ModSecurity supplies an array of request filtering and other security features to the Apache HTTP Server. ModSecurity is a web application layer firewall.
4
votes
2answers
3k views
mod_security - PCRE limits exceeded
Just about on every request I am getting the following error:
Rule execution error - PCRE limits exceeded (-8): (null).
After a bunch of googling the only solutions seem to be
a) Add the following ...
4
votes
1answer
6k views
How do I find out if mod_security is installed on my apache server?
How can I find out if mod_security is installed on my apache server? I would also like to learn its version.
I'm having some upload issues and I tried to disable mod_security using .htaccess. But ...
4
votes
2answers
300 views
Good free guide for mod_security?
I have looked at the official sites documentation, and it is a little tough to find starting points.
Is there a free comprehensive guide that is easy to understand for someone that has never dealt ...
3
votes
1answer
62 views
Modifying Apache configuration via a Web Interface
I would like to create a website on my server, which runs Apache2, to allow a user to fill in a form containing a desired subdomain name to be created on the server. For example, a user could go to ...
3
votes
1answer
273 views
Looking for a good web penetration testing client
I'm implementing mod_security on an apache server. In order to test the effectiveness of the protection, I am looking for a client that can generate a set of predefined malicious HTTP requests. I will ...
3
votes
1answer
363 views
modsecurity: block ips, that visited 404 pages more than 10 times in a minute
we're using mod_security and we have currently issues with some bots.
i would like to block ips, that visited 404 pages more than 10 times in a minute.
How can this be done? How can i poll the 404 ...
3
votes
2answers
158 views
Mod_security Logging
Im trying to run mod_security as standalone service with nginx as reverse proxy everything works fine except logging. Mod_security logs reverse proxys ip addres instead of clients ip address.
I would ...
2
votes
2answers
4k views
mod_unique_id: unable to find IPv4 address of FQDN despite setting etc/hosts and Apache ServerName
I'm trying to get mod_security and hit the very common hostname error of
[alert] (EAI 2)Name or service not known: mod_unique_id: unable to find IPv4 address of "computername.domain.com"
This ...
2
votes
1answer
96 views
Enable Mod_Security for only one website
Is there a way to dis-able mod-security for all websites? except one?
i have more than 500 websites hosted, only want to turn it on for one website, which is having attacks on it.
2
votes
1answer
505 views
Do I really need mod_security?
I'm doing a clean install of my server and I'm looking for some advice on whether or not I actually need the Apache mod_security module.
I consider myself to be a bit security paranoid when it comes ...
2
votes
2answers
475 views
what is the impact of increasing the SecResponseBodyLimit from default value (512k) to (5M)?
I installed the mod_security version 2.5.13 with apache2 and I'm facing problem with SecResponseBodyLimit:
( ModSecurity: Output filter: Response body too large (over limit of 524288, total not ...
2
votes
1answer
333 views
why use apache's LoadFile?
Installing mod_security, the instructions direct us to add:
LoadFile /usr/lib/libxml2.so
LoadFile /usr/lib/liblua5.1.so
to httpd.conf.
I'm wondering why they might prefer LoadFile to linking with ...
2
votes
1answer
1k views
Why Is ModSecurity Unable to Access the Data Directory?
Update I think we've solved this; the problem appears to have been a result of the /modsec_storage directory having an incorrect value for its SELinux context type.
However, we're still not sure, ...
2
votes
0answers
53 views
.htaccess ignored two layers deep on only some hosting plans [closed]
I have one .htaccess file doing this:
RewriteRule ^system(.*)$ /system/app/$1 [QSA,L]
...and then underneath /system/app, I have another .htaccess file doing this:
RewriteCond %{REQUEST_FILENAME} ...
2
votes
0answers
73 views
Custom collections with mod_security
I would like to create a mod_security collection that is based on something other than the user's IP, Session ID, or username. Specifically, based on the REQUEST_URI. However, mod_security indicates ...
2
votes
1answer
488 views
Where I can find ModSecurity Rules for Specific Applications
Where I can find ModSecurity Rules for Specific Applications specially joomla, wordpress, mambo ?
2
votes
1answer
859 views
Why does mod_security require an ACCEPT HTTP header field?
