Questions tagged [mod-security]
ModSecurity supplies an array of request and response filtering rules and other security features to the Apache HTTP Server. ModSecurity is an open source web application layer firewall.
344
questions
0
votes
2
answers
2k
views
Apache2 mod_security simple default deny rules for specific directory
How to configure the simplest useful default-deny rule set for mod_security?
I want to configure mod_security to allow only very specific queries to single directory:
In short: I use Apache as a ...
0
votes
2
answers
1k
views
mod_security on an OWA front end
When using mod_security (installed from EPEL) with apache 2 on a centos box, sometimes users are unable to send messages - im having trouble tracing the rule back, the only place i get to is 'inbound ...
0
votes
2
answers
3k
views
Web Application Firewall: alternatives to mod_security
mod_security seems to be no longer on Debian repositories. The installation seems quite complicated. The only one I could find is Zorp, which seems even more complicated.
Hence I'd like to ask for up ...
0
votes
2
answers
2k
views
Disable mod_security on Dreamhost, for a single cgi script
I've searched around a lot, and tried various tweaks to .htaccess files to try to turn off mod_security for a particular cgi script (uber uploader) but it doesn't seem to have any effect.
The most ...
0
votes
2
answers
573
views
How to block IPs making requests to specific domain?
I have a server with CSF and ModSecurity enabled.
I'd like to set up a rule or configuration that will automatically block (for a specified amount of time) any IP that makes incoming requests to a ...
0
votes
1
answer
80
views
Which protections can I use on the server
I have read about server protection and I know how to work with fewalld protection because it is not demanding.
My question is:
Which of the following protections is best for the server and which of ...
0
votes
1
answer
202
views
How to reduce Modsecurity disk IO
Modsecurity generates a lot of disk io operations, and the file www-data-ip.pag is read and written continuously.
Is there any solution that can effectively reduce this? Could it be moved to RAM in ...
0
votes
1
answer
1k
views
mod_security with OWASP CRS: Custom rule for whitelisting googlebot
I am about to use OWASP CRS rules with mod_security on my WHM/cPanel enabled CentOS server (with apache). But I fear that accidentally Googlebot may be blocked by one rule or the other. After enabling ...
0
votes
1
answer
165
views
Is it okay to use core ruleset v3.3 on modsecurity v2.9
I am just a beginner in the field of security. I have installed ModSecurity v2.9 on my server using this link. But GitHub repository for the core rule set in the link was outdated, so later I removed ...
0
votes
2
answers
1k
views
How do I restrict a specific client, based on their host name, with ModSecurity SecRule?
I am trying to restrict specific hosts (e.g. AWS) from accessing my webserver. I tried different variations of these but it doesn't work.
# Block AWS
SecRule REQUEST_HEADERS:Host ".*\.amazonaws\....
0
votes
1
answer
81
views
OWASP-CSR on ATS
I have some Apache Traffic Servers that use in CDN platform. Is it possible to configure OWASP-CSR on Apache Traffic Server? If yes, how can I implement it?
0
votes
1
answer
1k
views
Cannot find rule ID to whitelist an IP in ModSecurity
I have a local IP that was apparently banned. I would like to whitelist it. The subnet is already in my /etc/modsecurity/modsecurity.conf file:
SecRule REMOTE_ADDR "@ipMatch 192.168.0.0/19" &...
0
votes
1
answer
45
views
My centOS 7 minimal font screwed up when trying to tail modsecurity audit log
My font display was completely normal. But right after i cat or tail /var/log/modsec_audit.log, my font becomes like this. Any solution?
Image link:
https://i.stack.imgur.com/XkIyj.png
0
votes
1
answer
706
views
Can mod_security be configured to create log only?
I've installed mod_security on openSUSE and want to make it log only.
I want absolutely no blocking or filtering of any kind.
I've created a config file as:
SecAuditEngine On
SecAuditLog /siteA/...
0
votes
1
answer
316
views
ModSecurity dependency not found?
1. yum groupinstall 'Development tools'
2. yum install -y geoip-devel libcurl-devel libxml2-devel libxslt-devel libgb-devel lmdb-devel openssl-devel pcre-devel perl-ExtUtils-Embed yajl-devel zlib-...
0
votes
1
answer
2k
views
mod_security X-Forwarded-For not being blocked
I made some changes to my config as per this suggestion:
SecAction \
"id:901321,\
phase:1,\
pass,\
t:none,\
nolog,\
initcol:global=global,\
initcol:ip=%{x-forwarded-for}_%{...
0
votes
2
answers
165
views
Can Modsecurity detect and block infected client computers that connect to a server?
