ModSecurity supplies an array of request and response filtering rules and other security features to the Apache HTTP Server. ModSecurity is an open source web application layer firewall.

learn more… | top users | synonyms

5
votes
1answer
653 views

ModSecurity on Apache (Debian Wheezy), Authentication logging

I am new to ModSecurity, it works great on the server, but I would like to control the way it logs things. For example as I am troubleshooting my website in order to whitelist or correct php coding ...
2
votes
1answer
92 views

ModSecurity rule to not scan URI

I am having difficulty creating a new mod security 2.5 rule. My deployment: Apache server, Setup as a reverse proxy. (so the apache webserver __does not_ host the website. Instead, I proxy the ...
1
vote
1answer
16 views

Steps to find the specific rule for Mod_security

I am running an web portal on Lamp stack. I am facing an issue with a export button functionality when i click on the button it redirects to Apache test page. When i comment the #Include ...
1
vote
1answer
399 views

Proper SSL config for SSL - Apache2 ignores DocumentRoot

So here's my current config: <VirtualHost *:443> DocumentRoot "/var/www/keypad" ServerName keypad.io SSLOptions +StrictRequire <Directory /> SSLRequireSSL ...
1
vote
1answer
785 views

Dropping incoming requests for a specific file with iptables

Server is a standard LAMP stack configured via cpanel on CentOS 5.9. We have one file, call it bad.php, on one of our domains that is mistakenly being accessed about 10 times a second by a service ...
1
vote
1answer
1k views

mod_security2.so: undefined symbol: ap_unixd_set_gl

service httpd restart Stopping httpd: [ OK ] Starting httpd: httpd: Syntax error on line 205 of /etc/httpd/conf/httpd.conf: Cannot load ...
0
votes
1answer
156 views

Chrooting Apache 2.4 on Debian Jessie with mod_security

I have been advised to chroot my apache2 installation to better secure the sensitive content on the rest of the server. I have installed and setup mod_security properly and can see in the logs that it ...
0
votes
1answer
51 views

mod_security unable to add OWASP CRS - CentOS 7

My website has been under constant attack from hackers since the day I set up the virtual server and installed WordPress. I was able to install mod_security, however, I am unable to add the OWASP CSR. ...
0
votes
1answer
30 views

Modsecurity Ignore/Whitelist IP

I have looked around on the net and have seen many common answers for this , however, none of them are working. I am trying to use this to ignore whenever our scans kick off in the morning. SecRule ...
0
votes
1answer
68 views

SecChrootDir Jailing apache 2.2.X on Centos 6.7

I was trying to do apache jailing on centos 6.7 with modsec. I already built everything even the jail directory and remodeled the config files. httpd(apache) says it started nicely, however its dead. ...
2
votes
0answers
38 views

Any versions of ModSecurity that works with recent versions of Nginx?

I'm building Nginx and ModSecurity together in order to use the OWASP- Core Rule Set Project. According to the modsecurity download page, the latest version of modsecurity (2.9.1) is not stable when ...
2
votes
0answers
128 views

ModSecurity phase not working?

I have installed modsecurity (2.8). So I made my first rule to block a referrer spam with the following: SecRule REQUEST_HEADERS:Referer "buttons\-for\-website\.com" ...
2
votes
0answers
541 views

How to filter POST data with mod_security when type is text/xml?

I'm trying to craft a rule which would match certain regex in POST requests. Rule I have so far looks like; SecRule REQUEST_FILENAME "form.php" \ "id:'12345',chain,deny,status:406,log,msg:'foobar ...
2
votes
0answers
241 views

Nginx and dynamic X-Forwarded-For blocklist

I am running Nginx behind a proxy. I am getting visitors' real IP addresses through X-Forwarded-For HTTP request header. I'd like to block individual IPs based on a dynamic block list, up to 10000+ ...
2
votes
0answers
184 views

Custom collections with mod_security

I would like to create a mod_security collection that is based on something other than the user's IP, Session ID, or username. Specifically, based on the REQUEST_URI. However, mod_security indicates ...
1
vote
0answers
15 views

Install Mod_Security for Nginx without need to recompile

I've got LEMP all setup. Now I would like to add mod_security. I tried to research but all I could find are instructions on how to recompile nginx. Is there a way to add mod_security without needing ...
1
vote
0answers
41 views

mod_security forcing to redirect to Apache test page

i have installed drupal and installed couple of modules to provide the admin export to excel feature. when i click on the export button the page is getting redirected to Apache test page. I have done ...
1
vote
0answers
124 views

