3

mod_security with custom rules and whitelists in separate .conf files - Apache 2.2, modsec 2.8

Whitelist rule:

SecRule REMOTE_ADDR "^10\.10\.10\.10" phase:1,nolog,allow,ctl:ruleEngine=Off,id:104008

If a request is sent to the server that includes e.g. /?abc=../../ then modsec allows the request from 10.10.10.10 only, otherwise it denies the request in Phase 2 with a 403 as I would expect (due to our installed rules)

I have a customer who uses a remote WorPress management system (which is being represented here as 10.10.10.10) but that system sends certain POST requests which contain Content-Length headers but lack Content-Type headers.

Even when the request comes from 10.10.10.10 this results in:

--7ed45f75-H--
Message: Access denied with connection close (phase 1). Match of "rx ^0$" against "REQUEST_HEADERS:Content-Length" required. [file "/usr/local/apache/conf/modsec_rules/10_asl_rules.conf"] [line "93"] [id "392301"] [rev "7"] [msg "Atomicorp.com WAF Rules: Request Containing Content, but Missing Content-Type header"] [severity "NOTICE"] [tag "no_ar"]
Apache-Error: [file "config.c"] [line 395] [level 3] Handler for (null) returned invalid result code 9, referer: https://redacted.com
Action: Intercepted (phase 1)

I'm not sure if ctl:ruleEngine=Off simply can't be used in a phase 1 SecRule, or if this is a Mod Security 2.8 bug. I can confirm that there are no rules that subsequently turn ctl:ruleEngine back on.

Improve this question

1 Answer 1

Reset to default
0

As you already answered to your question here, you should create additional configuration file and put this line in it, it will disable Atomicorp rule you you were mentioning for this user/domain only (for everyone).

File : /usr/local/apache/conf/userdata/std/2/username/example.com

<IfModule mod_security2.c>
  SecRuleRemoveById 392301
</IfModule>

EDIT

Disabling certain rule for specific IP/range would go like this

SecRule REMOTE_HOST "@ipmatch 1.2.0.0/16" \
"id:12345,phase:2,t:none,pass,nolog,noauditlog,ctl:ruleRemovebyID=392301"

As explained on Atomicorp wiki

Improve this answer
4
  • I didn't answer my question here at all. My post here is to whitelist an IP Address not a rule. I do not want to disable this rule across the entire server, nor do i want to disable it for all requests against this virtual host - only for requests from this specific IP address. I'm afraid your solution doesn't answer my question.
    – Santrix
    Nov 22, 2014 at 17:15
  • I've updated answer; to 'whitelist' IP you need to make exemption for certain IP from given rule like in second example in answer. If you have list of IPs in some file use @pmFromFile /etc/modsecurity/ip_whitelist_list instead @ipmatch 1.2.0.0/16 part; and make sure IPs you want whitelisted are present in that file
    – Hrvoje Špoljar
    Nov 22, 2014 at 17:39
  • Dear Hrvoje. Firstly your suggestion shows phase 2 but IP matching belongs in phase 1 for efficiency. Secondly, I'm afraid you have not understood my question. I am whitelisting an IP from ALL rules. The most efficient way to do this is to turn off the rule engine. This is what my suggested rule does but due to an unknown reason modsec still blocks the request under certain conditions. Please re-read my original post.
    – Santrix
    Nov 23, 2014 at 20:09
  • 1
    Your question has so many details and I find it bit confusing to understand what the real problem is. Reading your last comment I understand your goal clearly. To disable all rules for some IP as you suggested ctl:ruleEngine=Off would need to do. Problem is if block is applied first; and rule disable only after. Is your whitelist attempt maybe within Location block? if it is you'll need to move it out since Location blocks are parsed last, in your case never since block kicked in already and no further rules are evaluated.
    – Hrvoje Špoljar
    Nov 23, 2014 at 23:31

Not the answer you're looking for? Browse other questions tagged .