ModSecurity supplies an array of request filtering and other security features to the Apache HTTP Server. ModSecurity is a web application layer firewall.

learn more… | top users | synonyms

1
vote
3answers
819 views

How do I remove the ServerSignature added by mod_fcgid?

I'm running Mod_Security and I'm using the SecServerSignature to customize the Server header that Apache returns. This part works fine, however I'm also running mod_fcgid which appends ...
1
vote
2answers
298 views

Where does Ubuntu 10.04 store the configuration file of mod-security?

I've installed libapache-mod-security on Ubuntu 10.04. The only configuration file I've been able to find is this one: cat /var/lib/dpkg/info/libapache-mod-security.conffiles ...
1
vote
1answer
17 views

What exactly does the ModSecurity SecCollectionTimeout directive?

I am having a little bit of trouble with a recurring "Failed deleting collection" error message from ModSecurity (see this discussion @ GitHub for some context). In the discussion of this error it is ...
1
vote
1answer
133 views

Mod Security ctl:ruleEngine=Off Whitelist Fails in Phase 1

Background info : cPanel server with atomicorp ruleset, plus our own custom rules and whitelists in separate .conf files - Apache 2.2, modsec 2.8 Whitelist rule: SecRule REMOTE_ADDR ...
1
vote
1answer
522 views

Dropping incoming requests for a specific file with iptables

Server is a standard LAMP stack configured via cpanel on CentOS 5.9. We have one file, call it bad.php, on one of our domains that is mistakenly being accessed about 10 times a second by a service ...
1
vote
1answer
283 views

Does ModSecurity 2.7.1 work with ASP.NET MVC 3?

I'm trying to get ModSecurity 2.7.1 to work with an ASP.NET MVC 3 website. The installation ran without errors and looking at the event log, ModSecurity is starting up successfully. I am using the ...
1
vote
1answer
677 views

mod_security2.so: undefined symbol: ap_unixd_set_gl

service httpd restart Stopping httpd: [ OK ] Starting httpd: httpd: Syntax error on line 205 of /etc/httpd/conf/httpd.conf: Cannot load ...
0
votes
1answer
36 views
+50

mod_security not working at all

I'm trying to make the mod_security work, I searched a lot on the web, and followed this tutorial to configure mod_security (all my configuration files are the same as the tutorial), and when I run ...
0
votes
1answer
35 views

How could I exclude mod_security from sub-directories on Amazon EC2 with LAMP?

I never activated before the mod_security or edit Virtual Hosts, so it's a new challenge for me, I tried to follow this tutorial but seems that most of the tutorials around the web are not reflecting ...
0
votes
1answer
26 views

whitelist URI on mod_security enabled apache reverse proxy

I have an apache 2.2.29-1.4 with mod_security 2.8.0-5.25 which is a reverse proxy with mod_proxy_http for a local java application. I have false positive on some urls and would like to whitelist some ...
0
votes
1answer
30 views

Modsecurity: Whitelist requests, Block all else?

I'm just reading up about - and experimenting with - modsecurity and hoping someone can educate a little about the method behind the madness. The approach I'd ordinarily take with any firewall is to ...
0
votes
1answer
72 views

Proper SSL config for SSL - Apache2 ignores DocumentRoot

So here's my current config: <VirtualHost *:443> DocumentRoot "/var/www/keypad" ServerName keypad.io SSLOptions +StrictRequire <Directory /> SSLRequireSSL ...
0
votes
1answer
38 views

Mod Security2 deactivation rule only from a specified IP addresses

Is it possible to disable a rule by Mod Security2, only for one specified IP addresses? Only for one specified IP addresses & only for one specified path ( /administrator ) ? I tried this: ...
0
votes
1answer
1k views

Mod_security - Syntax error

I have a password protected directory on my web server. To protect that from brute force attack, I tried to add the IP-Based BLocking config as below in the apache2 config file. But everytime I ...
0
votes
1answer
489 views

csf lfd denied by desktop because of mod_security

I have a WHM/Cpanel server with CSF/LFD installed and mod_security enabled. I used to login to WHM/cpanel from one of my local windows box through a linux (Centos 5)NAT gateway(with a public IP ...
0
votes
1answer
99 views

Blocking request with query string

I'm an under a DDoS attack though I have cloud flare.. I found out that the attacker is accessing the server using query strings "?a=randomnumber" I don't use query strings in my website so I need ...
0
votes
1answer
436 views

Apache/ModSecurity - Blocking HTML Textarea with 403 when it contains a linebreak (enter key)?