How install PHP 5.4, mod_security and mod_evasive together without conflict

I need create webserver with PHP 5.4, and install mod_security and mod_evasive. But when I try to join the php 5.4 and the mods on an EC2 server, it returns an error of conflict between the versions ...
1
vote
0answers
91 views

Test for length of ARG parameter in SecRule - Mod Security

What is the most efficient way to limit the length of a http request parameter using Mod Security? For example, to limit WordPress comment length : SecRule ARGS:comment "^.{65530}" Would this regex ...
1
vote
0answers
239 views

apache mod_evasive with mpm_prefork settings to work

I have tried to find all the information I could on this and I understand the problem with mod_evasive not working when the server is in the mpm_prefork mode (instead of worker). However, I was able ...
1
vote
0answers
91 views

ModSecurity on Apache 2.2 in EC2 - HTTP Status 413 messages dropped

Hi I am running Mod_Security on Ubuntu instances in EC2 behind an Elastic Loadbalancer. The app is a Ruby App. I have set SecRequestBodyLimit 293601280 When I upload files below that size, they ...
1
vote
0answers
304 views

Apache mod_security crs blocking PDF files

I've just installed CRS for Apache mod_security and it's reporting all PDF files as possible attacks. Specificaly, it's the modsecurity_crs_20_protocol_violations.conf that's causing the trouble ...
1
vote
0answers
640 views

Curl Sourced DDoS: How to detect it & how to stop?

Okay, an Ubuntu server I manage fell victim to a DDoS attack today. Usually this is unpleasant but not that big a deal. A few high server load moments & then it passes. Today was clearly ...
1
vote
0answers
309 views

How to solve UNIQUE_ID variable issue in modsecurity_crs_16_session_hijacking.conf ubuntu 10.04

I have been trying to harden ubuntu 10.04 using modsecurity and its core rules from owasp version 2.2.5. I have used the package from their github . After the symbolic link of the files in the ...
1
vote
0answers
138 views

ModSecurity: What do MULTIPART_DATA_BEFORE and MULTIPART_DATA_AFTER mean?

I'm getting the following ModSecurity error when posting form data to a LiquidWeb server: Multipart request body failed strict validation: PE 0, BQ 0, BW 0, DB 1, DA 1, HF 0, LF 0, SM 0, IQ 0, IP 0, ...
1
vote
0answers
225 views

nginx with fail2ban and mod_security

I forgot to update my fail2ban config for nginx. I just moved to nginx from apache. Today, I got a lot of cals from a single IP. IP tried to access login pages with post and get methods IP tried to ...
1
vote
0answers
608 views

How do I handle apache2 modsecurity2 warnings like Match of “rx ^OPTIONS$” against “REQUEST_METHOD” required?

After upgrade from squeeze to wheezy I get loads of these messages in my apache errorlog when I open a webpage on myserver, (changed to myserver.de here): [Sat Oct 19 01:06:21 2013] [error] [client ...
1
vote
0answers
1k views

ModSecurity: collections_remove_stale: Failed deleting collection

Environment: Ubuntu Server 12.04 64Bit with Apache/2.2.22 (Ubuntu) and Worker mpm with modsecurity 2.7.5 and OWASP CRS latest. Problem: When server is under a load of 1500 concurrent users ...
1
vote
0answers
254 views

apache DirectoryMatch matching filenames

I have the following code in my security.conf file of apache <DirectoryMatch "/(albums|attachment(s)?|upload(s)?)"> Options -ExecCGI <IfModule php5_module> php_flag engine off ...
1
vote
0answers
574 views

short Apache outages (VPS, ModSecurity)

I have a problem with my site recently hosted at Liquidweb, none of their techs seems to be able to solve this issue even after days. Was hoping I could get some help here. Occasionally, my site's ...
1
vote
0answers
285 views

log/dump response body

Is there any way to log response body in Apache 2? I need the exact content that will be sent to user browser. I tried mod_security audit logging, but it won't log response body for all requests. ...
0
votes
0answers
17 views

Remove IP from modsecurity blacklist

I have a CentOS 7.2 server with apache. I installed and configured modsecurity and I did some tests from my home and now my IP si blocked. Where is stored the blacklist for modsecurity? I stopped the ...
0
votes
0answers
35 views

convert modsecurity apache specific rules for nginx

Using ModSecurity with Apache and OWASP CRS there are some rules which use apache specific directives like (in modsecurity_crs_55_application_defects.conf file): Header edit Set-Cookie ...
0
votes
0answers
10 views

Is there a way around Apache HTTPS redirect filtering blocks?

