New answers tagged

0

I wrote that answer you've referenced and, after testing a bit after reading your question, I've realised it isn't accurate. Will update it. After some experimentation I've found the following: If SecAuditEngine is set to On, then auditlog will have no real effect as the request will be logged anyway. If SecAuditEngine is set to Off, then auditlog will ...


0

It's a little confusing but some of the actions specified in the first rule will run for each rule matched in the chain and some only if all rules match (the author of ModSecurity has stated in hindsight it would have been better to put the rules on the last chained rule rather than the first). See here for more details: ...


0

No that is only for updating the Target the rule is aimed at. There is a SecRuleUpdateActionById command which allows you to make the SQL_INJECTION rules pass instead of block, but not for specific scenarios like you want here (i.e. only the ARGS/^fallout/ requests) and not ctl equivalent to allow you to chain this to achieve this :-( You could remove ...


0

Several problems: REMOTE_HOST is a name not an IP address. You want REMOTE_ADDR. "ctl:ruleRemovebyID=.*" is not valid syntax and, even if it was, should not be necessary (though see point 4 below). Don't need the semi-colon at the end. "Allow" is ignored in DetectionOnly mode, which I think is counter intuitive and can lead to a lot of false detections if ...


0

Add this line after the line including your base rules to remove this rule checking for that cookie. SecRuleUpdateTargetById 981318 !REQUEST_COOKIES:TOKEN And then restart Apache.



Top 50 recent answers are included