ModSecurity supplies an array of request filtering and other security features to the Apache HTTP Server. ModSecurity is a web application layer firewall.

learn more… | top users | synonyms

5
votes
1answer
2k views

What are PCRE limits?

In ModSecurity there are PCRE limits exceeded errors. I know I can fix this by setting rules such as: SecPcreMatchLimit 150000 SecPcreMatchLimitRecursion 150000 But, what are these rules actually ...
5
votes
2answers
316 views

Good free guide for mod_security?

I have looked at the official sites documentation, and it is a little tough to find starting points. Is there a free comprehensive guide that is easy to understand for someone that has never dealt ...
4
votes
2answers
82 views

Why bother reverse proxying applications if you aren't using mod_security or TMG/UAG?

Common wisdom is that internal applications that live inside of the trusted network, such as Exchange, should be reverse proxies whenever they are exposed to the Internet. Microsoft recommends using ...
4
votes
2answers
5k views

mod_security - PCRE limits exceeded

Just about on every request I am getting the following error: Rule execution error - PCRE limits exceeded (-8): (null). After a bunch of googling the only solutions seem to be a) Add the following ...
4
votes
2answers
8k views

How do I find out if mod_security is installed on my apache server?

How can I find out if mod_security is installed on my apache server? I would also like to learn its version. I'm having some upload issues and I tried to disable mod_security using .htaccess. But ...
4
votes
0answers
198 views

ModSecurity on Apache (Debian Wheezy), Authentication logging

I am new to ModSecurity, it works great on the server, but I would like to control the way it logs things. For example as I am troubleshooting my website in order to whitelist or correct php coding ...
3
votes
1answer
68 views

Modifying Apache configuration via a Web Interface

I would like to create a website on my server, which runs Apache2, to allow a user to fill in a form containing a desired subdomain name to be created on the server. For example, a user could go to ...
3
votes
1answer
352 views

Looking for a good web penetration testing client

I'm implementing mod_security on an apache server. In order to test the effectiveness of the protection, I am looking for a client that can generate a set of predefined malicious HTTP requests. I will ...
3
votes
1answer
550 views

modsecurity: block ips, that visited 404 pages more than 10 times in a minute

we're using mod_security and we have currently issues with some bots. i would like to block ips, that visited 404 pages more than 10 times in a minute. How can this be done? How can i poll the 404 ...
3
votes
2answers
219 views

Mod_security Logging

Im trying to run mod_security as standalone service with nginx as reverse proxy everything works fine except logging. Mod_security logs reverse proxys ip addres instead of clients ip address. I would ...
2
votes
2answers
5k views

mod_unique_id: unable to find IPv4 address of FQDN despite setting etc/hosts and Apache ServerName

I'm trying to get mod_security and hit the very common hostname error of [alert] (EAI 2)Name or service not known: mod_unique_id: unable to find IPv4 address of "computername.domain.com" This ...
2
votes
1answer
515 views

Enable Mod_Security for only one website

Is there a way to dis-able mod-security for all websites? except one? i have more than 500 websites hosted, only want to turn it on for one website, which is having attacks on it.
2
votes
1answer
594 views

Do I really need mod_security?

I'm doing a clean install of my server and I'm looking for some advice on whether or not I actually need the Apache mod_security module. I consider myself to be a bit security paranoid when it comes ...
2
votes
2answers
747 views

what is the impact of increasing the SecResponseBodyLimit from default value (512k) to (5M)?

I installed the mod_security version 2.5.13 with apache2 and I'm facing problem with SecResponseBodyLimit: ( ModSecurity: Output filter: Response body too large (over limit of 524288, total not ...
2
votes
2answers
49 views

mod_security 960015 blocks Google and other good bots

mod_security rule 960015 keeps catching Google and other good bots. I have the following in the vhost to prevent good bots from being caught: SecRule REQUEST_HEADERS:User-Agent "Mail.ru" log,allow ...
2
votes
2answers
25 views

How to use Modsec rules to certain page?

i want to block proxy(x-forwarded) ip certain page(wp-comments-post.php) using Apache Mod_security. my current mod_security rule: SecRule REQUEST_HEADERS_NAMES "^x-forwarded-for" ...
2
votes
2answers
754 views

mod_security not actually blocking requests despite rule trigger & returning 403

I've pulled my finger out and installed mod_security to protect our WHMCS installation (a PHP based billing system) from some of the more obvious SQL injection attacks to try and minimise our ...
2
votes
1answer
486 views

why use apache's LoadFile?