I am currently using a mod_security HTTPS redirect in order to maintain PCI requirements. However, I have noticed that many commercial web filters (i.e. websense) are blocking the site due to a proxy ...
0
votes
0answers
7 views

modsecurity Does not contain custom REDQUEST_HEADER_NAMES

Trying to build a rule that will 403 any incoming traffic that doesn't contain the header X-CFKey and match a specific of X-CFKey. I've got modsecurity testing X-CFKey value successfully but fails ...
0
votes
0answers
16 views

Mosecurity with Nginx logs the 127.0.0.1 as destination

I am using Modsecurity with Nginx. It works and everything is fine unless the modsecurity logs the destination as 127.0.0.1. How can I set the destination with Nginx $proxy_host variable or whatever ...
0
votes
0answers
23 views

Nginx set_real_ip_from clears source port

I am using Modsecurity with Nginx behind another proxy (reverse cache proxy). To have the correct IP addresses of the clients am using ngx_http_realip_module using directives: set_real_ip_from ...
0
votes
0answers
22 views

Modsecurity: How can I consolidate all SecRules to ignore aparameter

How can I consolidate all or any secrule to ignore a parameter with modsecurity? I have a form that will always flag as XSS, unfortunately, my rule list is getting rather large as the site grows. I ...
0
votes
0answers
62 views

Apache mod-security - Deny access from IP addresses listed in a blacklist file

I want to deny access from IP addresses listed in a blacklist file (not realy matters, but the file is /etc/csf/csf.deny). This is my custom rule (at the moment..): SecRule REQUEST_URI ...
0
votes
0answers
25 views

ModSecurity - Matching multiple occurences in XML body

I have the following XML request body: <myMethod> <struct> <member> <name>Member_1</name> ...
0
votes
0answers
96 views

enable PUT with ModSecurity

I'm hosted in a VPS with Inmotionhosting, and I need to expose PUT and DELETE method for a REST API I'm programming. They tell me that if I want to use PUT, I need to disable ModSecurity. I think ...
0
votes
0answers
20 views

ModSecurity shows server ip as source instead of attacker ip

after upgrade to PHP 5.5 and everything works well i found that mod security is logging all attacks with the server ip itself instead of attacker ip !! before upgrade it was showing the attacker ip ...
0
votes
0answers
210 views

After install mod_security and mod_evasive, php not working

I followed this tutorial ( tutorial.centos.com.my/?p=69 ) and got success to install mod_security and mod_evasive. But php does not run, displays the code in the browser. Insert an index.php file in ...
0
votes
0answers
79 views

Apache hangs after on heavy load

I am using apache 2.4.7 in ubuntu14.04 . I am using mod mpm_event in the apache and due to some DOS attack my server got hang after certain time. I am using this default setting for it. StartServers ...
0
votes
0answers
110 views

Apache header order

I am working on a private server application for a web based mobile game that uses php to generate responses. In order to do this I am trying to replicate the behavior of the main server as closely as ...
0
votes
0answers
234 views

prevent phpbb bruteforcing with mod_security

Update: I edited this and added a fail2ban tag. Perhaps that might be another way to handle this issue. I'm running phpbb 3.0.13-PL1 and I would like to protect the login page from bruteforcing. I'm ...
0
votes
0answers
139 views

Server wont let me save URLs to MySQL database?

I am posting here because all other forum say it's a server environ issue. I have a site with the ModX CMS on it hosted on a GoDaddy server (not sure about the specific setup is as client has ...
0
votes
0answers
282 views

Nginx + mod_security without a backend server

I want to start using mod_security for Nginx. However, I have read the official doc and something got my atention: ...
0
votes
0answers
281 views

Modsec: Set env variable based on User-agent

Relatively new to Apache modsec. Trying to do something simple and hitting a wall. I want to set an environment variable based on the User-Agent, and test it by setting a header. I have this: ...
-2
votes
0answers
10 views

Will loading passive content in secure Iframe will show up on all browsers?

Hey we would like to move our site to HTTPS, but the main question is will our passive content that hosted on 3rd party website shown in secure iframe, Example: The page on website is using HTTPS ...