I have the latest version of Modsecurity (as of March 25th 2019) installed on my server. I am using OWASP rulesets along with fail2ban on Linux.
I know it is designed to block hacking attempts. ...
0
votes
1
answer
3k
views
Updating ModSecurity when using OWASP rule sets
I am somewhat new to Modsecurity and still have a long way to go so bear with me. Ubuntu 18.04
I'm currently running Modsecurity 2.9.2-1 and OWASP rules 3.0.2
I would like to update the rules to ...
0
votes
1
answer
1k
views
Mod security syntax error
when i ran the command apache2ctl configtest it is showing this error
AH00526: Syntax error on line 193 of /etc/modsecurity/modsecurity.conf:
ModSecurity: Failed to open the audit log file: /var/log/...
0
votes
1
answer
437
views
SPOE and modsecurity contrib Failed to decode HELLO frame
I'm compile modsec as described in the instructions contib/modsec/README, but have the next errors:
# /usr/local/bin/modsecurity -n 4 -d -f /etc/haproxy/waf/modsecurity.conf
1534409877.286475 [00] ...
0
votes
1
answer
2k
views
Mod_security exclusion not fully working, still blocking CSS and images
I have put either of the following in my rules:
SecRule REQUEST_URI "@beginsWith /directory" "phase:1,id:12345,allow"
SecRule REQUEST_URI "@beginsWith /directory" "phase:1,id:12345,ctl:ruleEngine=off"...
0
votes
1
answer
953
views
Mod security exceptions not working
I would like to exclude a directory from mod security. I have tried everything under the sun in every config file to no avail. I have put stuff in the vhost file, the crs-setup file, the modsecurity....
0
votes
1
answer
2k
views
Apache LocationMatch not matching
I'm trying to set up request throttling for certain sensitive URIs in an apache (v2.2) virtualhost with mod_security, but finding trouble with the use of LocationMatch.
So far the configuration is as ...
0
votes
1
answer
1k
views
How to disable a specific mod_security rule in a specific directory?
I want to disable this rule:
[file "/usr/share/modsecurity-crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "159"] [id "981173"] [rev "2"] [msg "Restricted SQL Character ...
0
votes
1
answer
960
views
Modsecurity SecRuleUpdateTargetById not working
I'm trying to modify owasp crs 3.0 rule number 920440:
[id "920440"] [rev "2"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity ...
0
votes
1
answer
1k
views
Modsecurity cookie match [closed]
I run a small webhosting service (CPanel + ModSecurity) and I personnaly host few laravel projects on it. I noticed that when I (or anyone) visit multiple pages quickly (one after the other), at some ...
0
votes
1
answer
466
views
Testing new ModSecurity rules in production - only some rules to DetectionOnly
I'm in the process of modifying an existing ModSecurity ruleset and I'm wondering how I should handle the process of adding new, (mainly) untested rules to production systems.
At the moment, we do ...
0
votes
1
answer
3k
views
Whitelist for IP range on ModSecurity 2.9 & Apache 2.4.3
I'm try to add Google Ip range on white list for Mod Security
I use Cpanel+Apache 2.4+ModSecurity 2.9.0+OWASP Rules
On several post i se this conf
SecRule REMOTE_ADDR "@ipMatch XX.XX.XX.XX,66.249....
0
votes
1
answer
579
views
Mod_Security on 2 CentOS 7-servers. Different log-format
I installed mod_security on 2 CentOS 7-servers. Bot got this config:
SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4(?!04))"
SecAuditLogParts ABIFHZ
SecAuditLogType Concurrent
...
0
votes
1
answer
860
views
Modsecurity redirect rule : Send threatening user back to referrer
Consider the following SecRule, which takes a feed from a lua script that is executed:
SecRule &TX:SQLI "@eq 1" "id:'129793',phase:2,t:none,redirect:http://www.example.com/failed.html,msg:'...
0
votes
1
answer
2k
views
Blocking a request with ModSecurity and lua script
I have web traffic flowing through ModSecurity.
Within the ModSecurity configuration I am calling a Lua script that is running some simple analysis on the arguments of request string. Specifically, ...
0
votes
1
answer
3k
views
Modsecurity check REQUEST_URI without query parameters
Currently, I am using Modsecurity XSS prevention, but I'm having a hard time understanding how exactly I can restrict what I'm checking for in the REQUEST_URI variable.
My Example:
#
# -=[ XSS ...
0
votes
1
answer
504
views
modsecurity Does not contain custom REDQUEST_HEADER_NAMES
Trying to build a rule that will 403 any incoming traffic that doesn't contain the header X-CFKey and match a specific of X-CFKey.