After some debugging, I found that the core ruleset of mod_security blocks requests that don't have the (optional!) ACCEPT header field.
This is what I find in the logs:
ModSecurity: Warning. ...
1
vote
3answers
443 views
How to drop all requests using mod_security
I have an apache2 server with several sites enabled on it, including the default one (000default). The default server is catching lots of spammy requests that are doing nothing but consume bandwidth ...
1
vote
2answers
343 views
error: libxml2 is required (modsecurity)
I am trying to install mod_security from source. when i run ./configure I get this error:
configure: error: libxml2 is required
After that error, I executed this command:
yum install libxml2
It ...
1
vote
1answer
660 views
What are PCRE limits?
In ModSecurity there are PCRE limits exceeded errors.
I know I can fix this by setting rules such as:
SecPcreMatchLimit 150000
SecPcreMatchLimitRecursion 150000
But, what are these rules actually ...
1
vote
1answer
343 views
What web application firewall do you use? What should I use?
What web application firewall do you use? I'm primarily interested in something I can deploy on the perimeter that can protect multiple Apache and IIS servers, but I'd like to hear all answers. Tell ...
1
vote
3answers
1k views
modsecurity inbound_anomaly_score
I get this error from web server - is this known issue. There is plenty of questions on google -- but not clear solution.
[error] [client ] ModSecurity: Warning. Operator LT matched 20 at ...
1
vote
1answer
37 views
Limit mod_security rule to one vhost only
I run several domains (via vhosts) with the same apache installation. Some domains require different mod_security rules than the others. In a seperate exceptions.conf file I collect all those rules ...
1
vote
1answer
163 views
mod_security: track user to check if redirected to login failed page
I have to log when a user fails to log in to a web application. Unfortunately, this web application is not able to do this out of the box and I can not change it.
Now I'm experimenting with ...
1
vote
1answer
269 views
Configuring mod_security on Ubuntu 10.04
After spending pretty much a non-stop 24 hours trying and failing to setup mod_security in Ubuntu 10.04 LTS - I've finally decided that I'm going to need some help (and so asked here).
I've tried ...
1
vote
1answer
452 views
mod_security never tells what the problem is
Normally I would just pester my provider to disable the rule. And while he certainly deserves pestering, I've done that way too often already for the low service price.
(Like always this is about a ...
1
vote
2answers
410 views
mod_security IP collection key not being set correctly
I'm using an IP collection in a load balanced setup, I therefor want mod_security to act on the x-forwarded for header instead of the REMOTE_ADDR. Here is my rule:
SecAction ...
1
vote
0answers
43 views
short Apache outages (VPS, ModSecurity)
I have a problem with my site recently hosted at Liquidweb, none of their techs seems to be able to solve this issue even after days. Was hoping I could get some help here.
Occasionally, my site's ...
1
vote
1answer
18 views
Mod_security2 and clamav to catch malicious files on upload
Is there a clear documentation to describe the solution?
It's very common and also necessary.
1
vote
0answers
29 views
log/dump response body
Is there any way to log response body in Apache 2?
I need the exact content that will be sent to user browser.
I tried mod_security audit logging, but it won't log response body for all requests.
...
1
vote
1answer
101 views
Does ModSecurity 2.7.1 work with ASP.NET MVC 3?
I'm trying to get ModSecurity 2.7.1 to work with an ASP.NET MVC 3 website.
The installation ran without errors and looking at the event log, ModSecurity is
starting up successfully.
I am using the ...
1
vote
0answers
196 views
mod_security2.so: undefined symbol: ap_unixd_set_gl
service httpd restart
Stopping httpd: [ OK ]
Starting httpd: httpd: Syntax error on line 205 of /etc/httpd/conf/httpd.conf: Cannot load ...
1
vote
1answer
203 views
What do the audit log records for ModSecurity actually mean?
We have ModSecurity setup to log to modsec_audit.log for Apache2. Today we have had 2259 entries created in this log with a referrer of:
Mozilla/5.0 (compatible; bingbot/2.0; ...
1
vote
2answers
1k views
How do I enable mod_security in Ubuntu 10.04?
