Questions tagged [mod-security]

ModSecurity supplies an array of request and response filtering rules and other security features to the Apache HTTP Server. ModSecurity is an open source web application layer firewall.

Filter by
Sorted by
Tagged with
0 votes
2 answers
2k views

Apache2 mod_security simple default deny rules for specific directory

How to configure the simplest useful default-deny rule set for mod_security? I want to configure mod_security to allow only very specific queries to single directory: In short: I use Apache as a ...
Hubert Kario's user avatar
  • 6,401
0 votes
2 answers
1k views

mod_security on an OWA front end

When using mod_security (installed from EPEL) with apache 2 on a centos box, sometimes users are unable to send messages - im having trouble tracing the rule back, the only place i get to is 'inbound ...
Devnull's user avatar
  • 951
0 votes
2 answers
3k views

Web Application Firewall: alternatives to mod_security

mod_security seems to be no longer on Debian repositories. The installation seems quite complicated. The only one I could find is Zorp, which seems even more complicated. Hence I'd like to ask for up ...
MrG's user avatar
  • 289
0 votes
2 answers
2k views

Disable mod_security on Dreamhost, for a single cgi script

I've searched around a lot, and tried various tweaks to .htaccess files to try to turn off mod_security for a particular cgi script (uber uploader) but it doesn't seem to have any effect. The most ...
Hippyjim's user avatar
  • 211
0 votes
2 answers
573 views

How to block IPs making requests to specific domain?

I have a server with CSF and ModSecurity enabled. I'd like to set up a rule or configuration that will automatically block (for a specified amount of time) any IP that makes incoming requests to a ...
inspirednz's user avatar
0 votes
1 answer
80 views

Which protections can I use on the server

I have read about server protection and I know how to work with fewalld protection because it is not demanding. My question is: Which of the following protections is best for the server and which of ...
Edgar's user avatar
  • 17
0 votes
1 answer
202 views

How to reduce Modsecurity disk IO

Modsecurity generates a lot of disk io operations, and the file www-data-ip.pag is read and written continuously. Is there any solution that can effectively reduce this? Could it be moved to RAM in ...
AndreaF's user avatar
  • 225
0 votes
1 answer
1k views

mod_security with OWASP CRS: Custom rule for whitelisting googlebot

I am about to use OWASP CRS rules with mod_security on my WHM/cPanel enabled CentOS server (with apache). But I fear that accidentally Googlebot may be blocked by one rule or the other. After enabling ...
Kannan's user avatar
  • 101
0 votes
1 answer
165 views

Is it okay to use core ruleset v3.3 on modsecurity v2.9

I am just a beginner in the field of security. I have installed ModSecurity v2.9 on my server using this link. But GitHub repository for the core rule set in the link was outdated, so later I removed ...
Praveen Kumar P S's user avatar
0 votes
2 answers
1k views

How do I restrict a specific client, based on their host name, with ModSecurity SecRule?

I am trying to restrict specific hosts (e.g. AWS) from accessing my webserver. I tried different variations of these but it doesn't work. # Block AWS SecRule REQUEST_HEADERS:Host ".*\.amazonaws\....
David's user avatar
  • 81
0 votes
1 answer
81 views

OWASP-CSR on ATS

I have some Apache Traffic Servers that use in CDN platform. Is it possible to configure OWASP-CSR on Apache Traffic Server? If yes, how can I implement it?
user avatar
0 votes
1 answer
1k views

Cannot find rule ID to whitelist an IP in ModSecurity

I have a local IP that was apparently banned. I would like to whitelist it. The subnet is already in my /etc/modsecurity/modsecurity.conf file: SecRule REMOTE_ADDR "@ipMatch 192.168.0.0/19" &...
DevOpsSauce's user avatar
0 votes
1 answer
45 views

My centOS 7 minimal font screwed up when trying to tail modsecurity audit log

My font display was completely normal. But right after i cat or tail /var/log/modsec_audit.log, my font becomes like this. Any solution? Image link: https://i.stack.imgur.com/XkIyj.png
newbie01's user avatar
0 votes
1 answer
706 views

Can mod_security be configured to create log only?

I've installed mod_security on openSUSE and want to make it log only. I want absolutely no blocking or filtering of any kind. I've created a config file as: SecAuditEngine On SecAuditLog /siteA/...
Rocket's user avatar
  • 103
0 votes
1 answer
316 views

ModSecurity dependency not found?

1. yum groupinstall 'Development tools' 2. yum install -y geoip-devel libcurl-devel libxml2-devel libxslt-devel libgb-devel lmdb-devel openssl-devel pcre-devel perl-ExtUtils-Embed yajl-devel zlib-...
Isaac's user avatar
  • 115
0 votes
1 answer
2k views

mod_security X-Forwarded-For not being blocked

I made some changes to my config as per this suggestion: SecAction \ "id:901321,\ phase:1,\ pass,\ t:none,\ nolog,\ initcol:global=global,\ initcol:ip=%{x-forwarded-for}_%{...
Yes Barry's user avatar
  • 180
0 votes
2 answers
165 views

Can Modsecurity detect and block infected client computers that connect to a server?