I've got modsecurity testing X-CFKey value successfully but fails ...
0
votes
1
answer
1k
views
mod_security: What's the point of action auditlog?
I'm fiddling around with mod_security to log POST request payloads for a specific URI.
As stated in this response https://serverfault.com/a/729079/292993 to a similar question mod_security's ...
0
votes
1
answer
497
views
security2_module for apache with owsap modsecurity crs base rules is causing the “Forbidden You don't have permission to access / on this server”
I installed the security2 module to my apache server with owasp mod security base rules by adding these following lines to my httpd.conf:
<IfModule security2_module>
Include crs/owasp-...
0
votes
1
answer
3k
views
mod_security behind reverse proxy and clients IP
client -> haproxy -> mod_security boxes -> backends
Problem: mod_security boxes use mod_rpaf with ip of haproxy in 'RPAFproxy_ips'. Apache logging shows clients real ip but mod_security ...
0
votes
1
answer
2k
views
Syntax error on line 23 of /etc/httpd/conf.d/modsecurity.conf [duplicate]
I'm try install and configure Mod_Security on Amazon EC2 Linux 64 bits, but one error happens
Syntax error on line 23 of /etc/httpd/conf.d/modsecurity.conf:
ModSecurity: Found another rule with the ...
0
votes
1
answer
3k
views
mod-security not blocking POST request
I have a mod-security compiled from source and installed on Ubuntu Server 12.04, Apache 2.2.22. I loaded the OWASP core rule set, and I can see them getting triggered on the log file /var/log/apache2/...
0
votes
1
answer
601
views
How i can block requests for a specific page?
I would like to completely delete or block access to a specific page in my site.
More specifically, I have seen this exploit "Joomla COM_MEDIA Exploit" : http://all1gat0r.blogspot.gr/2013/08/joomla-...
0
votes
1
answer
2k
views
apache2 reverse proxy broken after modsecurity is installed ubuntu on 12.04.1
this is the first time I have run into issue like this one. I have a java application setting behind a apache2 using mod_ajp on 8009. I have noticed that I could not get the client's IP so I have ...
0
votes
1
answer
141
views
Find excluded keywords for $_POST/$_GET content with ModSecurity? [closed]
Our client has ModSecurity 2.0 with Rule Set 2.0.5 but he told us that minor detail at the end of the development.
I need to audit all the application code and make sure it does not interfere with ...
0
votes
2
answers
2k
views
How to prevent from uploading shell
What is the best way to prevent from uploading c99shell,r57shell and another php sheller? i want when an attacker upload a shell the sheller don't show for him.
I use mod_security ver 1.x
Thanks in ...
0
votes
1
answer
195
views
Side effects of using owasp mod_sec rules [closed]
I was looking at all the owasp rules for mod_security. How badly does it slow your loading time down if you use them all?
What would be the recommended packages to use? I want to mostly block bad UA, ...
0
votes
1
answer
1k
views
Mod_security questions and on User-Agent types
Very new to mod_sec
I want to block a UA string and I noticed there are a few types:
SecRule HTTP_User-Agent
SecRule REQUEST_HEADERS:User-Agent
What is the real difference between them?
My block:
...
0
votes
1
answer
749
views
Mod Security log monitoring
Is there a web based log management utility present for Mod Security? As parsing the logs of Mod Security is a big headache. I can only see traditional log monitoring systems but not any, which is ...
0
votes
1
answer
553
views
sources.list entry for mod_security testing release?
I have a debian "squeeze" installation, but the mod_security delivered with this release is quite old. So I'm thinking of adding an additional line to my sources.list to get the "wheezy" version (...
0
votes
2
answers
717
views
How to secure Cpanel/WHM from malacious uploads [duplicate]
Recently my site's index.php file was replaced with some malicious javascript code.
I really don't know how it was added to the page.
Today when I tried to download the file via FTP, my local anti-...
0
votes
1
answer
858
views
How can I have APF block script kiddies that mod_security detects?
In one of the vhosts' error_log I found thousands of lines like these, all from the same IP:
[Mon Apr 19 08:15:59 2010] [error] [client 61.147.67.206] mod_security: Access denied with code 403. ...
0
votes
1
answer
213
views
mod_security and apt-get
hi can anyone help me with mod_security configuration...
I have installed mod_security on ubuntu 9.04 lamp server,... but now I want to install anything and type apt-get install program, it keeps ...
0
votes
2
answers
1k
views
How to detect brute force in mod-security
I checked the core rules set in the mod-security but it's didn't contain the rules related to Brute-Force Attack!!! Did anyone know how to write the rules or the existing rules for this kind of Attack!...