ModSecurity supplies an array of request and response filtering rules and other security features to the Apache HTTP Server. ModSecurity is an open source web application layer firewall.

learn more… | top users | synonyms

0
votes
2answers
96 views

What rule can I use in ModSecurity to log POST payload for a specific site?

I need to inspect POST payload for a specific website (the server is rather busy and I wouldn't turn on POST logging for the entire server). The server is LiteSpeed 5.0.7. SecRequestBodyAccess is set ...
0
votes
1answer
15 views

mod_security: What's the point of action auditlog?

I'm fiddling around with mod_security to log POST request payloads for a specific URI. As stated in this response http://serverfault.com/a/729079/292993 to a similar question mod_security's ...
0
votes
1answer
10 views

mod_security: How to log POST requests for specific URI?

I'm trying to set up mod_security to log POST requests payload for a specific URI, as it seems that a customers webpage is used as a spam relay and these requests corrupt the server side cache. I ...
0
votes
1answer
1k views

csf lfd denied by desktop because of mod_security

I have a WHM/Cpanel server with CSF/LFD installed and mod_security enabled. I used to login to WHM/cpanel from one of my local windows box through a linux (Centos 5)NAT gateway(with a public IP ...
0
votes
0answers
11 views

Mosecurity with Nginx logs the 127.0.0.1 as destination

I am using Modsecurity with Nginx. It works and everything is fine unless the modsecurity logs the destination as 127.0.0.1. How can I set the destination with Nginx $proxy_host variable or whatever ...
0
votes
0answers
13 views

Nginx set_real_ip_from clears source port

I am using Modsecurity with Nginx behind another proxy (reverse cache proxy). To have the correct IP addresses of the clients am using ngx_http_realip_module using directives: set_real_ip_from ...
1
vote
1answer
1k views

mod_security2.so: undefined symbol: ap_unixd_set_gl

service httpd restart Stopping httpd: [ OK ] Starting httpd: httpd: Syntax error on line 205 of /etc/httpd/conf/httpd.conf: Cannot load ...
0
votes
1answer
11 views

Modsecurity Whitelist and keep logging

I am white listing a tag and I am curious if there is a way to white list this and keep the logging to this at the same time. SecRuleUpdateTargetByTag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION" ...
0
votes
1answer
17 views

Modsecurity Ignore/Whitelist IP

I have looked around on the net and have seen many common answers for this , however, none of them are working. I am trying to use this to ignore whenever our scans kick off in the morning. SecRule ...
0
votes
1answer
25 views

security2_module for apache with owsap modsecurity crs base rules is causing the “Forbidden You don't have permission to access / on this server”

I installed the security2 module to my apache server with owasp mod security base rules by adding these following lines to my httpd.conf: <IfModule security2_module> Include ...
0
votes
0answers
16 views

Modsecurity: How can I consolidate all SecRules to ignore aparameter

How can I consolidate all or any secrule to ignore a parameter with modsecurity? I have a form that will always flag as XSS, unfortunately, my rule list is getting rather large as the site grows. I ...
0
votes
1answer
39 views

SecRuleEngine Off not working on a single domain in virtual host

I have modSecurity installed and working on a server with multiple hosts and I want to disable some rules for one host only. This is what is what I put in the virtual host file: <IfModule ...
0
votes
1answer
51 views

SecChrootDir Jailing apache 2.2.X on Centos 6.7

I was trying to do apache jailing on centos 6.7 with modsec. I already built everything even the jail directory and remodeled the config files. httpd(apache) says it started nicely, however its dead. ...
1
vote
1answer
1k views

Nginx with mod_security support

I have compiled nginx with mod_security support. In error log I can see the support for mod_security 2012/08/27 11:13:11 [info] 602096#0: ModSecurity for nginx/2.7.0-rc2 ...
-1
votes
1answer
44 views

Nginx with mod_security on EC2 [closed]

I am looking to get some ideas and see what others are doing in terms of managing/keeping updated Nginx + mod_security on EC2 instances. The catch with this is that mod_security needs to be compiled ...
1
vote
1answer
15 views

Apache 2: Limit Ressources

I'm running some web pages on apache 2.4. At the moment I can see a lot of connections like these on status-page: Srv PID Acc M CPU SS Req Conn Child Slot Client VHost Request 2-0 - ...
1
vote
1answer
30 views

How can I decrease mod-security severity?

