Questions tagged [mod-security]
ModSecurity supplies an array of request and response filtering rules and other security features to the Apache HTTP Server. ModSecurity is an open source web application layer firewall.
344
questions
16
votes
5
answers
18k
views
mod_security block requests by http-host header
The last few days I noticed some servers being hammered with unknown requests.
Most of them are like the following:
60.246.*.* - - [03/Jan/2015:20:59:16 +0200] "GET /announce.php?info_hash=%80%85%...
14
votes
2
answers
24k
views
What are PCRE limits?
In ModSecurity there are PCRE limits exceeded errors.
I know I can fix this by setting rules such as:
SecPcreMatchLimit 150000
SecPcreMatchLimitRecursion 150000
But, what are these rules actually ...
13
votes
4
answers
28k
views
mod_security - PCRE limits exceeded
Just about on every request I am getting the following error:
Rule execution error - PCRE limits exceeded (-8): (null).
After a bunch of googling the only solutions seem to be
a) Add the following ...
12
votes
4
answers
35k
views
Disable modsecurity For a Specific Directory
How do you disable modsecurity for just a specific directory. I'm getting errors in phpMyAdmin that are caused by modsecurity tripping based on rules. I have the following files set up:
# /etc/httpd/...
11
votes
7
answers
51k
views
Test whether mod_security is actually working
I'm running this on my staging server for the first time and I think I did everything correctly. I can see entries in modsec_audit.log when I run nikto2 against it, but for the life of me I can't ...
8
votes
2
answers
15k
views
Why does mod_security require an ACCEPT HTTP header field?
After some debugging, I found that the core ruleset of mod_security blocks requests that don't have the (optional!) ACCEPT header field.
This is what I find in the logs:
ModSecurity: Warning. ...
7
votes
2
answers
5k
views
Why does modsecurity require Content-Length in POST requests?
I have a RESTful web service that accepts a POST request to a resource without an entity body, e.g. an empty POST request. The default modsecurity configuration requires that all POST requests have a ...
7
votes
1
answer
9k
views
How to get mod_security to log all POST data?
I currently have a CentOS system that is successfully logging relevant mod_security actions to the audit log file. The following is my configuration:
<IfModule mod_security2.c>
SecRuleEngine ...
6
votes
2
answers
29k
views
How do I find out if mod_security is installed on my apache server?
How can I find out if mod_security is installed on my apache server? I would also like to learn its version.
I'm having some upload issues and I tried to disable mod_security using .htaccess. But ...
6
votes
2
answers
407
views
Good free guide for mod_security?
I have looked at the official sites documentation, and it is a little tough to find starting points.
Is there a free comprehensive guide that is easy to understand for someone that has never dealt ...
5
votes
1
answer
9k
views
Enable Mod_Security for only one website
Is there a way to dis-able mod-security for all websites? except one?
i have more than 500 websites hosted, only want to turn it on for one website, which is having attacks on it.
5
votes
1
answer
9k
views
how to whitelist a certain cookie string in ModSecurity
We are getting a lot of False Positives from using 3rd part software on our server. They themselves can't seem to fix it and I'm trying to work out how to allow cookies through that contain "...
5
votes
1
answer
1k
views
SecAuditLogParts not working: mod_security keeps logging response body
I have set SecAuditLogParts in modsecurity.conf to just log ABFH, but the modsecurity audit log keeps logging -E- part (response body) which makes the audit log too big.
What can I do to disable ...
5
votes
1
answer
1k
views
ModSecurity on Apache (Debian Wheezy), Authentication logging
I am new to ModSecurity, it works great on the server, but I would like to control the way it logs things. For example as I am troubleshooting my website in order to whitelist or correct php coding ...
5
votes
2
answers
564
views
How to include ModSecurity request final action in the Apache access.log
I'm currently using ModSecurity 2.7 and Apache 2.4.7 on Ubuntu Trusty.
I would like to use Apache's LogFormat and CustomLog directives so that I can include a field indicating whether ModSecurity ...
4
votes
4
answers
9k
views
How to drop all requests using mod_security
I have an apache2 server with several sites enabled on it, including the default one (000default). The default server is catching lots of spammy requests that are doing nothing but consume bandwidth ...
4
votes
3
answers
20k
views
ModSecurity block specific string in request
I want a ModSecurity rule, which block the access to any url or any Body request Post/Get, if it contains a specific string.
For example i want to block this string : "km0ae9gr6m"
I have this rule ...
4
votes
2
answers
8k
views
How to exclude ModSecurity rules by hostname?