I have the latest version of Modsecurity (as of March 25th 2019) installed on my server. I am using OWASP rulesets along with fail2ban on Linux. I know it is designed to block hacking attempts. ...
User6655's user avatar
0 votes
1 answer
3k views

Updating ModSecurity when using OWASP rule sets

I am somewhat new to Modsecurity and still have a long way to go so bear with me. Ubuntu 18.04 I'm currently running Modsecurity 2.9.2-1 and OWASP rules 3.0.2 I would like to update the rules to ...
User6655's user avatar
0 votes
1 answer
1k views

Mod security syntax error

when i ran the command apache2ctl configtest it is showing this error AH00526: Syntax error on line 193 of /etc/modsecurity/modsecurity.conf: ModSecurity: Failed to open the audit log file: /var/log/...
Sony's user avatar
  • 103
0 votes
1 answer
437 views

SPOE and modsecurity contrib Failed to decode HELLO frame

I'm compile modsec as described in the instructions contib/modsec/README, but have the next errors: # /usr/local/bin/modsecurity -n 4 -d -f /etc/haproxy/waf/modsecurity.conf 1534409877.286475 [00] ...
Pavel Loginov's user avatar
0 votes
1 answer
2k views

Mod_security exclusion not fully working, still blocking CSS and images

I have put either of the following in my rules: SecRule REQUEST_URI "@beginsWith /directory" "phase:1,id:12345,allow" SecRule REQUEST_URI "@beginsWith /directory" "phase:1,id:12345,ctl:ruleEngine=off"...
user3080539's user avatar
0 votes
1 answer
953 views

Mod security exceptions not working

I would like to exclude a directory from mod security. I have tried everything under the sun in every config file to no avail. I have put stuff in the vhost file, the crs-setup file, the modsecurity....
user3080539's user avatar
0 votes
1 answer
2k views

Apache LocationMatch not matching

I'm trying to set up request throttling for certain sensitive URIs in an apache (v2.2) virtualhost with mod_security, but finding trouble with the use of LocationMatch. So far the configuration is as ...
André Fernandes's user avatar
0 votes
1 answer
1k views

How to disable a specific mod_security rule in a specific directory?

I want to disable this rule: [file "/usr/share/modsecurity-crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "159"] [id "981173"] [rev "2"] [msg "Restricted SQL Character ...
romanturbo's user avatar
0 votes
1 answer
960 views

Modsecurity SecRuleUpdateTargetById not working

I'm trying to modify owasp crs 3.0 rule number 920440: [id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity ...
Multihomed's user avatar
0 votes
1 answer
1k views

Modsecurity cookie match [closed]

I run a small webhosting service (CPanel + ModSecurity) and I personnaly host few laravel projects on it. I noticed that when I (or anyone) visit multiple pages quickly (one after the other), at some ...
Max13's user avatar
  • 141
0 votes
1 answer
466 views

Testing new ModSecurity rules in production - only some rules to DetectionOnly

I'm in the process of modifying an existing ModSecurity ruleset and I'm wondering how I should handle the process of adding new, (mainly) untested rules to production systems. At the moment, we do ...
Michael Helwig's user avatar
0 votes
1 answer
3k views

Whitelist for IP range on ModSecurity 2.9 & Apache 2.4.3

I'm try to add Google Ip range on white list for Mod Security I use Cpanel+Apache 2.4+ModSecurity 2.9.0+OWASP Rules On several post i se this conf SecRule REMOTE_ADDR "@ipMatch XX.XX.XX.XX,66.249....
abkrim's user avatar
  • 416
0 votes
1 answer
579 views

Mod_Security on 2 CentOS 7-servers. Different log-format

I installed mod_security on 2 CentOS 7-servers. Bot got this config: SecAuditEngine RelevantOnly SecAuditLogRelevantStatus "^(?:5|4(?!04))" SecAuditLogParts ABIFHZ SecAuditLogType Concurrent ...
MyFault's user avatar
  • 913
0 votes
1 answer
860 views

Modsecurity redirect rule : Send threatening user back to referrer

Consider the following SecRule, which takes a feed from a lua script that is executed: SecRule &TX:SQLI "@eq 1" "id:'129793',phase:2,t:none,redirect:http://www.example.com/failed.html,msg:'...
Futh's user avatar
  • 17
0 votes
1 answer
2k views

Blocking a request with ModSecurity and lua script

I have web traffic flowing through ModSecurity. Within the ModSecurity configuration I am calling a Lua script that is running some simple analysis on the arguments of request string. Specifically, ...
Futh's user avatar
  • 17
0 votes
1 answer
3k views

Modsecurity check REQUEST_URI without query parameters

Currently, I am using Modsecurity XSS prevention, but I'm having a hard time understanding how exactly I can restrict what I'm checking for in the REQUEST_URI variable. My Example: # # -=[ XSS ...
Derek Pollard's user avatar
0 votes
1 answer
504 views

modsecurity Does not contain custom REDQUEST_HEADER_NAMES

Trying to build a rule that will 403 any incoming traffic that doesn't contain the header X-CFKey and match a specific of X-CFKey. I've got modsecurity testing X-CFKey value successfully but fails ...
Alex Turner's user avatar
0 votes
1 answer
1k views

mod_security: What's the point of action auditlog?

