTP request header. I'd like to block individual IPs based on a dynamic block list, up to 10000+ ...
0
votes
1answer
824 views

apache2 reverse proxy broken after modsecurity is installed ubuntu on 12.04.1

this is the first time I have run into issue like this one. I have a java application setting behind a apache2 using mod_ajp on 8009. I have noticed that I could not get the client's IP so I have ...
0
votes
0answers
304 views

Nginx + mod_security without a backend server

I want to start using mod_security for Nginx. However, I have read the official doc and something got my atention: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#installation-for-...
1
vote
0answers
694 views

Curl Sourced DDoS: How to detect it & how to stop?

Okay, an Ubuntu server I manage fell victim to a DDoS attack today. Usually this is unpleasant but not that big a deal. A few high server load moments & then it passes. Today was clearly different....
0
votes
1answer
794 views

Apache/ModSecurity - Blocking HTML Textarea with 403 when it contains a linebreak (enter key)?

I have a contact form, within this contact form is a textarea. If i fill out the contact form and in the test area, i enter one line of text, e.g. Example The form completes and i am notified via ...
0
votes
0answers
305 views

Modsec: Set env variable based on User-agent

Relatively new to Apache modsec. Trying to do something simple and hitting a wall. I want to set an environment variable based on the User-Agent, and test it by setting a header. I have this: ...
2
votes
0answers
319 views

How to solve UNIQUE_ID variable issue in modsecurity_crs_16_session_hijacking.conf ubuntu 10.04

I have been trying to harden ubuntu 10.04 using modsecurity and its core rules from owasp version 2.2.5. I have used the package from their github . After the symbolic link of the files in the ...
4
votes
2answers
8k views

mod_security not actually blocking requests despite rule trigger & returning 403

I've pulled my finger out and installed mod_security to protect our WHMCS installation (a PHP based billing system) from some of the more obvious SQL injection attacks to try and minimise our ...
1
vote
1answer
304 views

Configuring mod_security on Ubuntu 10.04

After spending ~24 hours trying and failing to setup mod_security in Ubuntu 10.04 LTS, I've finally decided that I'm going to need some help. I've tried pretty much every tutorial I can find with a ...
2
votes
2answers
191 views

How to use Modsec rules to certain page?

i want to block proxy(x-forwarded) ip certain page(wp-comments-post.php) using Apache Mod_security. my current mod_security rule: SecRule REQUEST_HEADERS_NAMES "^x-forwarded-for" "log,deny,id:48,...
2
votes
1answer
3k views

how to whitelist a certain cookie string in ModSecurity

We are getting a lot of False Positives from using 3rd part software on our server. They themselves can't seem to fix it and I'm trying to work out how to allow cookies through that contain "...
1
vote
0answers
154 views

ModSecurity: What do MULTIPART_DATA_BEFORE and MULTIPART_DATA_AFTER mean?

I'm getting the following ModSecurity error when posting form data to a LiquidWeb server: Multipart request body failed strict validation: PE 0, BQ 0, BW 0, DB 1, DA 1, HF 0, LF 0, SM 0, IQ 0, IP 0, ...
-3
votes
1answer
74 views

how i configuration mod_security? [closed]

when i setup mod_security default configuration then if anyone go wordpress admin panel and change any code or some modified then his ip block. why? my all customer complain for this problem. how i ...
0
votes
1answer
137 views

How to block/ban clients that try to access some paths / urls?

Some spambots hammer my server with nonexisting paths like /user/pass?=asdfdasfas How could I block any access to /user/pass?=* ? Is there a better tool than iptables or csf for catching such crap?
4
votes
2answers
262 views

Why bother reverse proxying applications if you aren't using mod_security or TMG/UAG?

Common wisdom is that internal applications that live inside of the trusted network, such as Exchange, should be reverse proxies whenever they are exposed to the Internet. Microsoft recommends using ...
4
votes
2answers
13k views

How do I find out if mod_security is installed on my apache server?

How can I find out if mod_security is installed on my apache server? I would also like to learn its version. I'm having some upload issues and I tried to disable mod_security using .htaccess. But ...
1
vote
0answers
243 views

nginx with fail2ban and mod_security

I forgot to update my fail2ban config for nginx. I just moved to nginx from apache. Today, I got a lot of cals from a single IP. IP tried to access login pages with post and get methods IP tried to ...
1
vote
0answers
636 views

How do I handle apache2 modsecurity2 warnings like Match of “rx ^OPTIONS$” against “REQUEST_METHOD” required?

After upgrade from squeeze to wheezy I get loads of these messages in my apache errorlog when I open a webpage on myserver, (changed to myserver.de here): [Sat Oct 19 01:06:21 2013] [error] [client ...
1
vote
2answers
915 views

Blocking bad bots

I found this script and was wondering if this is just overkill and even worth using? Is it better for me to just use mod_security? # Generated using http://solidshellsecurity.com services # Begin ...