New answers tagged mod-security
Out of the box mod_security is very sensitive. All you can do is look at the modsecurity_audit.log or use modgrep to gather the various log parts together and decide which rules to ignore which locations to whitelist. You're in a world of irritation ...
We use fail2ban It automatically blocks the IP of the spambot or malicious user for a user defined period of time once it detects a user defined number of requests to non-existent pages, failed login attempts etc. We currently use it to protect against ssh attacks but are now extending it to our website.
There was a time that the default install of Apache simply had fewer known security holes than a default install of IIS; that alone was a security improvement. Thus, it may have simply become tribal lore because it was once a best practice.
From the perspective of defense from attack, not filtering in/out data of course does not add anything of value. One could argue that proxying without forethought in fact lowers security in that: greater complexity is introduced, often with a vengeance. less transparency in that multiple log and alerting layers need correlation per transaction. attack ...
Ahhh, ModSecurity. That’s the most I will say! Other than ask, do you have the SecRuleInheritance option activated anywhere in addition to SecRuleEngine? SecRuleInheritance On SecRuleEngine On And what about SecFilterScanPOST? SecFilterScanPOST On Also, what kind of server setup do you have? Is this instance of ModSecurity running on an Apache setup ...
Top 50 recent answers are included