2

i just installed mod_security on my server but every page gets blocked with a forbidden error. i feel the rules are to strict, no? how can change it?

this is the last line on my log

Message: Access denied with code 403 (phase 2). Pattern match "([\\~\\!\\@\\#\\$\\%\\^\\&\\*\\(\\)\\-\\+\\=\\{\\}\\[\\]\\|\\:\\;\"\\'\\\xc2\xb4\\\xe2\x80\x99\\\xe2\x80\x98\\`\\<\\>].*?){8,}" at REQUEST_COOKIES:_iub_cs-856516. [file "/usr/share/modsecurity-crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "157"] [id "981172"] [rev "2"] [msg "Restricted SQL Character Anomaly Detection Alert - Total # of special characters exceeded"] [data "Matched Data: \x22 found within REQUEST_COOKIES:_iub_cs-856516: {\x22consent\x22:true,\x22timestamp\x22:\x222016-02-25T03:39:02.641Z\x22,\x22version\x22:\x220.11.36.4\x22,\x22id\x22:856516}"] [ver "OWASP_CRS/2.2.8"] [maturity "9"] [accuracy "8"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"]
Action: Intercepted (phase 2)
Stopwatch: 1456371544053489 3619 (- - -)
Stopwatch2: 1456371544053489 3619; combined=1721, p1=217, p2=1499, p3=0, p4=0, p5=5, sr=59, sw=0, l=0, gc=0
Response-Body-Transformed: Dechunked
Producer: ModSecurity for Apache/2.7.7 (http://www.modsecurity.org/); OWASP_CRS/2.2.8.
Server: Apache
Engine-Mode: "ENABLED"

2 Answers 2

3

You probably linked in every single mod_security rule. Take them all out and try using just the core rule set.

If that doesn't work take them all out and introduce them one by one, in the order you really want the rules to work. Do a full test of your website after each addition, including registration.

A tutorial on mod_security should go through this.

2

Cookies are notorious for firing some of the OWASP CRS rules because the contain random text and potentially lots of special characters that the rules block.

You want to add this config to whitelist that cookie from this rule:

SecRuleUpdateTargetById 981172 !REQUEST_COOKIES:'/^_iub_cs.*/'

This should be specified in config after the file that defines the original rule is loaded.

I'd imagine quite a few other rules are also firing so you'll probably have to add several tweaks like this. You should run on DetectionOnly mode until you have adjusted the rules to what your site requires. They WILL need tweaking.

Here's some other posts that might help get you up to speed on ModSecurity:

Hope that helps, Barry

Not the answer you're looking for? Browse other questions tagged .