0

I can't get mod_security to block empty useragent requests. I am not very saavy with it so after searching I found this rule:

SecMarker BEGIN_UA_CHECK
SecRule &REQUEST_HEADERS:User-Agent "@eq 0" \"skipAfter:END_UA_CHECK,phase:2,rev:'1',ver:'OWASP_CRS/2.2.9',maturity:'9',accuracy:'9',t:none,block,msg:'Request Missing a User Agent Header',id:'960009',tag:'OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_UA',tag:'WASCTC/WASC-21',tag:'OWASP_TOP_10/A7',tag:'PCI/6.5.10',severity:'5',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.notice_anomaly_score},setvar:tx.%{rule.id}-OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER-%{matched_var_name}=%{matched_var}"
SecRule REQUEST_HEADERS:User-Agent "^$" \"phase:2,t:none,block,msg:'Empty User Agent Header',id:'960006',rev:'1',ver:'OWASP_CRS/2.2.9',maturity:'9',accuracy:'9',tag:'OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_UA',severity:'5',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.notice_anomaly_score},setvar:tx.%{rule.id}-OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER-%{matched_var_name}=%{matched_var}"
SecMarker END_UA_CHECK

In the file located here: /etc/modsecurity/modsecurity_custom_rules.conf

But it just doesn't block the requests...

Am I missing something?

2
  • Is the SecRuleEngine directive set to on in your config file ?
    – krisFR
    Nov 14, 2014 at 21:44
  • Yes it is. Modsecurity is actually working on my VPS for other things like blocking SQL inyections and things like that, but not empty useragent requests.
    – san671
    Nov 15, 2014 at 11:14

1 Answer 1

0

Solved adding the following custom rule:

<Location />
# Block empty User-Agents.
SecRule &REQUEST_HEADERS:User-Agent "@eq 0" \
     "id:'13009',phase:2,t:none,deny,status:406"
SecRule REQUEST_HEADERS:User-Agent "^$" \
     "id:'13006',phase:2,t:none,deny,status:406"
</Location>

I adapted the rule from here: http://www.outdoorsxch.com/aa/00.html/usr/local/ssl/local/apache/conf/modsec-imh/40_wordpress.conf

Hope this helps somebody.

1
  • If you're only interested in HTTP headers then you should use phase:1
    – IanB
    Oct 19, 2018 at 6:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .