ModSecurity supplies an array of request filtering and other security features to the Apache HTTP Server. ModSecurity is a web application layer firewall.

learn more… | top users | synonyms

3
votes
2answers
6k views

mod_unique_id: unable to find IPv4 address of FQDN despite setting etc/hosts and Apache ServerName

I'm trying to get mod_security and hit the very common hostname error of [alert] (EAI 2)Name or service not known: mod_unique_id: unable to find IPv4 address of "computername.domain.com" This ...
0
votes
1answer
785 views

HAProxy health check is logged as TCP_MISS/000 in Squid

We have a HAProxy front-end, load balancing a layer of Squid servers, which handles data from an Apache ModSecurity layer, and which ultimately serves up data from IIS cluster. Each Squid server is ...
3
votes
1answer
414 views

Looking for a good web penetration testing client

I'm implementing mod_security on an apache server. In order to test the effectiveness of the protection, I am looking for a client that can generate a set of predefined malicious HTTP requests. I will ...
2
votes
2answers
888 views

what is the impact of increasing the SecResponseBodyLimit from default value (512k) to (5M)?

I installed the mod_security version 2.5.13 with apache2 and I'm facing problem with SecResponseBodyLimit: ( ModSecurity: Output filter: Response body too large (over limit of 524288, total not ...
1
vote
2answers
1k views

How do I enable mod_security in Ubuntu 10.04?

A quick run through of what I've done: apt-get install libapache-mod-security a2enmod mod-security create /etc/apache2/mod_security_rules/ with base_rules and optional_rules from the latest core ...
1
vote
1answer
641 views

mod_security never tells what the problem is

Normally I would just pester my provider to disable the rule. And while he certainly deserves pestering, I've done that way too often already for the low service price. (Like always this is about a ...
1
vote
2answers
291 views

Where does Ubuntu 10.04 store the configuration file of mod-security?

I've installed libapache-mod-security on Ubuntu 10.04. The only configuration file I've been able to find is this one: cat /var/lib/dpkg/info/libapache-mod-security.conffiles ...
1
vote
2answers
730 views

mod_security IP collection key not being set correctly

I'm using an IP collection in a load balanced setup, I therefor want mod_security to act on the x-forwarded for header instead of the REMOTE_ADDR. Here is my rule: SecAction ...
0
votes
2answers
4k views

Why doesn't my mod_security catch / log anything?

I installed mod_security on my Ubuntu GNU/Linux server but when I send some simple requests to the web server that should match even the simplest rules, I fail to see any alerts or any log files that ...
0
votes
1answer
521 views

What is this mod_security rule trying to prevent?

Today my IP was blocked by my server. I was told it was because of a mod_security rule that got triggered. I'm told that the regex that got triggered was ^((?:(?:POS|GE)T|OPTIONS|HEAD)) I don't ...
1
vote
1answer
405 views

What web application firewall do you use? What should I use?

What web application firewall do you use? I'm primarily interested in something I can deploy on the perimeter that can protect multiple Apache and IIS servers, but I'd like to hear all answers. Tell ...
2
votes
1answer
530 views

why use apache's LoadFile?

Installing mod_security, the instructions direct us to add: LoadFile /usr/lib/libxml2.so LoadFile /usr/lib/liblua5.1.so to httpd.conf. I'm wondering why they might prefer LoadFile to linking with ...
0
votes
2answers
345 views

Alternatives to ModSecurity for Postdata-filtering

I've found using ModSecurity cumbersome for logging/denying regex matches in postdata but I'm having trouble finding alternatives. I looked into various proxy solutions, but I can't seem to find any ...
0
votes
2answers
581 views

mod_security on an OWA front end

When using mod_security (installed from EPEL) with apache 2 on a centos box, sometimes users are unable to send messages - im having trouble tracing the rule back, the only place i get to is 'inbound ...
2
votes
1answer
2k views

Why Is ModSecurity Unable to Access the Data Directory?

Update I think we've solved this; the problem appears to have been a result of the /modsec_storage directory having an incorrect value for its SELinux context type. However, we're still not sure, ...
0
votes
2answers
1k views

Web Application Firewall: alternatives to mod_security

mod_security seems to be no longer on Debian repositories. The installation seems quite complicated. The only one I could find is Zorp, which seems even more complicated. Hence I'd like to ask for up ...
1
vote
3answers
2k views

modsecurity inbound_anomaly_score

I get this error from web server - is this known issue. There is plenty of questions on google -- but not clear solution. [error] [client ] ModSecurity: Warning. Operator LT matched 20 at ...
1
vote
3answers
779 views

How do I remove the ServerSignature added by mod_fcgid?

I'm running Mod_Security and I'm using the SecServerSignature to customize the Server header that Apache returns. This part works fine, however I'm also running mod_fcgid which appends ...
2
votes
1answer
645 views

Do I really need mod_security?

I'm doing a clean install of my server and I'm looking for some advice on whether or not I actually need the Apache mod_security module. I consider myself to be a bit security paranoid when it comes ...
1
vote
1answer
161 views

Simple, current how-to install mod-security on cPanel server?

Does anyone have or know of a simple, up to date how to for installing mod-security on cPanel and configuring it after install? Every how to on the web I've found is at least two years old and is ...
0
votes
2answers
477 views

How to secure Cpanel/WHM from malacious uploads [duplicate]

Recently my site's index.php file was replaced with some malicious javascript code. I really don't know how it was added to the page. Today when I tried to download the file via FTP, my local ...
0
votes
1answer
2k views

What is the difference between an Audit Log and a regular Log (In the context of mod_security)?

I am using mod_security What is the difference between and audit log (audit trail) and a normal log? I read on wikipedia that an audit log is a log of user activity, if this is the case what would ...
0
votes
2answers
985 views

Disable mod_security on Dreamhost, for a single cgi script

I've searched around a lot, and tried various tweaks to .htaccess files to try to turn off mod_security for a particular cgi script (uber uploader) but it doesn't seem to have any effect. The most ...
1
vote
1answer
2k views

How to disable mod_security2 rule (false positive) for one domain on centos 5

Hi I have mod_security enabled on a centos5 server and one of the rules is keeping a user from posting some text on a form. The text is legitimate but it has the words 'create' and an html ...
0
votes
1answer
616 views

How can I have APF block script kiddies that mod_security detects?

In one of the vhosts' error_log I found thousands of lines like these, all from the same IP: [Mon Apr 19 08:15:59 2010] [error] [client 61.147.67.206] mod_security: Access denied with code 403. ...
5
votes
2answers
326 views

Good free guide for mod_security?

I have looked at the official sites documentation, and it is a little tough to find starting points. Is there a free comprehensive guide that is easy to understand for someone that has never dealt ...
1
vote
2answers
2k views

Necesity of ModSecurity if Apache is behind Nginx

I have my Apache installed behind Nginx. So every request that comes in is first handeled by Nginx. If there is dynamic content needed the request is send to Apache which listens on port 8080. Pretty ...
4
votes
2answers
9k views

How do I find out if mod_security is installed on my apache server?

How can I find out if mod_security is installed on my apache server? I would also like to learn its version. I'm having some upload issues and I tried to disable mod_security using .htaccess. But ...
0
votes
1answer
209 views

mod_security and apt-get

hi can anyone help me with mod_security configuration... I have installed mod_security on ubuntu 9.04 lamp server,... but now I want to install anything and type apt-get install program, it keeps ...
0
votes
2answers
3k views

Just added mod_security… want to whitelist a series of sub directories

I am running a host and just updated mod_security. It "broke" a CMS in multiple sites. I want to white list all sub-directories named CMS. How do I specify a rule to do that?
0
votes
2answers
718 views

How to detect brute force in mod-security

I checked the core rules set in the mod-security but it's didn't contain the rules related to Brute-Force Attack!!! Did anyone know how to write the rules or the existing rules for this kind of ...