Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [mod-security]

ModSecurity supplies an array of request and response filtering rules and other security features to the Apache HTTP Server. ModSecurity is an open source web application layer firewall.

0
votes
0answers
3 views

Libapache2-mod-security2 causes error 403 and prevents access even after uninstall

I have an Ubuntu 18.04 server with Nextcloud installed in an Apache2 (Apache/2.4.29 (Ubuntu)) virtual host. I am using PHP 7.3. In an attempt to harden the server, I installed libapache2-mod-security2....
0
votes
0answers
15 views

Is it safe / OK to send ModSecurity Detail Logs to an ISP after hack attempts?

Would it be ill advisable to send a copy of the Mod Security Audit Log to an ISP abuse department after a hack attempt? Someone just tried an SQL Injection attack against my server and fortunately ...
0
votes
1answer
170 views

Updating ModSecurity when using OWASP rule sets

I am somewhat new to Modsecurity and still have a long way to go so bear with me. Ubuntu 18.04 I'm currently running Modsecurity 2.9.2-1 and OWASP rules 3.0.2 I would like to update the rules to ...
1
vote
1answer
38 views

Modsecurity - entire web pages being posted to log

I am running the latest version of Modsecurity on Ubuntu 18.04 and I'm having an odd problem that I cannot find through searching. The problem is that certain visitors to my server are posting the ...
0
votes
0answers
17 views

Apache config test failed because of duplicate ID in mod security.conf

I have installed mod security and cloned the rules and then added the rules in security2.conf. <IfModule security2_module> # Default Debian dir for modsecurity's persistent data ...
0
votes
0answers
16 views

How to whitelist Ip so that the IP can pass the Mod_security rules

I am finding that mod_security 3.0.3 will block wordpress user to post an article. The question is How I whitelist an IP so that I can post an article via the IP ? Mod_security : 3.0.3 OS : Centos 7 ...
0
votes
0answers
16 views

My nginx log not read the web activity in real time

I am confused, my nginx log does not read the web activity in real time. The log will tell what happens after several time (it is hours ). Do you know why? Thanks
0
votes
0answers
63 views

Compilation Error : Nginx with pagespeed,http2,brotli and mod security

After searching for whole internet i didnt found anything on how to build all these together , there are tutorials for individual but not together so i tried on my own. Error : .........................
0
votes
1answer
170 views

ModSecurity for Apache 2.4.34 Failing with Invalid command 'SecRuleEngine'

I have A Ubuntu 18.04 server, installed Apache 2.4.34, and have compiled ModSecurity 3 with the apache module. I can successfully load the module, by adding: LoadModule security3_module modules/...
1
vote
1answer
15 views

Whitelisting browser agents in ModSecurrity

I'm using ModSecurity WAF with Apache. I wanted to know if there's a way I can restrict to only few browser agent type? I want to do this for two reasons: Force the users to use an updated browser. ...
0
votes
0answers
17 views

Can ModSecurity Sniffing on Mirror (SPAN) Trafic?

My Debian Linux has an interface which configured in promiscuous mode and receives Mirror (SPAN) Traffic from Cisco Switch. Is there any way to running ModSecurity for sniffing this traffic to ...
0
votes
0answers
43 views

Enable mod_security only for specific directory

Current settings: - mod-security 2.9 Mod-security itself work as expected if enabled globally with SecRuleEngine on on main config but I need to enable it only for one specific folder for testing ...
1
vote
1answer
36 views

Can I setup redirects with Modsec?

The web servers I managed are all running Apache 2.4 with Modsec. Is it possible to write a rule that will serve up a different page if matched by Modsec? I want this to be independent of the domain. ...
0
votes
0answers
34 views

Apache modsecurity and htaccess which comes first?

Are htaccess rules executed before modsecurity rules? Sending illegal requests to couple of domains some of them trigger modsecurity but some of them with same illegal requests are not showing ...
0
votes
0answers
35 views

Mod security syntax error

when i ran the command apache2ctl configtest it is showing this error AH00526: Syntax error on line 193 of /etc/modsecurity/modsecurity.conf: ModSecurity: Failed to open the audit log file: /var/log/...
0
votes
0answers
263 views

PHP is not working after installing ModSecurity for NGINX on Ubuntu 16.04

My server is running on Ubuntu 16.04. One of my web app(php app) was running on my nginx server. To install ModSecurity I removed the NGINX completely and then followed the following steps to complie ...
0
votes
0answers
56 views

how can I whitelist dyndns host in mod security?

