Tag Info

Hot answers tagged

8

SecRuleEngine Off must work . Have you tried to put SecRuleEngine inside Directory: <Directory /var/www/site/phpMA> SecRuleEngine Off </Directory> instead of LocationMatch ?


8

Well I suppose it is possible if you enable the configuration for mod security either in .htaccess or in the virtual host apache configuration for that particular domain using something like this : <IfModule mod_security2.c> SecRuleEngine On ...... (any other directives you might want to override from the defaul conf) </IfModule> Also ...


7

The robots.txt file is only parsed by the robot. The webserver does not use it to decide if a client with that user-agent is allowed to access your website or not. A malicious bot will most likely ignore this file. If you want to improve security, mod_security is a much better way to do it.


7

These appear to be settings internal to the PCRE engine in order to limit the maximum amount of memory/time spent on trying to match some text to a pattern. The pcreapi manpage does little to explain it in layman's terms: The match_limit field provides a means of preventing PCRE from using up a vast amount of resources when running patterns that are ...


7

First of all, you should know that you are running an obsolete version of ModSecurity (branch 1.x). If you are running Apache 2.0.x you should upgrade to ModSecurity 2.x. If you are still running Apache 1.3.x then I am afraid that you don't have a choice since ModSecurity 2.x won't work with it. ModSecurity 1.x itself is not known to be vulnerable, but its ...


6

Which ModSecurity version are you using? ARGS variable only includes QUERY_STRING + POST_PAYLOAD in version 1.X. If you're running version 2.X, with your above rule, testing with a request as below: http://domain.com/a?b=km0ae9gr6m you'll see something like this in the audit_log: [modsecurity] [client x.x.x.x] [domain domain.com] [302] ...


6

Same issue here. I am using mod_security to block the user-agent SecRule REQUEST_HEADERS:User-Agent "Bittorrent" "id:10000002,rev:1,severity:2,log,msg:'Bittorrent Hit Detected'" I would change the log to nolog after you verify it is working to avoid filling up your log file SecRule REQUEST_HEADERS:User-Agent "Bittorrent" ...


5

I wrote a blog post about how to properly tell BitTorrent clients to go away and never come back, similar to what Dan did, but using nginx. server { location /announc { access_log off; error_log off; default_type text/plain; return 410 "d14:failure reason13:not a tracker8:retry in5:nevere"; } } Torrent trackers ...


5

I'm having the same issue at the moment, having torrent trackers point at my server. I've experimented with iptables for the past couple of days and inspected headers and patterns of the requests and narrowed it down to a couple of iptables rules that filters pretty much all of the recent seemingly malicious traffic from Asia (China,Malaysia,Japan and Hong ...


5

We are experiencing exactly the same issue with one of our client's sites. I added the following near the top of their : # Drop Bittorrent agent 2015-01-05 before redirect to https <IfModule mod_rewrite.c> RewriteEngine on # RewriteCond %{HTTP_USER_AGENT} =Bittorrent RewriteRule ^/announce$ - [F] RewriteRule ^/announce\.php$ - [F] ...


5

Holy recursion, Batman! I claim you have something wrong with your mod_security rules. That kind of recursion seems to be unnecessary and will most likely cause some serious load for your server. Fix the rules and/or Apache config, and don't try to "fix" this problem with arbitrarily large numbers.


5

This sounds like a suitable situation for the <FilesMatch > directive, no need for mod_security at all. <FilesMatch sm6[0-9]+\.php> Order Allow,Deny Deny from all </FilesMatch> Of course, if you don't want anyone to access the file, why not delete it or move it out of the DocumentRoot ? If you edit your question to include more ...


5

If you want to have fine grained manipulation of the interaction between the client and your server, mod_security is the way to go. It's a fine Open Source solution if you want to implement a "Web Application Firewall." (WAF) If you do not want to spend the time properly configuring it and writing rules suited for your particular applications the benefit ...


4

<Directory /path/to/dir> SecRuleEngine Off </Directory>


4

No - the output listed above just describes the pre-compiled in modules. The presence of the mod_so.c entry however means that Apache is capable of dynamically loading additional modules. If you have access to the central configuration you could just go look at this and check to see if there's a line like: LoadModule security_module ...


