Tag Info

Hot answers tagged

9

SecRuleEngine Off must work . Have you tried to put SecRuleEngine inside Directory: <Directory /var/www/site/phpMA> SecRuleEngine Off </Directory> instead of LocationMatch ?


8

Well I suppose it is possible if you enable the configuration for mod security either in .htaccess or in the virtual host apache configuration for that particular domain using something like this : <IfModule mod_security2.c> SecRuleEngine On ...... (any other directives you might want to override from the defaul conf) </IfModule> Also ...


7

The robots.txt file is only parsed by the robot. The webserver does not use it to decide if a client with that user-agent is allowed to access your website or not. A malicious bot will most likely ignore this file. If you want to improve security, mod_security is a much better way to do it.


7

These appear to be settings internal to the PCRE engine in order to limit the maximum amount of memory/time spent on trying to match some text to a pattern. The pcreapi manpage does little to explain it in layman's terms: The match_limit field provides a means of preventing PCRE from using up a vast amount of resources when running patterns that are ...


7

First of all, you should know that you are running an obsolete version of ModSecurity (branch 1.x). If you are running Apache 2.0.x you should upgrade to ModSecurity 2.x. If you are still running Apache 1.3.x then I am afraid that you don't have a choice since ModSecurity 2.x won't work with it. ModSecurity 1.x itself is not known to be vulnerable, but its ...


7

Same issue here. I am using mod_security to block the user-agent SecRule REQUEST_HEADERS:User-Agent "Bittorrent" "id:10000002,rev:1,severity:2,log,msg:'Bittorrent Hit Detected'" I would change the log to nolog after you verify it is working to avoid filling up your log file SecRule REQUEST_HEADERS:User-Agent "Bittorrent" ...


6

Which ModSecurity version are you using? ARGS variable only includes QUERY_STRING + POST_PAYLOAD in version 1.X. If you're running version 2.X, with your above rule, testing with a request as below: http://domain.com/a?b=km0ae9gr6m you'll see something like this in the audit_log: [modsecurity] [client x.x.x.x] [domain domain.com] [302] ...


5

Holy recursion, Batman! I claim you have something wrong with your mod_security rules. That kind of recursion seems to be unnecessary and will most likely cause some serious load for your server. Fix the rules and/or Apache config, and don't try to "fix" this problem with arbitrarily large numbers.


5

This sounds like a suitable situation for the <FilesMatch > directive, no need for mod_security at all. <FilesMatch sm6[0-9]+\.php> Order Allow,Deny Deny from all </FilesMatch> Of course, if you don't want anyone to access the file, why not delete it or move it out of the DocumentRoot ? If you edit your question to include more ...


5

If you want to have fine grained manipulation of the interaction between the client and your server, mod_security is the way to go. It's a fine Open Source solution if you want to implement a "Web Application Firewall." (WAF) If you do not want to spend the time properly configuring it and writing rules suited for your particular applications the benefit ...


5

I wrote a blog post about how to properly tell BitTorrent clients to go away and never come back, similar to what Dan did, but using nginx. server { location /announc { access_log off; error_log off; default_type text/plain; return 410 "d14:failure reason13:not a tracker8:retry in5:nevere"; } } Torrent trackers ...


5

I'm having the same issue at the moment, having torrent trackers point at my server. I've experimented with iptables for the past couple of days and inspected headers and patterns of the requests and narrowed it down to a couple of iptables rules that filters pretty much all of the recent seemingly malicious traffic from Asia (China,Malaysia,Japan and Hong ...


5

We are experiencing exactly the same issue with one of our client's sites. I added the following near the top of their : # Drop Bittorrent agent 2015-01-05 before redirect to https <IfModule mod_rewrite.c> RewriteEngine on # RewriteCond %{HTTP_USER_AGENT} =Bittorrent RewriteRule ^/announce$ - [F] RewriteRule ^/announce\.php$ - [F] ...


4

/etc/modsecurity/whmcs_rules.conf Shows it as phase:4, this is the reponse_body bit, you probably want phase:1 (or maybe 2) which is request_headers (and request_body) That way modsecurity will trigger earlier


4

From the perspective of defense from attack, not filtering in/out data of course does not add anything of value. One could argue that proxying without forethought in fact lowers security in that: greater complexity is introduced, often with a vengeance. less transparency in that multiple log and alerting layers need correlation per transaction. attack ...


4

We use fail2ban It automatically blocks the IP of the spambot or malicious user for a user defined period of time once it detects a user defined number of requests to non-existent pages, failed login attempts etc. We currently use it to protect against ssh attacks but are now extending it to our website.


4

<Directory /path/to/dir> SecRuleEngine Off </Directory>


4

No - the output listed above just describes the pre-compiled in modules. The presence of the mod_so.c entry however means that Apache is capable of dynamically loading additional modules. If you have access to the central configuration you could just go look at this and check to see if there's a line like: LoadModule security_module ...


4

I would say yes to hardening NginX as much as possible and yes to using ModSecurity on the Apache server if your site is hosting any sort of webapp or dynamic content that can be contributed by the end users, such as comments. Pretty much if your website has forms then ModSecurity is a good idea. ModSecurity doesn't protect Apache per-say. It protects ...


4

Having said I have no experience in using Mod Security, I like to share the following review: ModSecurity is an open source web application firewall (WAF) engine for Apache that is developed by Trustwave's SpiderLabs. It has a robust event-based programming language which provides protection from a range of attacks against web applications ...


4

It refuses requests that are not using one of the accepted methods HEAD, GET, POST or OPTIONS. If you say, tried a WebDAV DELETE statement or something, it would then block that.


4

For me, this rule was triggering when someone submitted a form with a less-than, greater-than sign with no characters in between, so: '><' It looks like your form is built in with those pre-entered into the form: Note that whitespace doesn't fix this.


4

The problem was SELinux #less /var/log/audit/audit.log type=AVC msg=audit(1311546944.235:1040): avc: denied { read } for pid=1396 comm="httpd" name="hosts" dev=dm-0 ino=262931 scontext=user_u:system_r:httpd_t:s0 tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=file In my case the following solved it: # ls -lZ /etc/hosts -rw-r--r-- root root ...


4

When you build software, you need the library development package, not the shared library package. So, install libxml2-devel and your build problems should go away (or at least the error message will change).


4

Apache has to handle the request in some way, it can't just ignore them. Responding with 403 Forbidden is as close as you get.


4

The mod_security action deny will produce a 403 response whereas drop will immediately close the connection. From the manual: drop Description: Immediately initiate a "connection close" action to tear down the TCP connection by sending a FIN packet. Action Group: Disruptive Example: The following example initiates an IP collection for tracking Basic ...


3

How about not re-inventing the wheel and just use a control panel like ISPConfig. You can disable unwanted features and only allow the subdomaining.


3

mod_security is a WAF, but not a F. You are mixing technologies in your post: I use ssh (port 22) and http (80) to access this and I've read horror stories from other EC2 users claiming they were locked out of their sites once they put up a firewall. The WAF inspects web traffic, that is to say, HTTP. It will have no effect on other Layer 7 ...


3

SecRule REQUEST_LINE "@rx sm6[0-9]{1,}\.php" \ "phase:2,block,severity:2,msg:'Blocking access to sm6#.php files.'"


3

Watching this closely as I have exactly the same issue and your config looks similar to mine. I'm a first timer to modsecurity, it's not exactly noob friendly! Agree with Janne. Only advice I have so far is to remove all the core rules and re-introduce them 1 by 1 to start narrowing the problem down. I'm about to do that now. Also you should change your ...



Only top voted, non community-wiki answers of a minimum length are eligible