ModSecurity supplies an array of request and response filtering rules and other security features to the Apache HTTP Server. ModSecurity is an open source web application layer firewall.

learn more… | top users | synonyms

1
vote
0answers
101 views

ModSecurity: What do MULTIPART_DATA_BEFORE and MULTIPART_DATA_AFTER mean?

I'm getting the following ModSecurity error when posting form data to a LiquidWeb server: Multipart request body failed strict validation: PE 0, BQ 0, BW 0, DB 1, DA 1, HF 0, LF 0, SM 0, IQ 0, IP 0, ...
-3
votes
1answer
68 views

how i configuration mod_security? [closed]

when i setup mod_security default configuration then if anyone go wordpress admin panel and change any code or some modified then his ip block. why? my all customer complain for this problem. how i ...
0
votes
1answer
104 views

How to block/ban clients that try to access some paths / urls?

Some spambots hammer my server with nonexisting paths like /user/pass?=asdfdasfas How could I block any access to /user/pass?=* ? Is there a better tool than iptables or csf for catching such crap?
4
votes
2answers
204 views

Why bother reverse proxying applications if you aren't using mod_security or TMG/UAG?

Common wisdom is that internal applications that live inside of the trusted network, such as Exchange, should be reverse proxies whenever they are exposed to the Internet. Microsoft recommends using ...
4
votes
2answers
11k views

How do I find out if mod_security is installed on my apache server?

How can I find out if mod_security is installed on my apache server? I would also like to learn its version. I'm having some upload issues and I tried to disable mod_security using .htaccess. But ...
1
vote
0answers
188 views

nginx with fail2ban and mod_security

I forgot to update my fail2ban config for nginx. I just moved to nginx from apache. Today, I got a lot of cals from a single IP. IP tried to access login pages with post and get methods IP tried to ...
1
vote
0answers
435 views

How do I handle apache2 modsecurity2 warnings like Match of “rx ^OPTIONS$” against “REQUEST_METHOD” required?

After upgrade from squeeze to wheezy I get loads of these messages in my apache errorlog when I open a webpage on myserver, (changed to myserver.de here): [Sat Oct 19 01:06:21 2013] [error] [client ...
1
vote
2answers
633 views

Blocking bad bots

I found this script and was wondering if this is just overkill and even worth using? Is it better for me to just use mod_security? # Generated using http://solidshellsecurity.com services # Begin ...
1
vote
0answers
869 views

ModSecurity: collections_remove_stale: Failed deleting collection

Environment: Ubuntu Server 12.04 64Bit with Apache/2.2.22 (Ubuntu) and Worker mpm with modsecurity 2.7.5 and OWASP CRS latest. Problem: When server is under a load of 1500 concurrent users ...
0
votes
1answer
49 views

Find excluded keywords for $_POST/$_GET content with ModSecurity? [closed]

Our client has ModSecurity 2.0 with Rule Set 2.0.5 but he told us that minor detail at the end of the development. I need to audit all the application code and make sure it does not interfere with ...
1
vote
0answers
208 views

apache DirectoryMatch matching filenames

I have the following code in my security.conf file of apache <DirectoryMatch "/(albums|attachment(s)?|upload(s)?)"> Options -ExecCGI <IfModule php5_module> php_flag engine off ...
-1
votes
1answer
325 views

You don't have permission to access /on this server

I created a form in joomla with 2000 fields but when I submit the form it gives me: error-- You don't have permission to access /en/soccer-player-update on this server. Additionally, a 404 Not Found ...
0
votes
2answers
2k views

ModSecurity compile error on nginx

I'm trying to install ModSecurity on nginx with the following instructions : wget https://github.com/SpiderLabs/ModSecurity/archive/master.zip unzip master cd ModSecurity-master ./autogen.sh ...
-1
votes
2answers
565 views

How to prevent from uploading shell

What is the best way to prevent from uploading c99shell,r57shell and another php sheller? i want when an attacker upload a shell the sheller don't show for him. I use mod_security ver 1.x Thanks in ...
0
votes
1answer
93 views

Proxying while preserving URI with mod_security2

I'm using a proxy: action in mod_security2. I'd like to preserve the full URL of the original request, however, and it seems to be rewriting that to the url in my proxy: action. So a request to ...
0
votes
1answer
622 views