I'm using OWASP core rule set 3.2.0 set up with ModSecurity 3.0.4 and ModSecurity-nginx.
If I have a rule exclusion like this, in REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf:
SecRule REQUEST_URI "@...
4
votes
2
answers
429
views
Why bother reverse proxying applications if you aren't using mod_security or TMG/UAG?
Common wisdom is that internal applications that live inside of the trusted network, such as Exchange, should be reverse proxies whenever they are exposed to the Internet. Microsoft recommends using ...
4
votes
2
answers
15k
views
mod_security not actually blocking requests despite rule trigger & returning 403
I've pulled my finger out and installed mod_security to protect our WHMCS installation (a PHP based billing system) from some of the more obvious SQL injection attacks to try and minimise our ...
4
votes
2
answers
7k
views
modsecurity apache mod-security.conf missing [closed]
Greetings Serverfaultians. I'm not a server guy as you can see from my noob score of 1 point. But maybe those more versed can help me.
I'm using Ubuntu v13.10 32-bit Server and Apache2 v2.4.6 and I'm ...
4
votes
3
answers
2k
views
Block traffic behind AWS ELB
My web servers are behind ELB, I want to block traffic from some specific user agent which is a DDOS attack. Apache always see ip address of ELB as an end user so I tried below attempts:
Blocking IP ...
4
votes
2
answers
3k
views
mod_security ruleset for Joomla! admin
I run several hosting servers and recently I have experienced a lot of bruteforce attacks against joomla-based websites. Attackers seem to try a bruteforce against administrator/index.php page.
I ...
4
votes
2
answers
7k
views
modsecurity: block IP address that visited 404 pages more than 10 times in a minute
We're using mod_security and we have currently issues with some bots.
I would like to block IP Address that visited 404 pages more than 10 times in a minute.
How can this be done? How can I poll the ...
3
votes
2
answers
27k
views
how I can know which version of mod security that I had on the server? and how I can update it? [closed]
I'm using cpanel (11.25 Stable 46156) with mod security installed. How can I know the version of mod security that installed in the server?
How can I update mod security manually or make it update ...
3
votes
2
answers
11k
views
mod_unique_id: unable to find IPv4 address of FQDN despite setting etc/hosts and Apache ServerName
I'm trying to get mod_security and hit the very common hostname error of
[alert] (EAI 2)Name or service not known: mod_unique_id: unable to find IPv4 address of "computername.domain.com"
This ...
3
votes
1
answer
2k
views
Do I really need mod_security?
I'm doing a clean install of my server and I'm looking for some advice on whether or not I actually need the Apache mod_security module.
I consider myself to be a bit security paranoid when it comes ...
3
votes
3
answers
21k
views
How to Disable ModSecurity without any Errors
I've enabled Mod_Security on my VPS which runs an Ubuntu OS with an apache web server. Now, I want to disable it because I setup another firewall to protect my server.
I've tried preforming the steps ...
3
votes
3
answers
8k
views
modsecurity inbound_anomaly_score
I get this error from web server - is this known issue. There is plenty of questions on google -- but not clear solution.
[error] [client ] ModSecurity: Warning. Operator LT matched 20 at TX:...
3
votes
2
answers
7k
views
Blocking repeated http requests in Apache behind a load balancer
I have a number of EC2 servers on AWS running apache behind a load balancer (ELB). Every now and then some IP address abuses the API hosted on the EC2 servers and causes a denial of service. I have no ...
3
votes
2
answers
7k
views
mod_security 960015 blocks Google and other good bots
mod_security rule 960015 keeps catching Google and other good bots. I have the following in the vhost to prevent good bots from being caught:
SecRule REQUEST_HEADERS:User-Agent "Mail.ru" log,allow
...
3
votes
1
answer
101
views
Modifying Apache configuration via a Web Interface
I would like to create a website on my server, which runs Apache2, to allow a user to fill in a form containing a desired subdomain name to be created on the server. For example, a user could go to ...
3
votes
1
answer
2k
views
Looking for a good web penetration testing client [closed]
I'm implementing mod_security on an apache server. In order to test the effectiveness of the protection, I am looking for a client that can generate a set of predefined malicious HTTP requests. I will ...
3
votes
1
answer
4k
views
what is the impact of increasing the SecResponseBodyLimit from default value (512k) to (5M)?
I installed the mod_security version 2.5.13 with apache2 and I'm facing problem with SecResponseBodyLimit:
( ModSecurity: Output filter: Response body too large (over limit of 524288, total not ...