I'm fiddling around with mod_security to log POST request payloads for a specific URI. As stated in this response https://serverfault.com/a/729079/292993 to a similar question mod_security's ...
ahaertig's user avatar
0 votes
1 answer
497 views

security2_module for apache with owsap modsecurity crs base rules is causing the “Forbidden You don't have permission to access / on this server”

I installed the security2 module to my apache server with owasp mod security base rules by adding these following lines to my httpd.conf: <IfModule security2_module> Include crs/owasp-...
sorin's user avatar
  • 101
0 votes
1 answer
3k views

mod_security behind reverse proxy and clients IP

client -> haproxy -> mod_security boxes -> backends Problem: mod_security boxes use mod_rpaf with ip of haproxy in 'RPAFproxy_ips'. Apache logging shows clients real ip but mod_security ...
3molo's user avatar
  • 4,350
0 votes
1 answer
2k views

Syntax error on line 23 of /etc/httpd/conf.d/modsecurity.conf [duplicate]

I'm try install and configure Mod_Security on Amazon EC2 Linux 64 bits, but one error happens Syntax error on line 23 of /etc/httpd/conf.d/modsecurity.conf: ModSecurity: Found another rule with the ...
Tiago Souza's user avatar
0 votes
1 answer
3k views

mod-security not blocking POST request

I have a mod-security compiled from source and installed on Ubuntu Server 12.04, Apache 2.2.22. I loaded the OWASP core rule set, and I can see them getting triggered on the log file /var/log/apache2/...
vincentleest's user avatar
0 votes
1 answer
601 views

How i can block requests for a specific page?

I would like to completely delete or block access to a specific page in my site. More specifically, I have seen this exploit "Joomla COM_MEDIA Exploit" : http://all1gat0r.blogspot.gr/2013/08/joomla-...
Shake-the-World's user avatar
0 votes
1 answer
2k views

apache2 reverse proxy broken after modsecurity is installed ubuntu on 12.04.1

this is the first time I have run into issue like this one. I have a java application setting behind a apache2 using mod_ajp on 8009. I have noticed that I could not get the client's IP so I have ...
black sensei's user avatar
0 votes
1 answer
141 views

Find excluded keywords for $_POST/$_GET content with ModSecurity? [closed]

Our client has ModSecurity 2.0 with Rule Set 2.0.5 but he told us that minor detail at the end of the development. I need to audit all the application code and make sure it does not interfere with ...
Tristan's user avatar
  • 498
0 votes
2 answers
2k views

How to prevent from uploading shell

What is the best way to prevent from uploading c99shell,r57shell and another php sheller? i want when an attacker upload a shell the sheller don't show for him. I use mod_security ver 1.x Thanks in ...
alysa's user avatar
  • 11
0 votes
1 answer
195 views

Side effects of using owasp mod_sec rules [closed]

I was looking at all the owasp rules for mod_security. How badly does it slow your loading time down if you use them all? What would be the recommended packages to use? I want to mostly block bad UA, ...
Thompson Smith's user avatar
0 votes
1 answer
1k views

Mod_security questions and on User-Agent types

Very new to mod_sec I want to block a UA string and I noticed there are a few types: SecRule HTTP_User-Agent SecRule REQUEST_HEADERS:User-Agent What is the real difference between them? My block: ...
Tiffany Walker's user avatar
0 votes
1 answer
749 views

Mod Security log monitoring

Is there a web based log management utility present for Mod Security? As parsing the logs of Mod Security is a big headache. I can only see traditional log monitoring systems but not any, which is ...
Farhan's user avatar
  • 4,309
0 votes
1 answer
553 views

sources.list entry for mod_security testing release?

I have a debian "squeeze" installation, but the mod_security delivered with this release is quite old. So I'm thinking of adding an additional line to my sources.list to get the "wheezy" version (...
powtac's user avatar
  • 639
0 votes
2 answers
717 views

How to secure Cpanel/WHM from malacious uploads [duplicate]

Recently my site's index.php file was replaced with some malicious javascript code. I really don't know how it was added to the page. Today when I tried to download the file via FTP, my local anti-...
user avatar
0 votes
1 answer
858 views

How can I have APF block script kiddies that mod_security detects?

In one of the vhosts' error_log I found thousands of lines like these, all from the same IP: [Mon Apr 19 08:15:59 2010] [error] [client 61.147.67.206] mod_security: Access denied with code 403. ...
Gaia's user avatar
  • 1,895
0 votes
1 answer
213 views

mod_security and apt-get

hi can anyone help me with mod_security configuration... I have installed mod_security on ubuntu 9.04 lamp server,... but now I want to install anything and type apt-get install program, it keeps ...
user avatar
0 votes
2 answers
1k views

How to detect brute force in mod-security

I checked the core rules set in the mod-security but it's didn't contain the rules related to Brute-Force Attack!!! Did anyone know how to write the rules or the existing rules for this kind of Attack!...
Wingless-Archangel's user avatar

1
3 4
5
6 7