A quick run through of what I've done:
apt-get install libapache-mod-security
a2enmod mod-security
create /etc/apache2/mod_security_rules/ with base_rules and optional_rules from the latest core ...
1
vote
2answers
254 views
Where does Ubuntu 10.04 store the configuration file of mod-security?
I've installed libapache-mod-security on Ubuntu 10.04. The only configuration file I've been able to find is this one:
cat /var/lib/dpkg/info/libapache-mod-security.conffiles
...
1
vote
0answers
409 views
Apache/mod_security/mod_proxy doesn't close a long-lived connection on FIN
We are using Comet that is routed via a proxy running Apache with mod_proxy and mod_security. The connections are long-lived, and have a client-side timeout.
When the connection times out, the client ...
1
vote
2answers
513 views
How do I remove the ServerSignature added by mod_fcgid?
I'm running Mod_Security and I'm using the SecServerSignature to customize the Server header that Apache returns. This part works fine, however I'm also running mod_fcgid which appends ...
1
vote
1answer
153 views
Simple, current how-to install mod-security on cPanel server?
Does anyone have or know of a simple, up to date how to for installing mod-security on cPanel and configuring it after install?
Every how to on the web I've found is at least two years old and is ...
0
votes
1answer
60 views
Blocking bad bots
I found this script and was wondering if this is just overkill and even worth using?
Is it better for me to just use mod_security?
# Generated using http://solidshellsecurity.com services
# Begin ...
0
votes
1answer
452 views
What is this mod_security rule trying to prevent?
Today my IP was blocked by my server. I was told it was because of a mod_security rule that got triggered. I'm told that the regex that got triggered was
^((?:(?:POS|GE)T|OPTIONS|HEAD))
I don't ...
0
votes
2answers
2k views
Necesity of ModSecurity if Apache is behind Nginx
I have my Apache installed behind Nginx. So every request that comes in is first handeled by Nginx. If there is dynamic content needed the request is send to Apache which listens on port 8080.
Pretty ...
0
votes
2answers
677 views
ModSecurity block specific string in request
I want a ModSecurity rule, which block the access to any url or any Body request Post/Get, if it contains a specific string.
For example i want to block this string : "km0ae9gr6m"
I have this rule ...
0
votes
2answers
3k views
Just added mod_security… want to whitelist a series of sub directories
I am running a host and just updated mod_security. It "broke" a CMS in multiple sites. I want to white list all sub-directories named CMS. How do I specify a rule to do that?
0
votes
1answer
183 views
apt-get update Error
I get the following error when typing:
# apt-get update
W: Failed to fetch http://etc.inittab.org/~agi/debian/libapache-mod-security2/etch/Packages 404 Not Found [IP: 80.28.139.208 80]
E: Some ...
0
votes
1answer
358 views
installing mod_security causing apache service start to fail
I installed mod security using this tutorial http://www.linuxmaza.... . After installing I got the error described and followed the steps to solve it. The only thing I did differently was updating ...
0
votes
2answers
1k views
Why doesn't my mod_security catch / log anything?
I installed mod_security on my Ubuntu GNU/Linux server but when I send some simple requests to the web server that should match even the simplest rules, I fail to see any alerts or any log files that ...
0
votes
2answers
446 views
mod_security on an OWA front end
When using mod_security (installed from EPEL) with apache 2 on a centos box, sometimes users are unable to send messages - im having trouble tracing the rule back, the only place i get to is 'inbound ...
0
votes
2answers
1k views
Web Application Firewall: alternatives to mod_security
mod_security seems to be no longer on Debian repositories. The installation seems quite complicated. The only one I could find is Zorp, which seems even more complicated.
Hence I'd like to ask for up ...
0
votes
1answer
1k views
What is the difference between an Audit Log and a regular Log (In the context of mod_security)?
I am using mod_security
What is the difference between and audit log (audit trail) and a normal log?
I read on wikipedia that an audit log is a log of user activity, if this is the case what would ...
0
votes
1answer
29 views
Apache vhost-specific logging
I have the following apache setting (in conf.d/owasp-modsecurity.conf):
SecAuditLog "/var/www/vhosts/${lowercase:%{SERVER_NAME}}/statistics/logs/modsec_audit.log"
When I do httpd -t I get the ...
