Tag Info

New answers tagged

0

Depends how the rules are written but in general, yes rules are written to block. Other than that can't really answer unless you give more specifics on what rules you're running. Most common are the OWASP Core Rule Set, most of which are designed to block depending which detection mode you are running that in. Best practice is to run ModSecurity in ...


1

I wrote up an extended blog post about how to do this with Apache 2.4 using OSSEC (a FOSS host-based intrusion detection system). Here's the TLDR: Use mod_remoteip to log client IPs in place of your load-balancer IPs. In your vhost config, use an IncludeOptional directive inside a RequireAll directive to source in a directory that will contain other ...


2

So I think I found the solution. First I disabled all IP collection related rules in Modsec. These were the following: 900050, 900018, 900020, 900021 Then I deleted the following files in /var/cpanel/secdatadir: ip.dir and ip.pag Errors have stopped ever since.


1

The rule is as follows: SecRule TX:INBOUND_ANOMALY_SCORE "@gt 0" \ "chain,phase:5,id:'981203',t:none,log,noauditlog,pass,skipAfter:END_CORRELATION,msg:'Inbound Anomaly Score (Total Inbound Score: %{TX.INBOUND_ANOMALY_SCORE}, SQLi=%{TX.SQL_INJECTION_SCORE}, XSS=%{TX.XSS_SCORE}): %{tx.inbound_tx_msg}'" SecRule TX:INBOUND_ANOMALY_SCORE "@lt ...


0

I was using a similar tutorial, http://idroot.net/tutorials/how-to-install-mod_security-apache-on-centos-6/, and had the same problem. The issue with my installation is on CentOS the config files in /etc/httpd/conf/httpd.conf are loaded around line 220 with the line: Include conf.d/*.conf Then the tutorial had me install the following at the end of the ...


2

You should set up a Sanitise rule: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#sanitiseArg 5kKate the password is in section C which is the request body. Which is where passwords should be for POST requests. I agree you shouldn't use them in URLS via GET requests (in which case they would should in section B of the audit log).


0

You can configure mod_security to disable logging the request URL. This is the letter B which I removed from the below configuration. SecAuditLogParts ACIFHZ You can read more here: http://resources.infosecinstitute.com/analyzing-mod-security-logs/ The bigger issue though is that you are sending cleartext passwords in the URL. I'm not as familiar with ...


1

The Error is here: Edit your httpd.conf/apache2.conf <IfModule security2_module> Include crs/modsecurity_crs_10_setup.conf Include crs/activated_rules/*.conf </IfModule> Change it to <IfModule security2_module> # Include crs/modsecurity_crs_10_setup.conf Include crs/activated_rules/*.conf </IfModule> With booth lines activated, ...



Top 50 recent answers are included