Actually the module blocks calls with "notice" level. How can I decrease the severity level and take it to "warning"?
2
votes
3answers
3k views

Test whether mod_security is actually working

I'm running this on my staging server for the first time and I think I did everything correctly. I can see entries in modsec_audit.log when I run nikto2 against it, but for the life of me I can't ...
0
votes
0answers
87 views

Remove double content-length header

Server configuration: CentOS 7, Apache 2.4.18, PHP 5.6.16, NginX 1.8.0 as reverse proxy, mod_security and rules latest version and DirectAdmin 1.49.1. The problem is: mod_security is adding double ...
1
vote
1answer
88 views

modsecurity whitelisting certian types of cookies

I am seeing cookies being generated on our server which appear to be from 3rd party objects in the site and don't show themselves when one logs in or navigates through the site. The cookies are ...
0
votes
0answers
41 views

Apache mod-security - Deny access from IP addresses listed in a blacklist file

I want to deny access from IP addresses listed in a blacklist file (not realy matters, but the file is /etc/csf/csf.deny). This is my custom rule (at the moment..): SecRule REQUEST_URI ...
0
votes
1answer
60 views

workaround for modsecurity false positive?

I was pasting "drwxr-xr-x. 2 root root 6 Sep 24 04:35 images" into a dokuwiki page That triggered modsecurity and I got a HTTP error. How can this rule be modified to avoid this kind of false ...
1
vote
2answers
177 views

Passwords in modsec log files

Are there any best practices or approaches I can take to prevent certain data (e.g. passwords) from being logged into mod-security's log files? We've a call coming into our Apache server (and onto ...
0
votes
1answer
55 views

Already enabled x-forwarded for in haproxy, but mod_remoteip 2.2 backport still doesn't work

I'm using haproxy to forward requests to Apache 2.2 bundled with modsecurity 2.7 and OWASP_CRS. I have enabled insertion of the X-Forwarded-For header in the haproxy config: defaults: option ...
4
votes
1answer
159 views

SecAuditLogParts not working: mod_security keeps logging response body

I have set SecAuditLogParts in modsecurity.conf to just log ABFH, but the modsecurity audit log keeps logging -E- part (response body) which makes the audit log too big. What can I do to disable ...
0
votes
0answers
22 views

ModSecurity - Matching multiple occurences in XML body

I have the following XML request body: <myMethod> <struct> <member> <name>Member_1</name> ...
0
votes
2answers
928 views

Apache2 mod_security simple default deny rules for specific directory

How to configure the simplest useful default-deny rule set for mod_security? I want to configure mod_security to allow only very specific queries to single directory: In short: I use Apache as a ...
0
votes
1answer
91 views

mod_security behind reverse proxy and clients IP

client -> haproxy -> mod_security boxes -> backends Problem: mod_security boxes use mod_rpaf with ip of haproxy in 'RPAFproxy_ips'. Apache logging shows clients real ip but mod_security ...
1
vote
1answer
114 views

mod_security rule to block GET requests via querystring or referer

In the last days in my VPS there are many many GET requests on 1 file that cause a high memory load (all came from a single refer url, with different IPs). Until now I've blocked these requests via ...
1
vote
1answer
75 views

mod_security - How to process text/xml request_body

I'm trying to process REQUEST_BODY of web request, which has Content-Type: text/xml and some XML inside it. Let say I have the following request: curl -v -d " <?xml version="1.0" ...
0
votes
1answer
49 views

Change Mod Security Rule for Deny ( 401 Status Page )

I Used a mod security rule for deny wp login attept. <LocationMatch /wp-login.php> SecRule REQUEST_METHOD "@streq POST" \ "phase:5,chain,t:none,auditlog,pass,msg:'Login Failure Detection: ...
-2
votes
1answer
77 views

ModSecurity error on wordpress wp-login rules

I have made i ModSecurity rule for apache for cPanel server to protect wordpress, but it have some error, so please suggest me some modification to work it fine. # This has to be global, cannot exist ...
0
votes
0answers
49 views

enable PUT with ModSecurity

I'm hosted in a VPS with Inmotionhosting, and I need to expose PUT and DELETE method for a REST API I'm programming. They tell me that if I want to use PUT, I need to disable ModSecurity. I think ...
0
votes
0answers
13 views

