Questions tagged [mod-security]

ModSecurity supplies an array of request and response filtering rules and other security features to the Apache HTTP Server. ModSecurity is an open source web application layer firewall.

Filter by
Sorted by
Tagged with
16 votes
5 answers
18k views

mod_security block requests by http-host header

The last few days I noticed some servers being hammered with unknown requests. Most of them are like the following: 60.246.*.* - - [03/Jan/2015:20:59:16 +0200] "GET /announce.php?info_hash=%80%85%...
Cha0s's user avatar
  • 2,460
14 votes
2 answers
24k views

What are PCRE limits?

In ModSecurity there are PCRE limits exceeded errors. I know I can fix this by setting rules such as: SecPcreMatchLimit 150000 SecPcreMatchLimitRecursion 150000 But, what are these rules actually ...
user avatar
13 votes
4 answers
28k views

mod_security - PCRE limits exceeded

Just about on every request I am getting the following error: Rule execution error - PCRE limits exceeded (-8): (null). After a bunch of googling the only solutions seem to be a) Add the following ...
ParoX's user avatar
  • 302
12 votes
4 answers
35k views

Disable modsecurity For a Specific Directory

How do you disable modsecurity for just a specific directory. I'm getting errors in phpMyAdmin that are caused by modsecurity tripping based on rules. I have the following files set up: # /etc/httpd/...
dragonmantank's user avatar
11 votes
7 answers
51k views

Test whether mod_security is actually working

I'm running this on my staging server for the first time and I think I did everything correctly. I can see entries in modsec_audit.log when I run nikto2 against it, but for the life of me I can't ...
DrZaiusApeLord's user avatar
8 votes
2 answers
15k views

Why does mod_security require an ACCEPT HTTP header field?

After some debugging, I found that the core ruleset of mod_security blocks requests that don't have the (optional!) ACCEPT header field. This is what I find in the logs: ModSecurity: Warning. ...
ripper234's user avatar
  • 6,020
7 votes
2 answers
5k views

Why does modsecurity require Content-Length in POST requests?

I have a RESTful web service that accepts a POST request to a resource without an entity body, e.g. an empty POST request. The default modsecurity configuration requires that all POST requests have a ...
user avatar
7 votes
1 answer
9k views

How to get mod_security to log all POST data?

I currently have a CentOS system that is successfully logging relevant mod_security actions to the audit log file. The following is my configuration: <IfModule mod_security2.c> SecRuleEngine ...
Chris's user avatar
  • 273
6 votes
2 answers
29k views

How do I find out if mod_security is installed on my apache server?

How can I find out if mod_security is installed on my apache server? I would also like to learn its version. I'm having some upload issues and I tried to disable mod_security using .htaccess. But ...
Haluk's user avatar
  • 963
6 votes
2 answers
407 views

Good free guide for mod_security?

I have looked at the official sites documentation, and it is a little tough to find starting points. Is there a free comprehensive guide that is easy to understand for someone that has never dealt ...
Joshua Enfield's user avatar
5 votes
1 answer
9k views

Enable Mod_Security for only one website

Is there a way to dis-able mod-security for all websites? except one? i have more than 500 websites hosted, only want to turn it on for one website, which is having attacks on it.
Farhan's user avatar
  • 4,309
5 votes
1 answer
9k views

how to whitelist a certain cookie string in ModSecurity

We are getting a lot of False Positives from using 3rd part software on our server. They themselves can't seem to fix it and I'm trying to work out how to allow cookies through that contain "...
starchild's user avatar
5 votes
1 answer
1k views

SecAuditLogParts not working: mod_security keeps logging response body

I have set SecAuditLogParts in modsecurity.conf to just log ABFH, but the modsecurity audit log keeps logging -E- part (response body) which makes the audit log too big. What can I do to disable ...
san671's user avatar
  • 51
5 votes
1 answer
1k views

ModSecurity on Apache (Debian Wheezy), Authentication logging

I am new to ModSecurity, it works great on the server, but I would like to control the way it logs things. For example as I am troubleshooting my website in order to whitelist or correct php coding ...
durduvakis's user avatar
5 votes
2 answers
564 views

How to include ModSecurity request final action in the Apache access.log

I'm currently using ModSecurity 2.7 and Apache 2.4.7 on Ubuntu Trusty. I would like to use Apache's LogFormat and CustomLog directives so that I can include a field indicating whether ModSecurity ...
Jason Stangroome's user avatar
4 votes
4 answers
9k views

How to drop all requests using mod_security

I have an apache2 server with several sites enabled on it, including the default one (000default). The default server is catching lots of spammy requests that are doing nothing but consume bandwidth ...
izb's user avatar
  • 191
4 votes
3 answers
20k views

ModSecurity block specific string in request

I want a ModSecurity rule, which block the access to any url or any Body request Post/Get, if it contains a specific string. For example i want to block this string : "km0ae9gr6m" I have this rule ...
Farhan's user avatar
  • 4,309
4 votes
2 answers
8k views

How to exclude ModSecurity rules by hostname?

