ModSecurity supplies an array of request filtering and other security features to the Apache HTTP Server. ModSecurity is a web application layer firewall.

learn more… | top users | synonyms

0
votes
1answer
30 views

Mod_security - Syntax error

I have a password protected directory on my web server. To protect that from brute force attack, I tried to add the IP-Based BLocking config as below in the apache2 config file. But everytime I ...
0
votes
2answers
114 views

Using modsec to block a sql injection?

I'm seeing malicious traffic (SQL injections) directed towards some of my websites and I want to use modsec to block the requests. An attack will look something like the following: ...
1
vote
2answers
731 views

How do I remove the ServerSignature added by mod_fcgid?

I'm running Mod_Security and I'm using the SecServerSignature to customize the Server header that Apache returns. This part works fine, however I'm also running mod_fcgid which appends ...
1
vote
1answer
25 views

Apache error_log filled with modsec blocks

Ever since I enabled Apache modsecurity I've been checking the logs and been seeing the following constantly like 24/7: [Wed Jun 25 12:40:07 2014] [error] [client 112.215.65.61] ModSecurity: Access ...
1
vote
2answers
88 views

modsecurity apache mod-security.conf missing [closed]

Greetings Serverfaultians. I'm not a server guy as you can see from my noob score of 1 point. But maybe those more versed can help me. I'm using Ubuntu v13.10 32-bit Server and Apache2 v2.4.6 and I'm ...
0
votes
0answers
62 views

Nginx and dynamic X-Forwarded-For blocklist

I am running Nginx behind a proxy. I am getting visitors' real IP addresses through X-Forwarded-For HTTP request header. I'd like to block individual IPs based on a dynamic block list, up to 10000+ ...
0
votes
1answer
96 views

csf lfd denied by desktop because of mod_security

I have a WHM/Cpanel server with CSF/LFD installed and mod_security enabled. I used to login to WHM/cpanel from one of my local windows box through a linux (Centos 5)NAT gateway(with a public IP ...
0
votes
1answer
167 views

apache2 reverse proxy broken after modsecurity is installed ubuntu on 12.04.1

this is the first time I have run into issue like this one. I have a java application setting behind a apache2 using mod_ajp on 8009. I have noticed that I could not get the client's IP so I have ...
0
votes
0answers
57 views

Nginx + mod_security without a backend server

I want to start using mod_security for Nginx. However, I have read the official doc and something got my atention: ...
0
votes
0answers
110 views

Error install mod_security on nginx

I have problem when install mod_security on nginx. I add flagment on /etc/nginx/nginx.conf server { listen 80; server_name localhost; location / { ModSecurityEnabled ...
0
votes
0answers
47 views

External Web Application Firewall infront of IIS

We have a public facing IIS webserver hosting an ASP website which is not very secure, to say the least. I have found out several serious flaws in the last few months and would like to do something ...
1
vote
0answers
142 views

Curl Sourced DDoS: How to detect it & how to stop?

Okay, an Ubuntu server I manage fell victim to a DDoS attack today. Usually this is unpleasant but not that big a deal. A few high server load moments & then it passes. Today was clearly ...
0
votes
0answers
53 views

Hardening of ubuntu server.How to prevent overkill checks? How to detect genuine request from attacks?

I have followed one these hardening check list tutorials where I have noticed that there fail2ban installed and denyhost at the same time. To my knowledge fail2ban does a little more than what ...
0
votes
1answer
57 views

Blocking request with query string

I'm an under a DDoS attack though I have cloud flare.. I found out that the attacker is accessing the server using query strings "?a=randomnumber" I don't use query strings in my website so I need ...
0
votes
0answers
41 views

Mod_security pause rule does not work without a redirect following it

I've been trying to get mod_security to do a simple pause when a counter has reached the value 2. I am using mod_security 2.6.8 on CentOS 5 (from EPEL repo). The pause does not get executed unless ...
0
votes
1answer
180 views

Apache/ModSecurity - Blocking HTML Textarea with 403 when it contains a linebreak (enter key)?