I have a contact form, within this contact form is a textarea. If i fill out the contact form and in the test area, i enter one line of text, e.g. Example The form completes and i am notified via ...
0
votes
1answer
88 views

Proxying while preserving URI with mod_security2

I'm using a proxy: action in mod_security2. I'd like to preserve the full URL of the original request, however, and it seems to be rewriting that to the url in my proxy: action. So a request to ...
0
votes
1answer
797 views

Nginx with mod_security support

I have compiled nginx with mod_security support. In error log I can see the support for mod_security 2012/08/27 11:13:11 [info] 602096#0: ModSecurity for nginx/2.7.0-rc2 ...
-1
votes
1answer
241 views

You don't have permission to access /on this server

I created a form in joomla with 2000 fields but when I submit the form it gives me: error-- You don't have permission to access /en/soccer-player-update on this server. Additionally, a 404 Not Found ...
-1
votes
1answer
144 views

gotroot mod_security rules

Are the gotroot mod_security rules any good? I've heard that you will get a lot of false positives and before I try and use them on a live box just wanted to know if anyone else has experience with ...
5
votes
0answers
467 views

ModSecurity on Apache (Debian Wheezy), Authentication logging

I am new to ModSecurity, it works great on the server, but I would like to control the way it logs things. For example as I am troubleshooting my website in order to whitelist or correct php coding ...
2
votes
0answers
50 views

ModSecurity phase not working?

Sorry I am very new to modsecurity (2.8). So I made my first rule to block a referrer spam with the following: SecRule REQUEST_HEADERS:Referer "buttons\-for\-website\.com" ...
2
votes
0answers
128 views

Custom collections with mod_security

I would like to create a mod_security collection that is based on something other than the user's IP, Session ID, or username. Specifically, based on the REQUEST_URI. However, mod_security indicates ...
1
vote
0answers
27 views

ModSecurity on IIS: Single threaded?

I installed ModSecurity on a web server running IIS 8.5, and noticed the response time has increased 15 times (0.15 ms/request vs. 2.2 ms/request), even with SecEngine set to off. It seems that IIS is ...
1
vote
0answers
159 views

How to filter POST data with mod_security when type is text/xml?

I'm trying to craft a rule which would match certain regex in POST requests. Rule I have so far looks like; SecRule REQUEST_FILENAME "form.php" \ "id:'12345',chain,deny,status:406,log,msg:'foobar ...
1
vote
0answers
338 views

Curl Sourced DDoS: How to detect it & how to stop?

Okay, an Ubuntu server I manage fell victim to a DDoS attack today. Usually this is unpleasant but not that big a deal. A few high server load moments & then it passes. Today was clearly ...
1
vote
0answers
180 views

How to solve UNIQUE_ID variable issue in modsecurity_crs_16_session_hijacking.conf ubuntu 10.04

I have been trying to harden ubuntu 10.04 using modsecurity and its core rules from owasp version 2.2.5. I have used the package from their github . After the symbolic link of the files in the ...
1
vote
0answers
66 views

ModSecurity: What do MULTIPART_DATA_BEFORE and MULTIPART_DATA_AFTER mean?

I'm getting the following ModSecurity error when posting form data to a LiquidWeb server: Multipart request body failed strict validation: PE 0, BQ 0, BW 0, DB 1, DA 1, HF 0, LF 0, SM 0, IQ 0, IP 0, ...
1
vote
0answers
155 views

nginx with fail2ban and mod_security

I forgot to update my fail2ban config for nginx. I just moved to nginx from apache. Today, I got a lot of cals from a single IP. IP tried to access login pages with post and get methods IP tried to ...
1
vote
0answers
332 views

How do I handle apache2 modsecurity2 warnings like Match of “rx ^OPTIONS$” against “REQUEST_METHOD” required?

