1

After upgrade from squeeze to wheezy I get loads of these messages in my apache errorlog when I open a webpage on myserver, (changed to myserver.de here):

[Sat Oct 19 01:06:21 2013] [error] [client 213.239.220.106] ModSecurity: Warning. Match of "rx ^OPTIONS$" against "REQUEST_METHOD" required. [file "/etc/apache2/modsecurity2/modsecurity_crs_21_protocol_anomalies.conf"] [line "41"] [id "960015"] [msg "Request Missing an Accept Header"] [severity "CRITICAL"] [tag "PROTOCOL_VIOLATION/MISSING_HEADER"] [hostname "www.myserver.de"] [uri "/js/jquery-ui-1.8.14.custom_myserver/css/custom-theme/images/ui-icons_ff7519_256x240.png"] [unique_id "UmG@7X8AAQEAAHHDMOkAAAAB"]
[Sat Oct 19 01:06:21 2013] [error] [client 213.239.220.106] ModSecurity: Warning. Match of "rx ^OPTIONS$" against "REQUEST_METHOD" required. [file "/etc/apache2/modsecurity2/modsecurity_crs_21_protocol_anomalies.conf"] [line "41"] [id "960015"] [msg "Request Missing an Accept Header"] [severity "CRITICAL"] [tag "PROTOCOL_VIOLATION/MISSING_HEADER"] [hostname "www.myserver.de"] [uri "/js/jquery-ui-1.8.14.custom_myserver/css/custom-theme/images/ui-bg_highlight-soft_20_372806_1x100.png"] [unique_id "UmG@7X8AAQEAADSz0KYAAAAC"]
[Sat Oct 19 01:06:21 2013] [error] [client 213.239.220.106] ModSecurity: Warning. Match of "rx ^OPTIONS$" against "REQUEST_METHOD" required. [file "/etc/apache2/modsecurity2/modsecurity_crs_21_protocol_anomalies.conf"] [line "41"] [id "960015"] [msg "Request Missing an Accept Header"] [severity "CRITICAL"] [tag "PROTOCOL_VIOLATION/MISSING_HEADER"] [hostname "www.myserver.de"] [uri "/js/jquery-ui-1.8.14.custom_myserver/css/custom-theme/images/ui-bg_flat_75_ddd4b0_40x100.png"] [unique_id "UmG@7X8AAQEAADTD27sAAAAF"]

line 40 and 41 in my

/etc/apache2/modsecurity2/modsecurity_crs_21_protocol_anomalies.conf`:

look like this:

SecRule &REQUEST_HEADERS:Accept "@eq 0" \
    "chain,phase:2,skip:1,t:none,log,auditlog,msg:'Request Missing an Accept Header', severity:'2',id:'960015',tag:'PROTOCOL_VIOLATION/MISSING_HEADER'"

could this be a conflict with mod_pagespeed?


Update: I disabled mod_security until this issue is solved and the warnings are gone (as expected)

0

Additionally, as a workaround I created a cronjob that deletes the modsec_audit.log which gets huge also every hour:

# empty mad modsec log
16 * * * * echo "">/var/log/apache2/modsec_audit.log

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.