Apache 2.2.4: problems chroot with modsecurity

I've been installed mod_security. If i simply include in the httpd the configuration files of mod_security, it starts normally. Indeed, if i try to add SecChrootDir /mnt/chr , httpd will start, but at ...
1
vote
1answer
740 views

Mod_security2 and clamav to catch malicious files on upload

Is there a clear documentation to describe the solution? It's very common and also necessary.
1
vote
0answers
549 views

short Apache outages (VPS, ModSecurity)

I have a problem with my site recently hosted at Liquidweb, none of their techs seems to be able to solve this issue even after days. Was hoping I could get some help here. Occasionally, my site's ...
2
votes
1answer
3k views

Why Is ModSecurity Unable to Access the Data Directory?

Update I think we've solved this; the problem appears to have been a result of the /modsec_storage directory having an incorrect value for its SELinux context type. However, we're still not sure, ...
0
votes
1answer
479 views

Apache vhost-specific logging

I have the following apache setting (in conf.d/owasp-modsecurity.conf): SecAuditLog "/var/www/vhosts/${lowercase:%{SERVER_NAME}}/statistics/logs/modsec_audit.log" When I do httpd -t I get the ...
1
vote
1answer
780 views

Limit mod_security rule to one vhost only

I run several domains (via vhosts) with the same apache installation. Some domains require different mod_security rules than the others. In a seperate exceptions.conf file I collect all those rules ...
1
vote
0answers
203 views

log/dump response body

Is there any way to log response body in Apache 2? I need the exact content that will be sent to user browser. I tried mod_security audit logging, but it won't log response body for all requests. ...
3
votes
1answer
2k views

Enable Mod_Security for only one website

Is there a way to dis-able mod-security for all websites? except one? i have more than 500 websites hosted, only want to turn it on for one website, which is having attacks on it.
1
vote
1answer
644 views

Dropping incoming requests for a specific file with iptables

Server is a standard LAMP stack configured via cpanel on CentOS 5.9. We have one file, call it bad.php, on one of our domains that is mistakenly being accessed about 10 times a second by a service ...
1
vote
3answers
3k views

modsecurity inbound_anomaly_score

I get this error from web server - is this known issue. There is plenty of questions on google -- but not clear solution. [error] [client ] ModSecurity: Warning. Operator LT matched 20 at ...
0
votes
1answer
3k views

What is the difference between an Audit Log and a regular Log (In the context of mod_security)?

I am using mod_security What is the difference between and audit log (audit trail) and a normal log? I read on wikipedia that an audit log is a log of user activity, if this is the case what would ...
-1
votes
1answer
65 views

hosting provider web server blocks certain url string by using mod security [closed]

I have a blog which has a post with the following as url /blog/insert-into-tablea-select-fields-from-tableb-for-specific-values-only/ This was working well until recently. I got a different ...
1
vote
2answers
2k views

How do I enable mod_security in Ubuntu 10.04?

A quick run through of what I've done: apt-get install libapache-mod-security a2enmod mod-security create /etc/apache2/mod_security_rules/ with base_rules and optional_rules from the latest core ...
2
votes
0answers
76 views

.htaccess ignored two layers deep on only some hosting plans [closed]

I have one .htaccess file doing this: RewriteRule ^system(.*)$ /system/app/$1 [QSA,L] ...and then underneath /system/app, I have another .htaccess file doing this: RewriteCond %{REQUEST_FILENAME} ...
0
votes
1answer
840 views

installing mod_security causing apache service start to fail

I installed mod security using this tutorial http://www.linuxmaza.... . After installing I got the error described and followed the steps to solve it. The only thing I did differently was updating ...
7
votes
1answer
3k views

What are PCRE limits?