I'm using OWASP core rule set 3.2.0 set up with ModSecurity 3.0.4 and ModSecurity-nginx. If I have a rule exclusion like this, in REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf: SecRule REQUEST_URI "@...
nnyby's user avatar
  • 298
4 votes
2 answers
429 views

Why bother reverse proxying applications if you aren't using mod_security or TMG/UAG?

Common wisdom is that internal applications that live inside of the trusted network, such as Exchange, should be reverse proxies whenever they are exposed to the Internet. Microsoft recommends using ...
MDMarra's user avatar
  • 101k
4 votes
2 answers
15k views

mod_security not actually blocking requests despite rule trigger & returning 403

I've pulled my finger out and installed mod_security to protect our WHMCS installation (a PHP based billing system) from some of the more obvious SQL injection attacks to try and minimise our ...
Phil's user avatar
  • 1,222
4 votes
2 answers
7k views

modsecurity apache mod-security.conf missing [closed]

Greetings Serverfaultians. I'm not a server guy as you can see from my noob score of 1 point. But maybe those more versed can help me. I'm using Ubuntu v13.10 32-bit Server and Apache2 v2.4.6 and I'm ...
James's user avatar
  • 185
4 votes
3 answers
2k views

Block traffic behind AWS ELB

My web servers are behind ELB, I want to block traffic from some specific user agent which is a DDOS attack. Apache always see ip address of ELB as an end user so I tried below attempts: Blocking IP ...
Deepak Deore's user avatar
4 votes
2 answers
3k views

mod_security ruleset for Joomla! admin

I run several hosting servers and recently I have experienced a lot of bruteforce attacks against joomla-based websites. Attackers seem to try a bruteforce against administrator/index.php page. I ...
godzillante's user avatar
4 votes
2 answers
7k views

modsecurity: block IP address that visited 404 pages more than 10 times in a minute

We're using mod_security and we have currently issues with some bots. I would like to block IP Address that visited 404 pages more than 10 times in a minute. How can this be done? How can I poll the ...
JMW's user avatar
  • 1,473
3 votes
2 answers
27k views

how I can know which version of mod security that I had on the server? and how I can update it? [closed]

I'm using cpanel (11.25 Stable 46156) with mod security installed. How can I know the version of mod security that installed in the server? How can I update mod security manually or make it update ...
Libyano's user avatar
  • 151
3 votes
2 answers
11k views

mod_unique_id: unable to find IPv4 address of FQDN despite setting etc/hosts and Apache ServerName

I'm trying to get mod_security and hit the very common hostname error of [alert] (EAI 2)Name or service not known: mod_unique_id: unable to find IPv4 address of "computername.domain.com" This ...
KCD's user avatar
  • 968
3 votes
1 answer
2k views

Do I really need mod_security?

I'm doing a clean install of my server and I'm looking for some advice on whether or not I actually need the Apache mod_security module. I consider myself to be a bit security paranoid when it comes ...
user avatar
3 votes
3 answers
21k views

How to Disable ModSecurity without any Errors

I've enabled Mod_Security on my VPS which runs an Ubuntu OS with an apache web server. Now, I want to disable it because I setup another firewall to protect my server. I've tried preforming the steps ...
Marc Woodyard's user avatar
3 votes
3 answers
8k views

modsecurity inbound_anomaly_score

I get this error from web server - is this known issue. There is plenty of questions on google -- but not clear solution. [error] [client ] ModSecurity: Warning. Operator LT matched 20 at TX:...
webminal.org's user avatar
3 votes
2 answers
7k views

Blocking repeated http requests in Apache behind a load balancer

I have a number of EC2 servers on AWS running apache behind a load balancer (ELB). Every now and then some IP address abuses the API hosted on the EC2 servers and causes a denial of service. I have no ...
hillel's user avatar
  • 131
3 votes
2 answers
7k views

mod_security 960015 blocks Google and other good bots

mod_security rule 960015 keeps catching Google and other good bots. I have the following in the vhost to prevent good bots from being caught: SecRule REQUEST_HEADERS:User-Agent "Mail.ru" log,allow ...
Vlad's user avatar
  • 61
3 votes
1 answer
101 views

Modifying Apache configuration via a Web Interface

I would like to create a website on my server, which runs Apache2, to allow a user to fill in a form containing a desired subdomain name to be created on the server. For example, a user could go to ...
dgh's user avatar
  • 478
3 votes
1 answer
2k views

Looking for a good web penetration testing client [closed]

I'm implementing mod_security on an apache server. In order to test the effectiveness of the protection, I am looking for a client that can generate a set of predefined malicious HTTP requests. I will ...
Max's user avatar
  • 3,563
3 votes
1 answer
4k views

what is the impact of increasing the SecResponseBodyLimit from default value (512k) to (5M)?