Installing mod_security, the instructions direct us to add: LoadFile /usr/lib/libxml2.so LoadFile /usr/lib/liblua5.1.so to httpd.conf. I'm wondering why they might prefer LoadFile to linking with ...
2
votes
1answer
2k views

Why does mod_security require an ACCEPT HTTP header field?

After some debugging, I found that the core ruleset of mod_security blocks requests that don't have the (optional!) ACCEPT header field. This is what I find in the logs: ModSecurity: Warning. ...
2
votes
1answer
1k views

Why Is ModSecurity Unable to Access the Data Directory?

Update I think we've solved this; the problem appears to have been a result of the /modsec_storage directory having an incorrect value for its SELinux context type. However, we're still not sure, ...
2
votes
0answers
62 views

.htaccess ignored two layers deep on only some hosting plans [closed]

I have one .htaccess file doing this: RewriteRule ^system(.*)$ /system/app/$1 [QSA,L] ...and then underneath /system/app, I have another .htaccess file doing this: RewriteCond %{REQUEST_FILENAME} ...
2
votes
0answers
100 views

Custom collections with mod_security

I would like to create a mod_security collection that is based on something other than the user's IP, Session ID, or username. Specifically, based on the REQUEST_URI. However, mod_security indicates ...
2
votes
1answer
1k views

Where I can find ModSecurity Rules for Specific Applications

Where I can find ModSecurity Rules for Specific Applications specially joomla, wordpress, mambo ?
1
vote
3answers
1k views

How to drop all requests using mod_security

I have an apache2 server with several sites enabled on it, including the default one (000default). The default server is catching lots of spammy requests that are doing nothing but consume bandwidth ...
1
vote
2answers
210 views

Blocking bad bots

I found this script and was wondering if this is just overkill and even worth using? Is it better for me to just use mod_security? # Generated using http://solidshellsecurity.com services # Begin ...
1
vote
2answers
719 views

error: libxml2 is required (modsecurity)

I am trying to install mod_security from source. when i run ./configure I get this error: configure: error: libxml2 is required After that error, I executed this command: yum install libxml2 It ...
1
vote
1answer
385 views

What web application firewall do you use? What should I use?

What web application firewall do you use? I'm primarily interested in something I can deploy on the perimeter that can protect multiple Apache and IIS servers, but I'd like to hear all answers. Tell ...
1
vote
3answers
2k views

modsecurity inbound_anomaly_score

I get this error from web server - is this known issue. There is plenty of questions on google -- but not clear solution. [error] [client ] ModSecurity: Warning. Operator LT matched 20 at ...
1
vote
1answer
283 views

Configuring mod_security on Ubuntu 10.04

After spending ~24 hours trying and failing to setup mod_security in Ubuntu 10.04 LTS, I've finally decided that I'm going to need some help. I've tried pretty much every tutorial I can find with a ...
1
vote
1answer
282 views

Limit mod_security rule to one vhost only

I run several domains (via vhosts) with the same apache installation. Some domains require different mod_security rules than the others. In a seperate exceptions.conf file I collect all those rules ...
1
vote
1answer
202 views

mod_security: track user to check if redirected to login failed page

I have to log when a user fails to log in to a web application. Unfortunately, this web application is not able to do this out of the box and I can not change it. Now I'm experimenting with ...
1
vote
1answer
579 views

mod_security never tells what the problem is

Normally I would just pester my provider to disable the rule. And while he certainly deserves pestering, I've done that way too often already for the low service price. (Like always this is about a ...
1
vote
2answers
564 views

mod_security IP collection key not being set correctly

I'm using an IP collection in a load balanced setup, I therefor want mod_security to act on the x-forwarded for header instead of the REMOTE_ADDR. Here is my rule: SecAction ...
1
vote
1answer
1k views

How to disable mod_security2 rule (false positive) for one domain on centos 5

Hi I have mod_security enabled on a centos5 server and one of the rules is keeping a user from posting some text on a form. The text is legitimate but it has the words 'create' and an html ...
1
vote
0answers
39 views

Curl Sourced DDoS: How to detect it & how to stop?