4

I would say yes to hardening NginX as much as possible and yes to using ModSecurity on the Apache server if your site is hosting any sort of webapp or dynamic content that can be contributed by the end users, such as comments. Pretty much if your website has forms then ModSecurity is a good idea. ModSecurity doesn't protect Apache per-say. It protects ...


4

Having said I have no experience in using Mod Security, I like to share the following review: ModSecurity is an open source web application firewall (WAF) engine for Apache that is developed by Trustwave's SpiderLabs. It has a robust event-based programming language which provides protection from a range of attacks against web applications ...


4

It refuses requests that are not using one of the accepted methods HEAD, GET, POST or OPTIONS. If you say, tried a WebDAV DELETE statement or something, it would then block that.


4

For me, this rule was triggering when someone submitted a form with a less-than, greater-than sign with no characters in between, so: '><' It looks like your form is built in with those pre-entered into the form: Note that whitespace doesn't fix this.


4

The problem was SELinux #less /var/log/audit/audit.log type=AVC msg=audit(1311546944.235:1040): avc: denied { read } for pid=1396 comm="httpd" name="hosts" dev=dm-0 ino=262931 scontext=user_u:system_r:httpd_t:s0 tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=file In my case the following solved it: # ls -lZ /etc/hosts -rw-r--r-- root root ...


4

When you build software, you need the library development package, not the shared library package. So, install libxml2-devel and your build problems should go away (or at least the error message will change).


4

Apache has to handle the request in some way, it can't just ignore them. Responding with 403 Forbidden is as close as you get.


4

The mod_security action deny will produce a 403 response whereas drop will immediately close the connection. From the manual: drop Description: Immediately initiate a "connection close" action to tear down the TCP connection by sending a FIN packet. Action Group: Disruptive Example: The following example initiates an IP collection for tracking Basic ...


4

/etc/modsecurity/whmcs_rules.conf Shows it as phase:4, this is the reponse_body bit, you probably want phase:1 (or maybe 2) which is request_headers (and request_body) That way modsecurity will trigger earlier


4

From the perspective of defense from attack, not filtering in/out data of course does not add anything of value. One could argue that proxying without forethought in fact lowers security in that: greater complexity is introduced, often with a vengeance. less transparency in that multiple log and alerting layers need correlation per transaction. attack ...


4

We use fail2ban It automatically blocks the IP of the spambot or malicious user for a user defined period of time once it detects a user defined number of requests to non-existent pages, failed login attempts etc. We currently use it to protect against ssh attacks but are now extending it to our website.


3

Googling yout error message I found this ... Now apache fails to start: Sep 30 15:30:14 mydomain httpd[2377]: Syntax error on line 52 of /etc/httpd/modsecurity.d/activated_rules/modsecurity_crs_20_protocol_violations.conf: Sep 30 15:30:14 mydomain httpd[2377]: Error parsing actions: Unknown action: ver and the response is This is my ...


3

The OWASP rule set has been upgraded to require modsecurity >= 2.7. There is a downgrade script in the util/rule-management folder that can automatically downgrade rulesets to be 2.6 compatible. To downgrade your activated rules just run this comand in the rule directory (requires perl): perl ...


3

First a disclaimer: I'm the author of Bad Behavior, a similar product, and some of the ModSecurity core rules were derived from Bad Behavior. RFC 2616 states that the Accept header SHOULD be present in all requests. Note that this isn't an absolute requirement, so a user-agent is still conditionally compliant (as defined in the RFC) if it doesn't send this ...


3

Alternatively, don't use ELB but roll out your own load balancer using HAProxy. If you've been deploying your site using AWS OpsWorks, you should be aware that AWS OpsWorks supports a HAProxy-based Load Balancer Layer. Yes, preparing a HAProxy Load Balancer Layer is much more involved than simply spinning up an ELB set, but ultimately it allows you to ...



Only top voted, non community-wiki answers of a minimum length are eligible