I installed the mod_security version 2.5.13 with apache2 and I'm facing problem with SecResponseBodyLimit: ( ModSecurity: Output filter: Response body too large (over limit of 524288, total not ...
user79483's user avatar
  • 411
3 votes
2 answers
2k views

mod_security IP collection key not being set correctly

I'm using an IP collection in a load balanced setup, I therefor want mod_security to act on the x-forwarded for header instead of the REMOTE_ADDR. Here is my rule: SecAction "phase:1,nolog,pass,...
Caseus's user avatar
  • 73
3 votes
2 answers
6k views

ModSecurity not working on IIS

I've installed the ModSecurity IIS module on a Windows Server 2012 VM. I have a simple test application running on its own app pool. default.aspx -- Just a simple page that spits out the date/time. ...
Josh M.'s user avatar
  • 688
3 votes
1 answer
5k views

Apache cannot access mod_security log

I have an Apache2 server that cannot access the mod-security log: [email protected]:~$ apachectl -V AH00526: Syntax error on line 196 of /etc/modsecurity/modsecurity.conf: ModSecurity: Failed to open the ...
caliph's user avatar
  • 213
3 votes
1 answer
2k views

Linux, apache2, modsecurity blocks Google reCAPTCHA variables

I have a Debian Jessie box, Apache 2.4 and default mod_security enabled with base rules activated. When I try to implement a Google reCAPTCHA solution in a PHP code, modsecurity blocks page with ...
JackD's user avatar
  • 43
3 votes
1 answer
2k views

Can mod_security only log triggered rules if the request was blocked?

I've installed mod_security and I'm currently running in DetectionOnly mode as I monitor logs and configure to suit my servers needs. I've set it up for anomaly scoring and tweaked my scores ...
AJReading's user avatar
  • 153
3 votes
1 answer
390 views

ModSecurity on IIS: Single threaded?

I installed ModSecurity on a web server running IIS 8.5, and noticed the response time has increased 15 times (0.15 ms/request vs. 2.2 ms/request), even with SecEngine set to off. It seems that IIS is ...
Jim's user avatar
  • 651
3 votes
1 answer
2k views

Where I can find ModSecurity Rules for Specific Applications [closed]

Where I can find ModSecurity Rules for Specific Applications specially joomla, wordpress, mambo ?
Libyano's user avatar
  • 151
3 votes
1 answer
1k views

Apache 2.2 / CentOS: Denying Bad Bots

I'm having all kinds of problems trying to restrict bad bots on my Apache 2.2 server, and am hoping somebody can assist. I have banged my head on the wall for days trying to get this working, and ...
Cheddar's user avatar
  • 131
3 votes
1 answer
4k views

What do the audit log records for ModSecurity actually mean?

We have ModSecurity setup to log to modsec_audit.log for Apache2. Today we have had 2259 entries created in this log with a referrer of: Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/...
Linnay's user avatar
  • 33
3 votes
0 answers
77 views

Efficient and comfortable mod_security monitoring with sentry.io or similar tools? [closed]

When using mod_security one might drown in error reports. sentry is a comfortable tool to monitor software errors, sort them, ignore unimportant ones and so on. I was wondering if it is possible to ...
Alex's user avatar
  • 726
3 votes
0 answers
486 views

How to make mod_remoteip and mod_evasive work together

I have several Cento7 machines running Apache 2.4. They are behind a load balancer. The load balancer pass X-Forwarded-For header with client IP. In order to have mod_evasive to use the real client IP,...
user3908406's user avatar
3 votes
1 answer
3k views

Mod Security ctl:ruleEngine=Off Whitelist Fails in Phase 1 [closed]

mod_security with custom rules and whitelists in separate .conf files - Apache 2.2, modsec 2.8 Whitelist rule: SecRule REMOTE_ADDR "^10\.10\.10\.10" phase:1,nolog,allow,ctl:ruleEngine=Off,id:104008 ...
Santrix's user avatar
  • 263
3 votes
0 answers
1k views

How to filter POST data with mod_security when type is text/xml?

I'm trying to craft a rule which would match certain regex in POST requests. Rule I have so far looks like; SecRule REQUEST_FILENAME "form.php" \ "id:'12345',chain,deny,status:406,log,msg:'foobar ...
Hrvoje Špoljar's user avatar
3 votes
1 answer
944 views

ModSecurity: What do MULTIPART_DATA_BEFORE and MULTIPART_DATA_AFTER mean?

I'm getting the following ModSecurity error when posting form data to a LiquidWeb server: Multipart request body failed strict validation: PE 0, BQ 0, BW 0, DB 1, DA 1, HF 0, LF 0, SM 0, IQ 0, IP 0, ...
bradt's user avatar
  • 131
3 votes
2 answers
1k views

Mod_security Logging

Im trying to run mod_security as standalone service with nginx as reverse proxy everything works fine except logging. Mod_security logs reverse proxys ip addres instead of clients ip address. I would ...
Hex's user avatar
  • 1,969
2 votes
5 answers
3k views

500 Internal Server Error when adding a line in the .htaccess file

I need to add the following line into my .htaccess file in order to get my website working with mod_security SecFilterScanPOST Off but then I get an error Internal Server Error The server ...
Elitmiar's user avatar
  • 785

1
2 3 4 5
7