After upgrade from squeeze to wheezy I get loads of these messages in my apache errorlog when I open a webpage on myserver, (changed to myserver.de here): [Sat Oct 19 01:06:21 2013] [error] [client ...
1
vote
0answers
641 views

ModSecurity: collections_remove_stale: Failed deleting collection

Environment: Ubuntu Server 12.04 64Bit with Apache/2.2.22 (Ubuntu) and Worker mpm with modsecurity 2.7.5 and OWASP CRS latest. Problem: When server is under a load of 1500 concurrent users ...
1
vote
0answers
67 views

mod_security to Inspect Post Variables

Can mod_security be used to inspect post variables? It looks like I can through turning SecRequestBodyAccess. I would like to check the username POST field from a form in wp-login.php. If it's value ...
1
vote
0answers
531 views

short Apache outages (VPS, ModSecurity)

I have a problem with my site recently hosted at Liquidweb, none of their techs seems to be able to solve this issue even after days. Was hoping I could get some help here. Occasionally, my site's ...
1
vote
0answers
112 views

log/dump response body

Is there any way to log response body in Apache 2? I need the exact content that will be sent to user browser. I tried mod_security audit logging, but it won't log response body for all requests. ...
0
votes
0answers
35 views

Apache server fault after configure mod-security2

I configured mod-security, from https://www.digitalocean.com/community/tutorials/how-to-set-up-mod_security-with-apache-on-debian-ubuntu . After that a restart apache service but i caught error: The ...
0
votes
0answers
74 views

mod_security and CSF protection for Wordpress - ban release issues

We're using mod_sec and CSF to protect client Wordpress logins from brute force attacks. System admin is using the popular 0134 / 0135 rule in mod_sec: SecAction ...
0
votes
0answers
34 views

Modsec XSS Filter Issue

Modsecurity is denying a particular email address and I can't figure out why. This rule has never been triggered before for me and the form where this data comes from is used hundreds of times per ...
0
votes
0answers
30 views

Server wont let me save URLs to MySQL database?

I am posting here because all other forum say it's a server environ issue. I have a site with the ModX CMS on it hosted on a GoDaddy server (not sure about the specific setup is as client has ...
0
votes
0answers
28 views

What is /stop in my server logs?

Why do my server logs show GET requests to /stop? I believe this is due to modsecurity but cannot determine why or the importance.
0
votes
0answers
151 views

mod-security not blocking POST request

I have a mod-security compiled from source and installed on Ubuntu Server 12.04, Apache 2.2.22. I loaded the OWASP core rule set, and I can see them getting triggered on the log file ...
0
votes
0answers
326 views

Server Mod_security Error “406 Not Acceptable” WHM/cPanel [1234123413]

When i try to access one of the domains from browser i get an "406 Not acceptable" error. after doing a little research i figure out is due to rule ID [1234123413]. Now my concerns are: if i ...
0
votes
0answers
126 views

Nginx and dynamic X-Forwarded-For blocklist

I am running Nginx behind a proxy. I am getting visitors' real IP addresses through X-Forwarded-For HTTP request header. I'd like to block individual IPs based on a dynamic block list, up to 10000+ ...
0
votes
0answers
115 views

Nginx + mod_security without a backend server

I want to start using mod_security for Nginx. However, I have read the official doc and something got my atention: ...
0
votes
0answers
327 views

Error install mod_security on nginx

I have problem when install mod_security on nginx. I add flagment on /etc/nginx/nginx.conf server { listen 80; server_name localhost; location / { ModSecurityEnabled ...
0
votes
0answers
112 views

External Web Application Firewall infront of IIS

We have a public facing IIS webserver hosting an ASP website which is not very secure, to say the least. I have found out several serious flaws in the last few months and would like to do something ...
0
votes
0answers
100 views

Hardening of ubuntu server.How to prevent overkill checks? How to detect genuine request from attacks?

I have followed one these hardening check list tutorials where I have noticed that there fail2ban installed and denyhost at the same time. To my knowledge fail2ban does a little more than what ...
0
votes
0answers
95 views

Mod_security pause rule does not work without a redirect following it

I've been trying to get mod_security to do a simple pause when a counter has reached the value 2. I am using mod_security 2.6.8 on CentOS 5 (from EPEL repo). The pause does not get executed unless ...
0
votes
0answers
86 views

Modsec: Set env variable based on User-agent

Relatively new to Apache modsec. Trying to do something simple and hitting a wall. I want to set an environment variable based on the User-Agent, and test it by setting a header. I have this: ...
0
votes
0answers
166 views

apache DirectoryMatch matching filenames

I have the following code in my security.conf file of apache <DirectoryMatch "/(albums|attachment(s)?|upload(s)?)"> Options -ExecCGI <IfModule php5_module> php_flag engine off ...