0

I'm trying to configure modsecurity to not log any issues originating from 127.0.0.1 but I have had no luck with the following rules.

SecRule REMOTE_ADDR "@ipMatch 127.0.0.1" "id:26091975,phase:2,pass,nolog,allow,ctl:ruleEngine=Off"
SecRule REMOTE_ADDR "^127.0.0.1" "id:26091975,phase:2,pass,nolog,allow,ctl:ruleEngine=Off"
SecRule REMOTE_ADDR "^127.0.0.1" phase:1,nolog,allow,ctl:ruleEngine=off

However my logs are still filling with entries from 127.0.0.1.

My rules for other IP's and specific rules work fine, it only seems to be when they originate from localhost.

#Versions
ModSecurity for Apache/2.6.3 (http://www.modsecurity.org/)
ModSecurity: APR compiled version="1.4.6"; loaded version="1.4.6"
ModSecurity: PCRE compiled version="8.12"; loaded version="8.12 2011-01-15"
ModSecurity: LUA compiled version="Lua 5.1"
ModSecurity: LIBXML compiled version="2.7.8"
1

A few pointers:

You should allow (which ends current rule processing for this request) rather than pass (which goes past this rule and continues processing next rules). Currently you have both in some of those rules and not sure what issues that causes.

In theory once the ctl:ruleEngine=off is processed it shouldn't pass to next rules so above may not matter but no harm to do it correctly.

You should make sure your skip rules are phase 1. Currently you have a mixture of phase 1 and phase 2.

You should make sure these skip rules are the first rules processed. That way other rules will not be processed before. Though honestly not sure if previously processed rules will log after you turn the audit engine off.

I would also change the nolog to log temporarily to see if these rules are being processed.

You could also turn on debug logging to see what happens when your rules are processed (is the REMOTE_ADDR not matched for some reason?). They produce a log of detail especially at a high debug level.

Hopefully that gives you some pointers but if that doesn't help then amend your question with any more details of what above did and might be able to help more. Would also say that ModSecurity 2.6.3 is very old now and may want to upgrade.

Can you share some rules which are firing? And where they are located in comparison to these skip rules? Can you share your other ModSecurity config?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.