3
votes
2
answers
2k
views
mod_security IP collection key not being set correctly
I'm using an IP collection in a load balanced setup, I therefor want mod_security to act on the x-forwarded for header instead of the REMOTE_ADDR. Here is my rule:
SecAction "phase:1,nolog,pass,...
3
votes
2
answers
6k
views
ModSecurity not working on IIS
I've installed the ModSecurity IIS module on a Windows Server 2012 VM. I have a simple test application running on its own app pool.
default.aspx -- Just a simple page that spits out the date/time.
...
3
votes
1
answer
5k
views
Apache cannot access mod_security log
I have an Apache2 server that cannot access the mod-security log:
[email protected]:~$ apachectl -V
AH00526: Syntax error on line 196 of /etc/modsecurity/modsecurity.conf:
ModSecurity: Failed to open the ...
3
votes
1
answer
2k
views
Linux, apache2, modsecurity blocks Google reCAPTCHA variables
I have a Debian Jessie box, Apache 2.4 and default mod_security enabled with base rules activated.
When I try to implement a Google reCAPTCHA solution in a PHP code, modsecurity blocks page with ...
3
votes
1
answer
2k
views
Can mod_security only log triggered rules if the request was blocked?
I've installed mod_security and I'm currently running in DetectionOnly mode as I monitor logs and configure to suit my servers needs.
I've set it up for anomaly scoring and tweaked my scores ...
3
votes
1
answer
390
views
ModSecurity on IIS: Single threaded?
I installed ModSecurity on a web server running IIS 8.5, and noticed the response time has increased 15 times (0.15 ms/request vs. 2.2 ms/request), even with SecEngine set to off. It seems that IIS is ...
3
votes
1
answer
2k
views
Where I can find ModSecurity Rules for Specific Applications [closed]
Where I can find ModSecurity Rules for Specific Applications specially joomla, wordpress, mambo ?
3
votes
1
answer
1k
views
Apache 2.2 / CentOS: Denying Bad Bots
I'm having all kinds of problems trying to restrict bad bots on my Apache 2.2 server, and am hoping somebody can assist.
I have banged my head on the wall for days trying to get this working, and ...
3
votes
1
answer
4k
views
What do the audit log records for ModSecurity actually mean?
We have ModSecurity setup to log to modsec_audit.log for Apache2. Today we have had 2259 entries created in this log with a referrer of:
Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/...
3
votes
0
answers
77
views
Efficient and comfortable mod_security monitoring with sentry.io or similar tools? [closed]
When using mod_security one might drown in error reports.
sentry is a comfortable tool to monitor software errors, sort them, ignore unimportant ones and so on.
I was wondering if it is possible to ...
3
votes
0
answers
486
views
How to make mod_remoteip and mod_evasive work together
I have several Cento7 machines running Apache 2.4. They are behind a load balancer. The load balancer pass X-Forwarded-For header with client IP. In order to have mod_evasive to use the real client IP,...
3
votes
1
answer
3k
views
Mod Security ctl:ruleEngine=Off Whitelist Fails in Phase 1 [closed]
mod_security with custom rules and whitelists in separate .conf files - Apache 2.2, modsec 2.8
Whitelist rule:
SecRule REMOTE_ADDR "^10\.10\.10\.10" phase:1,nolog,allow,ctl:ruleEngine=Off,id:104008
...
3
votes
0
answers
1k
views
How to filter POST data with mod_security when type is text/xml?
I'm trying to craft a rule which would match certain regex in POST requests.
Rule I have so far looks like;
SecRule REQUEST_FILENAME "form.php" \
"id:'12345',chain,deny,status:406,log,msg:'foobar ...
3
votes
1
answer
944
views
ModSecurity: What do MULTIPART_DATA_BEFORE and MULTIPART_DATA_AFTER mean?
I'm getting the following ModSecurity error when posting form data to a LiquidWeb server:
Multipart request body failed strict validation: PE 0, BQ 0, BW 0, DB 1, DA 1, HF 0, LF 0, SM 0, IQ 0, IP 0, ...
3
votes
2
answers
1k
views
Mod_security Logging
Im trying to run mod_security as standalone service with nginx as reverse proxy everything works fine except logging. Mod_security logs reverse proxys ip addres instead of clients ip address.
I would ...
2
votes
5
answers
3k
views
500 Internal Server Error when adding a line in the .htaccess file
I need to add the following line into my .htaccess file in order to get my website working with mod_security
SecFilterScanPOST Off
but then I get an error
Internal Server Error
The server ...