Tag Info

New answers tagged

2

Looks like mod_security is working perfectly. It blocked the request because the Host header only contained an IP address, which is what this rule is meant to do. You should be using an actual hostname to refer to your web site, in production. It's also a good idea in development too, but if you need to use an IP address in development you can always ...


0

We ended up solving this issue by using another rule to not scan the URI. SecRuleUpdateTargetById 950120 !ARGS:REQUEST_URI This way this particular rule would not scan the URI but would still be scan the rest of the packet. It should be noted that this rule needs to be replicated for every rule you have.


0

As far as I'm aware it is not possible to blanket ignore any particular part of the request (be it URI or any parameters) from all configured ModSecurity rules. While that may be useful it would likely open up a number of security holes. So you just need to see which rules are failing and add white list exceptions for those rules. If you give examples of ...


0

Following the response in the comments on the original question; In short it is not possible to negate the URI from inspection, ModSecurity is like other products rule/signature based. What you can do however is get the ruleid for your false positives (from the apache error log for the VirtualHost) and perform a SecRemoveRuleById 123456 in your apache ...


0

1) Ensure your whitelist rule bypasses on phase1 and is the highest among the highest rule in your rule set. Here is an example rule: SecRule REMOTE_ADDR "^111.222.333.444" phase:1,nolog,allow,ctl:ruleEngine=off Notice it bypasses on phase 1 and does not continue on any further portion on the scanning process, it is set to allow, not to log at all and is ...


0

My first question would be why? If mod_security is on the actual server it will be transparent. If mod security is on a gateway then the client will only ever see the gateway server address. Just use x-forwarded-for to see the client IP in the server logs. It may be possible to use TPROXY in the linux kernel in a two subnet configuration where the servers ...


0

You haven't actually told mod security what to do, i.e. the default rule: Try this: SecDefaultAction "phase:1,pass,log,auditlog" Which sets anomaly mode.


1

Ids became mandatory in ModSecurity 2.7. Guessing you moved from a version before this with your recent upgrade of your OS. And sounds like you've gone back to old version when you manually reinstalled ModSecurity. An id is useful so you uniquely identify a rule for the following reasons amongst others: Uniquely identify a rule in log files when it fires. ...


0

I solved this issue by reinstalling Modsecurity, then the problem with duplicate ids came up that I solved by making sure that Modsecurity is included only once in my configurations files.


1

If it is a randomly generated IP DOS attack ,then your ISP is the only place it can be stopped. However, if you can see the IPs are coming from a specific place, then read on. Look at your /var/log/messages or syslog. Are your NICs going down? Bad Drivers - Are they Realtek? If you want your server to be online while you figure this all out you can block ...



Top 50 recent answers are included