Okay, an Ubuntu server I manage fell victim to a DDoS attack today. Usually this is unpleasant but not that big a deal. A few high server load moments & then it passes. Today was clearly ...
1
vote
0answers
27 views

ModSecurity: What do MULTIPART_DATA_BEFORE and MULTIPART_DATA_AFTER mean?

I'm getting the following ModSecurity error when posting form data to a LiquidWeb server: Multipart request body failed strict validation: PE 0, BQ 0, BW 0, DB 1, DA 1, HF 0, LF 0, SM 0, IQ 0, IP 0, ...
1
vote
0answers
85 views

nginx with fail2ban and mod_security

I forgot to update my fail2ban config for nginx. I just moved to nginx from apache. Today, I got a lot of cals from a single IP. IP tried to access login pages with post and get methods IP tried to ...
1
vote
0answers
139 views

How do I handle apache2 modsecurity2 warnings like Match of “rx ^OPTIONS$” against “REQUEST_METHOD” required?

After upgrade from squeeze to wheezy I get loads of these messages in my apache errorlog when I open a webpage on myserver, (changed to myserver.de here): [Sat Oct 19 01:06:21 2013] [error] [client ...
1
vote
0answers
271 views

ModSecurity: collections_remove_stale: Failed deleting collection

Environment: Ubuntu Server 12.04 64Bit with Apache/2.2.22 (Ubuntu) and Worker mpm with modsecurity 2.7.5 and OWASP CRS latest. Problem: When server is under a load of 1500 concurrent users ...
1
vote
1answer
276 views

Setting up mod_security for phpmyadmin on 12.04

Having issues with mod_security blocking functions of phpmyadmin such as server_databases.php, as sql injection attacks. Is there a way to correct this, or do I need to disable mod_security totally ...
1
vote
0answers
41 views

mod_security to Inspect Post Variables

Can mod_security be used to inspect post variables? It looks like I can through turning SecRequestBodyAccess. I would like to check the username POST field from a form in wp-login.php. If it's value ...
1
vote
0answers
311 views

short Apache outages (VPS, ModSecurity)

I have a problem with my site recently hosted at Liquidweb, none of their techs seems to be able to solve this issue even after days. Was hoping I could get some help here. Occasionally, my site's ...
1
vote
1answer
172 views

Mod_security2 and clamav to catch malicious files on upload

Is there a clear documentation to describe the solution? It's very common and also necessary.
1
vote
0answers
47 views

log/dump response body

Is there any way to log response body in Apache 2? I need the exact content that will be sent to user browser. I tried mod_security audit logging, but it won't log response body for all requests. ...
1
vote
1answer
285 views

Dropping incoming requests for a specific file with iptables

Server is a standard LAMP stack configured via cpanel on CentOS 5.9. We have one file, call it bad.php, on one of our domains that is mistakenly being accessed about 10 times a second by a service ...
1
vote
1answer
210 views

Does ModSecurity 2.7.1 work with ASP.NET MVC 3?

I'm trying to get ModSecurity 2.7.1 to work with an ASP.NET MVC 3 website. The installation ran without errors and looking at the event log, ModSecurity is starting up successfully. I am using the ...
1
vote
0answers
414 views

mod_security2.so: undefined symbol: ap_unixd_set_gl

service httpd restart Stopping httpd: [ OK ] Starting httpd: httpd: Syntax error on line 205 of /etc/httpd/conf/httpd.conf: Cannot load ...
1
vote
1answer
310 views

What do the audit log records for ModSecurity actually mean?

We have ModSecurity setup to log to modsec_audit.log for Apache2. Today we have had 2259 entries created in this log with a referrer of: Mozilla/5.0 (compatible; bingbot/2.0; ...
1
vote
2answers
1k views

How do I enable mod_security in Ubuntu 10.04?

A quick run through of what I've done: apt-get install libapache-mod-security a2enmod mod-security create /etc/apache2/mod_security_rules/ with base_rules and optional_rules from the latest core ...
1
vote
2answers
280 views

Where does Ubuntu 10.04 store the configuration file of mod-security?

I've installed libapache-mod-security on Ubuntu 10.04. The only configuration file I've been able to find is this one: cat /var/lib/dpkg/info/libapache-mod-security.conffiles ...