I have a contact form, within this contact form is a textarea. If i fill out the contact form and in the test area, i enter one line of text, e.g. Example The form completes and i am notified via ...
2
votes
2answers
174 views

mod_security 960015 blocks Google and other good bots

mod_security rule 960015 keeps catching Google and other good bots. I have the following in the vhost to prevent good bots from being caught: SecRule REQUEST_HEADERS:User-Agent "Mail.ru" log,allow ...
0
votes
0answers
51 views

Error 403 when URL parameters are set twice

I am seeing strange behavior on an Apache server. When a parameter is set twice in the URL (e.g., https://example.com/xxx/xxx.cgi?toto=1&toto=1), I get a 403 error from Apache. I know ...
0
votes
0answers
40 views

Modsec: Set env variable based on User-agent

Relatively new to Apache modsec. Trying to do something simple and hitting a wall. I want to set an environment variable based on the User-Agent, and test it by setting a header. I have this: ...
0
votes
0answers
167 views

ModSecurity on Apache (Debian Wheezy), real-time IP-Blacklist from file

I am creating and updating an ip-blacklist dynamically with a php script based on specific bot behaviors or actions. The functions I use in the script add or remove ips, based on ban-duration set for ...
0
votes
0answers
117 views

How to solve UNIQUE_ID variable issue in modsecurity_crs_16_session_hijacking.conf ubuntu 10.04

I have been trying to harden ubuntu 10.04 using modsecurity and its core rules from owasp version 2.2.5. I have used the package from their github . After the symbolic link of the files in the ...
0
votes
0answers
65 views

mod_security2 rules for WordPress

Are there any standard (?!) mod_security2 rules for servers with WordPress websites? I want to make clear that I do not want to disable mod_security2 (it exists for a good reason). I just want to make ...
2
votes
2answers
2k views

mod_security not actually blocking requests despite rule trigger & returning 403

I've pulled my finger out and installed mod_security to protect our WHMCS installation (a PHP based billing system) from some of the more obvious SQL injection attacks to try and minimise our ...
0
votes
1answer
906 views

mod_security configuration issue: Error parsing actions: Unknown action: ver

I am trying to install / configure mod-sec using this tutorial, which uses the OWASP ModSecurity Core Rule Set. However when I go to restart apache, I get the following error: Syntax error on line 53 ...
-1
votes
2answers
919 views

How to turn off mod_security 2 on apache cpanel?

Preface I have been banging my head searching and trying to figure out why I am getting a 406 error on some occasions: Not Acceptable: An appropriate representation of the requested resource / could ...
1
vote
1answer
289 views

Configuring mod_security on Ubuntu 10.04

After spending ~24 hours trying and failing to setup mod_security in Ubuntu 10.04 LTS, I've finally decided that I'm going to need some help. I've tried pretty much every tutorial I can find with a ...
2
votes
2answers
34 views

How to use Modsec rules to certain page?

i want to block proxy(x-forwarded) ip certain page(wp-comments-post.php) using Apache Mod_security. my current mod_security rule: SecRule REQUEST_HEADERS_NAMES "^x-forwarded-for" ...
-1
votes
1answer
311 views

how to whitelist a certain cookie string in ModSecurity

We are getting a lot of False Positives from using 3rd part software on our server. They themselves can't seem to fix it and I'm trying to work out how to allow cookies through that contain ...
1
vote
0answers
49 views

ModSecurity: What do MULTIPART_DATA_BEFORE and MULTIPART_DATA_AFTER mean?

I'm getting the following ModSecurity error when posting form data to a LiquidWeb server: Multipart request body failed strict validation: PE 0, BQ 0, BW 0, DB 1, DA 1, HF 0, LF 0, SM 0, IQ 0, IP 0, ...
-3
votes
1answer
47 views

how i configuration mod_security? [closed]

when i setup mod_security default configuration then if anyone go wordpress admin panel and change any code or some modified then his ip block. why? my all customer complain for this problem. how i ...
0
votes
1answer
67 views

How to block/ban clients that try to access some paths / urls?

Some spambots hammer my server with nonexisting paths like /user/pass?=asdfdasfas How could I block any access to /user/pass?=* ? Is there a better tool than iptables or csf for catching such crap?
4
votes
2answers
102 views

Why bother reverse proxying applications if you aren't using mod_security or TMG/UAG?

Common wisdom is that internal applications that live inside of the trusted network, such as Exchange, should be reverse proxies whenever they are exposed to the Internet. Microsoft recommends using ...
4
votes
0answers
301 views

ModSecurity on Apache (Debian Wheezy), Authentication logging

I am new to ModSecurity, it works great on the server, but I would like to control the way it logs things. For example as I am troubleshooting my website in order to whitelist or correct php coding ...
0
votes
0answers
95 views

trace security hole for culprit random “post” mail files

Running a shared cpanel server with so many layers of security, but somehow someone is able to upload randomly named files with post, spamming out from random users on the box. Examples <?php if ...
4
votes
2answers
8k views

How do I find out if mod_security is installed on my apache server?