ModSecurity shows server ip as source instead of attacker ip

after upgrade to PHP 5.5 and everything works well i found that mod security is logging all attacks with the server ip itself instead of attacker ip !! before upgrade it was showing the attacker ip ...
3
votes
2answers
3k views

mod_security 960015 blocks Google and other good bots

mod_security rule 960015 keeps catching Google and other good bots. I have the following in the vhost to prevent good bots from being caught: SecRule REQUEST_HEADERS:User-Agent "Mail.ru" log,allow ...
1
vote
0answers
58 views

How install PHP 5.4, mod_security and mod_evasive together without conflict

I need create webserver with PHP 5.4, and install mod_security and mod_evasive. But when I try to join the php 5.4 and the mods on an EC2 server, it returns an error of conflict between the versions ...
0
votes
1answer
45 views

mod_security installation not creating /usr/share/modsecurity-crs/

I have a server running ubuntu 14 lamp I´ve installed mod_security: apt-get install libapache2-modsecurity then decided to uninstall using this command: sudo apt-get remove ...
0
votes
1answer
131 views

Syntax error on line 23 of /etc/httpd/conf.d/modsecurity.conf [duplicate]

I'm try install and configure Mod_Security on Amazon EC2 Linux 64 bits, but one error happens Syntax error on line 23 of /etc/httpd/conf.d/modsecurity.conf: ModSecurity: Found another rule with the ...
0
votes
0answers
128 views

After install mod_security and mod_evasive, php not working

I followed this tutorial ( tutorial.centos.com.my/?p=69 ) and got success to install mod_security and mod_evasive. But php does not run, displays the code in the browser. Insert an index.php file in ...
5
votes
2answers
152 views

How to include ModSecurity request final action in the Apache access.log

I'm currently using ModSecurity 2.7 and Apache 2.4.7 on Ubuntu Trusty. I would like to use Apache's LogFormat and CustomLog directives so that I can include a field indicating whether ModSecurity ...
0
votes
1answer
200 views

VPS server restarting MOD_SECURITY?

My VPS server has been acting up lately, for example last weekend the PHP module Imagemagick simply stopped working and I had to do a PERC uninstall / reinstall. Today my server has been totally ...
0
votes
1answer
139 views

Jetmon being blocked by ModSecurity, how to write override rule?

I have a WordPress site on a VPC and I'm trying to tweak ModSecurity to reduce the false positives. I have Jetpack monitoring which is being denied when ModSecurity is active. Log from Apache ...
3
votes
2answers
6k views

ModSecurity block specific string in request

I want a ModSecurity rule, which block the access to any url or any Body request Post/Get, if it contains a specific string. For example i want to block this string : "km0ae9gr6m" I have this rule ...
0
votes
1answer
331 views

security2_module for apache is causing the “Forbidden You don't have permission to access / on this server” message

I installed the security2 module to my apache server by adding these following lines to my httpd.conf: <IfModule security2_module> Include ...
0
votes
2answers
19 views

Modsecurity rule to not scan URIs

Good Morning, I am currently on creating a new mod security 2.5 rule. My deployment: I have an Apache server in reverse proxy mode. This Apache server does not host the websites. Instead, I proxy ...
2
votes
1answer
72 views

ModSecurity rule to not scan URI

I am having difficulty creating a new mod security 2.5 rule. My deployment: Apache server, Setup as a reverse proxy. (so the apache webserver __does not_ host the website. Instead, I proxy the ...
5
votes
1answer
623 views

ModSecurity on Apache (Debian Wheezy), Authentication logging

I am new to ModSecurity, it works great on the server, but I would like to control the way it logs things. For example as I am troubleshooting my website in order to whitelist or correct php coding ...
0
votes
1answer
77 views

WAF at Transparent Mode

I want to use Mod Security as transparent mode. Mod security web application firewall (WAF) should be between server and client and client provided with only server's IP address to access the site. ...
0
votes
1answer
414 views

mod-security not blocking POST request

I have a mod-security compiled from source and installed on Ubuntu Server 12.04, Apache 2.2.22. I loaded the OWASP core rule set, and I can see them getting triggered on the log file ...
-1
votes
2answers
34 views

Modsecurity: no action id present

I have not been doing anything with my site for a while and recently upgraded Ubuntu from 12.04 to 14.04 LTS, but now I am getting errors like: Modsecurity: no action id present I looked around ...