Tag Info

Hot answers tagged

7

These appear to be settings internal to the PCRE engine in order to limit the maximum amount of memory/time spent on trying to match some text to a pattern. The pcreapi manpage does little to explain it in layman's terms: The match_limit field provides a means of preventing PCRE from using up a vast amount of resources when running patterns that are ...


7

Well I suppose it is possible if you enable the configuration for mod security either in .htaccess or in the virtual host apache configuration for that particular domain using something like this : <IfModule mod_security2.c> SecRuleEngine On ...... (any other directives you might want to override from the defaul conf) </IfModule> Also ...


7

The robots.txt file is only parsed by the robot. The webserver does not use it to decide if a client with that user-agent is allowed to access your website or not. A malicious bot will most likely ignore this file. If you want to improve security, mod_security is a much better way to do it.


5

If you want to have fine grained manipulation of the interaction between the client and your server, mod_security is the way to go. It's a fine Open Source solution if you want to implement a "Web Application Firewall." (WAF) If you do not want to spend the time properly configuring it and writing rules suited for your particular applications the benefit ...


4

No - the output listed above just describes the pre-compiled in modules. The presence of the mod_so.c entry however means that Apache is capable of dynamically loading additional modules. If you have access to the central configuration you could just go look at this and check to see if there's a line like: LoadModule security_module ...


4

I would say yes to hardening NginX as much as possible and yes to using ModSecurity on the Apache server if your site is hosting any sort of webapp or dynamic content that can be contributed by the end users, such as comments. Pretty much if your website has forms then ModSecurity is a good idea. ModSecurity doesn't protect Apache per-say. It protects ...


4

It refuses requests that are not using one of the accepted methods HEAD, GET, POST or OPTIONS. If you say, tried a WebDAV DELETE statement or something, it would then block that.


4

The problem was SELinux #less /var/log/audit/audit.log type=AVC msg=audit(1311546944.235:1040): avc: denied { read } for pid=1396 comm="httpd" name="hosts" dev=dm-0 ino=262931 scontext=user_u:system_r:httpd_t:s0 tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=file In my case the following solved it: # ls -lZ /etc/hosts -rw-r--r-- root root ...


4

The mod_security action deny will produce a 403 response whereas drop will immediately close the connection. From the manual: drop Description: Immediately initiate a "connection close" action to tear down the TCP connection by sending a FIN packet. Action Group: Disruptive Example: The following example initiates an IP collection for tracking Basic ...


4

We use fail2ban It automatically blocks the IP of the spambot or malicious user for a user defined period of time once it detects a user defined number of requests to non-existent pages, failed login attempts etc. We currently use it to protect against ssh attacks but are now extending it to our website.


4

From the perspective of defense from attack, not filtering in/out data of course does not add anything of value. One could argue that proxying without forethought in fact lowers security in that: greater complexity is introduced, often with a vengeance. less transparency in that multiple log and alerting layers need correlation per transaction. attack ...


4

When you build software, you need the library development package, not the shared library package. So, install libxml2-devel and your build problems should go away (or at least the error message will change).


4

Apache has to handle the request in some way, it can't just ignore them. Responding with 403 Forbidden is as close as you get.


3

mod_security is a WAF, but not a F. You are mixing technologies in your post: I use ssh (port 22) and http (80) to access this and I've read horror stories from other EC2 users claiming they were locked out of their sites once they put up a firewall. The WAF inspects web traffic, that is to say, HTTP. It will have no effect on other Layer 7 ...


3

How about not re-inventing the wheel and just use a control panel like ISPConfig. You can disable unwanted features and only allow the subdomaining.


3

Which ModSecurity version are you using? ARGS variable only includes QUERY_STRING + POST_PAYLOAD in version 1.X. If you're running version 2.X, with your above rule, testing with a request as below: http://domain.com/a?b=km0ae9gr6m you'll see something like this in the audit_log: [modsecurity] [client x.x.x.x] [domain domain.com] [302] ...


3

First a disclaimer: I'm the author of Bad Behavior, a similar product, and some of the ModSecurity core rules were derived from Bad Behavior. RFC 2616 states that the Accept header SHOULD be present in all requests. Note that this isn't an absolute requirement, so a user-agent is still conditionally compliant (as defined in the RFC) if it doesn't send this ...


3

There's several free/open source options out there. A close friend of mine who's a Web applications pen tester uses none of these (with exception to Nessus, but only the Professional Feed) as their toolset is quite a bit more sophisticated and contains many unpublished zero day exploits. However, they're very expensive and require certain ...


3

I'd be looking for typos and other "stupidly simple" mistakes we all make from time to time (I use my wife as a proof-reader), but if that doesn't work I'd just fire up strace to see what mod_security is trying to do. It might not be reading /etc/hosts -- perhaps it's taking a failure to resolve the name via DNS as some sort of hard failure instead, or ...


3

Holy recursion, Batman! I claim you have something wrong with your mod_security rules. That kind of recursion seems to be unnecessary and will most likely cause some serious load for your server. Fix the rules and/or Apache config, and don't try to "fix" this problem with arbitrarily large numbers.


3

Having said I have no experience in using Mod Security, I like to share the following review: ModSecurity is an open source web application firewall (WAF) engine for Apache that is developed by Trustwave's SpiderLabs. It has a robust event-based programming language which provides protection from a range of attacks against web applications ...


3

Are you accessing the machine via IP instead of DNS? This is designed behavior if so, as mod_security is outputting this message in response to the machine being accessed via IP. If you don't want the error you could comment out the rule in the file listed in your error. For some background info, the reason the rule exists in the default configuration is ...


3

<Directory /path/to/dir> SecRuleEngine Off </Directory>


2

An audit log contains all the information necessary to follow a user's interaction with a system. It will usually contain more information and detail than what is necessary to have in day-to-day operations. You can think of it in terms of a phone system. You can record every call that passes through the phone system to be able to go back in time and prove ...


2

Your main focus should be on the applications themselves. Things like Nginx and mod_security are helpful addons, a first line of defense perhaps, but they can do nothing if your webapplication has glaring holes in it.


2

It means that anything over that limit will be rejected with a 500-Internal Server Error code. To change what it does when it hits that error the SecResponseBodyLimitAction directive affects that. By default, ModSecurity will reject a response body that is longer than specified. Some web sites, however, will produce very long responses, making it ...


2

Using LoadFile vs linking directly is the Apache recommended best practice. Really, it boils down to two issues: 1) Conflicts with other modules may cause strange and hard to diagnose side effects and make the order of LoadModule directives important. 2) Library versioning may cause two modules to load two different versions which may lead to overloading ...


2

Shame on me! I've put the mod-security config directives before (and not after) the: # Include module configuration: Include /etc/apache2/mods-enabled/*.load Include /etc/apache2/mods-enabled/*.conf so mod-security module was not loaded actually! Now that I placed the mod-security directives below them, mod-security is loaded and it logs to the relevant ...


2

I found the problem. I was putting this rule in the local rules file which is the last thing to be set. The IP collection had already been initialised by another rule which took precedence. The solution was to move the top line (the one with initcol in) to the top of the mod_security config so that all references to the IP collection use the x-forwarded-for ...


2

For me, this rule was triggering when someone submitted a form with a less-than, greater-than sign with no characters in between, so: '><' It looks like your form is built in with those pre-entered into the form: Note that whitespace doesn't fix this.



Only top voted, non community-wiki answers of a minimum length are eligible