How can I find out if mod_security is installed on my apache server? I would also like to learn its version. I'm having some upload issues and I tried to disable mod_security using .htaccess. But ...
0
votes
0answers
139 views

What advantages does mod_evasive have over mod_security2 in terms of DDOS protection?

I'm running an Apache2 server in front of a Tomcat and I need to implement a DDoS protection mechanism on the Apache2 layer. I have two candidates: mod_evasive and mod_security2 with the OWASP core ...
1
vote
0answers
108 views

nginx with fail2ban and mod_security

I forgot to update my fail2ban config for nginx. I just moved to nginx from apache. Today, I got a lot of cals from a single IP. IP tried to access login pages with post and get methods IP tried to ...
1
vote
0answers
187 views

How do I handle apache2 modsecurity2 warnings like Match of “rx ^OPTIONS$” against “REQUEST_METHOD” required?

After upgrade from squeeze to wheezy I get loads of these messages in my apache errorlog when I open a webpage on myserver, (changed to myserver.de here): [Sat Oct 19 01:06:21 2013] [error] [client ...
1
vote
2answers
275 views

Blocking bad bots

I found this script and was wondering if this is just overkill and even worth using? Is it better for me to just use mod_security? # Generated using http://solidshellsecurity.com services # Begin ...
1
vote
1answer
491 views

Setting up mod_security for phpmyadmin on 12.04

Having issues with mod_security blocking functions of phpmyadmin such as server_databases.php, as sql injection attacks. Is there a way to correct this, or do I need to disable mod_security totally ...
1
vote
0answers
390 views

ModSecurity: collections_remove_stale: Failed deleting collection

Environment: Ubuntu Server 12.04 64Bit with Apache/2.2.22 (Ubuntu) and Worker mpm with modsecurity 2.7.5 and OWASP CRS latest. Problem: When server is under a load of 1500 concurrent users ...
0
votes
1answer
33 views

Find excluded keywords for $_POST/$_GET content with ModSecurity? [closed]

Our client has ModSecurity 2.0 with Rule Set 2.0.5 but he told us that minor detail at the end of the development. I need to audit all the application code and make sure it does not interfere with ...
0
votes
0answers
110 views

apache DirectoryMatch matching filenames

I have the following code in my security.conf file of apache <DirectoryMatch "/(albums|attachment(s)?|upload(s)?)"> Options -ExecCGI <IfModule php5_module> php_flag engine off ...
-1
votes
1answer
124 views

You don't have permission to access /on this server

I created a form in joomla with 2000 fields but when I submit the form it gives me: error-- You don't have permission to access /en/soccer-player-update on this server. Additionally, a 404 Not Found ...
0
votes
2answers
1k views

ModSecurity compile error on nginx

I'm trying to install ModSecurity on nginx with the following instructions : wget https://github.com/SpiderLabs/ModSecurity/archive/master.zip unzip master cd ModSecurity-master ./autogen.sh ...
0
votes
1answer
573 views

Blocking repeated http requests in Apache behind a load balancer

I have a number of EC2 servers on AWS running apache behind a load balancer (ELB). Every now and then some IP address abuses the API hosted on the EC2 servers and causes a denial of service. I have no ...
0
votes
1answer
320 views

modsecurity whitelist to allow file downloads?

I have a site that has modsecurity enabled but I am receiving 403 Forbidden when trying to access PDF documents on the server through the web site. Is there a way to whitelist pdf files to allowed to ...
1
vote
0answers
51 views

mod_security to Inspect Post Variables

Can mod_security be used to inspect post variables? It looks like I can through turning SecRequestBodyAccess. I would like to check the username POST field from a form in wp-login.php. If it's value ...
-1
votes
2answers
297 views

How to prevent from uploading shell

What is the best way to prevent from uploading c99shell,r57shell and another php sheller? i want when an attacker upload a shell the sheller don't show for him. I use mod_security ver 1.x Thanks in ...
0
votes
1answer
83 views

Proxying while preserving URI with mod_security2

I'm using a proxy: action in mod_security2. I'd like to preserve the full URL of the original request, however, and it seems to be rewriting that to the url in my proxy: action. So a request to ...