In ModSecurity there are PCRE limits exceeded errors. I know I can fix this by setting rules such as: SecPcreMatchLimit 150000 SecPcreMatchLimitRecursion 150000 But, what are these rules actually ...
0
votes
1answer
163 views

Side effects of using owasp mod_sec rules [closed]

I was looking at all the owasp rules for mod_security. How badly does it slow your loading time down if you use them all? What would be the recommended packages to use? I want to mostly block bad UA, ...
0
votes
1answer
433 views

Mod_security questions and on User-Agent types

Very new to mod_sec I want to block a UA string and I noticed there are a few types: SecRule HTTP_User-Agent SecRule REQUEST_HEADERS:User-Agent What is the real difference between them? My block: ...
0
votes
1answer
101 views

Installing mod_security [closed]

I have apache and suphp running. How hard is it to install modsecurity? Also, where can I find some light weight/generic rule-sets to not bog apache down?
3
votes
2answers
337 views

Mod_security Logging

Im trying to run mod_security as standalone service with nginx as reverse proxy everything works fine except logging. Mod_security logs reverse proxys ip addres instead of clients ip address. I would ...
1
vote
1answer
263 views

mod_security: track user to check if redirected to login failed page

I have to log when a user fails to log in to a web application. Unfortunately, this web application is not able to do this out of the box and I can not change it. Now I'm experimenting with ...
0
votes
2answers
518 views

How to secure Cpanel/WHM from malacious uploads [duplicate]

Recently my site's index.php file was replaced with some malicious javascript code. I really don't know how it was added to the page. Today when I tried to download the file via FTP, my local ...
0
votes
1answer
647 views

ModSecurity not enabled

I have similar problem like question How do I enable mod_security in Ubuntu 10.04? , but i do not have the "minimal" file with me which i can replace and make it work. My configuration is also ...
3
votes
1answer
74 views

Modifying Apache configuration via a Web Interface

I would like to create a website on my server, which runs Apache2, to allow a user to fill in a form containing a desired subdomain name to be created on the server. For example, a user could go to ...
1
vote
3answers
2k views

How to drop all requests using mod_security

I have an apache2 server with several sites enabled on it, including the default one (000default). The default server is catching lots of spammy requests that are doing nothing but consume bandwidth ...
2
votes
0answers
167 views

Custom collections with mod_security

I would like to create a mod_security collection that is based on something other than the user's IP, Session ID, or username. Specifically, based on the REQUEST_URI. However, mod_security indicates ...
0
votes
1answer
987 views

Broken URLs after enabling mod_security

For example this pdf stopped working after enabling the mod, it generates 403 error. [Wed May 30 18:47:19 2012] [error] [client xxxxxxxxxxx] ModSecurity: Warning. Match of "within ...
0
votes
1answer
327 views

apt-get update Error

I get the following error when typing: # apt-get update W: Failed to fetch http://etc.inittab.org/~agi/debian/libapache-mod-security2/etch/Packages 404 Not Found [IP: 80.28.139.208 80] E: Some ...
0
votes
1answer
351 views

Mod Security log monitoring

Is there a web based log management utility present for Mod Security? As parsing the logs of Mod Security is a big headache. I can only see traditional log monitoring systems but not any, which is ...
1
vote
2answers
1k views

mod_security IP collection key not being set correctly

I'm using an IP collection in a load balanced setup, I therefor want mod_security to act on the x-forwarded for header instead of the REMOTE_ADDR. Here is my rule: SecAction ...
2
votes
1answer
2k views

Where I can find ModSecurity Rules for Specific Applications

Where I can find ModSecurity Rules for Specific Applications specially joomla, wordpress, mambo ?
-3
votes
1answer
386 views

mod_security: How to allow ssh/http access for admin?

I am going to be installing mod_security on my AWS EC2 Linux instance tonight and need a little help/reassurance. The only thing I am truly worried about right now is making sure my (admin) access to ...
1
vote
2answers
1k views

error: libxml2 is required (modsecurity)

I am trying to install mod_security from source. when i run ./configure I get this error: configure: error: libxml2 is required After that error, I executed this command: yum install libxml2 It ...
10
votes
2answers
9k views

mod_security - PCRE limits exceeded

Just about on every request I am getting the following error: Rule execution error - PCRE limits exceeded (-8): (null). After a bunch of googling the only solutions seem to be a) Add the following ...
-1
votes
1answer
153 views

gotroot mod_security rules

Are the gotroot mod_security rules any good? I've heard that you will get a lot of false positives and before I try and use them on a live box just wanted to know if anyone else has experience with ...