I'm using mod security with apache on Debian 8 and I'd like to add an exception for my IP. However I'm behind a dynamic IP address so it keeps changing. Is there a way to whitelist a hostname instead ...
0
votes
0answers
207 views

ModSecurity false positive 941100 and 941160 when saving WordPress page

I'm relatively new to ModSecurity and I have been trying to get my head around the rules for weeks. When saving a page in WordPress I was getting the following in modsecurity_audit.log: Message: ...
1
vote
2answers
342 views

ModSecurity SecRule based on original browser url, not internal rewrite (index.php, app.php, etc.)

I'm working on a Symfony 2 site, and am trying to create a ModSecurity rule to match a particular browser URL. IE example.com/results Symfony 2 internally rewrites all requests to app.php using ...
0
votes
0answers
21 views

Mod-Security whitelist page or more narrowly with query string?

I'm getting some Mod-Security 2 rule false positives from content updates in my cms. (300015 - generic sql injection) Since all admin.php.* URLs are login-walled, is there any risk in whitelisting ...
0
votes
0answers
32 views

Modsecurity v3 CRS + Nginx - separate vhost inclusions

I have the following setup: Nginx 1.14 ModSecurity v3 CRS v3 ModSecurity nginx connector I want to be able to specify in every vhost different collection of rules. For example: vhost1: filter all ...
0
votes
0answers
70 views

Get total number of cookie's from modsecurity using LUA script

I'm trying to access total number of cookies sent in response intercepted by mod-security and passed to LUA script. Below is an example response from server HTTP/1.1 200 OK Date: Tue, 21 Aug 2018 ...
0
votes
0answers
106 views

SPOE and modsecurity contrib Failed to decode HELLO frame

I'm compile modsec as described in the instructions contib/modsec/README, but have the next errors: # /usr/local/bin/modsecurity -n 4 -d -f /etc/haproxy/waf/modsecurity.conf 1534409877.286475 [00] ...
1
vote
1answer
80 views

How to use modsecurity with lighttpd

I'm not an expert and I'm looking to use modsecurity with lighttpd Can someone explain me how to compile or install modsecurity for lighttpd because I can't find any documentation online
0
votes
0answers
31 views

Modsecurity connector does not allow rule update

I am using nginx and modsecurity compiled with nginx-modsecurity connector. When I try to add a custom rule: SecRuleUpdateActionById 200004 "allow" the following error occurs when nginx is restarted:...
-1
votes
1answer
191 views

Modsecurity block request

How can I block in modsecurity these requests: 12.54.87.55:443 https://12.54.87.55 tried SecRule REQUEST_URI "12.54.87.55:443" phase:1,id:1008,log,deny,status:403 but seems like it's not working....
1
vote
1answer
2k views

ModSecurity: setenv within SecAction not effective

I am trying to debug an issue with ModSecurity. Using ModSecurity 2.9.2 on Apache 2.4.33. I've simplified the situation as far as possible, but have run into a wall. I'm working within a virtualhost ...
0
votes
3answers
911 views

Disable server signature on nginx with modsecurity

I have compiled modsecurity and headers_more_module with nginx(1.13.6) on my ubuntu server. When modsecurity is not enabled at the nginx configuration, I am able to hide the origin server's name in ...
1
vote
1answer
156 views

How to deactivate base64 logging in modsecurity

In my modsecurity audit log there are base64-encoded Images which were logged from owncloud uploads. How can I add a custom rule in my virtualhost definition so that uploads are not logged as base64-...
0
votes
0answers
43 views

How disable modsecurity rule only for specific parameter?

I have a web service that uses base64-encoded string for some parameter, and it is very frequently hit by modsecurity's many rules. Is it possible to disable all rules for these specific parameters?
0
votes
0answers
49 views

ModSecurity Change HTTP Response Code

I would like to know if there is a way to change the HTTP response code using mod security & if so an example sec/rule to do the same. This is w.r.t handling enumeration attacks. I wouldn't like ...
2
votes
2answers
794 views

ModSecurity not working on IIS

I've installed the ModSecurity IIS module on a Windows Server 2012 VM. I have a simple test application running on its own app pool. default.aspx -- Just a simple page that spits out the date/time. ...
0
votes
2answers
265 views

Docker multi-stage build with nginx and modsecurity - cannot open shared object

I have created a docker multi-stage build to be able to end up with a small, lean container with the most recent nginx version and some modules compiled from source. At the end I copy over the binary ...
0
votes
0answers
15 views

Mod Security and XML

I have enable mod_security (2.4) to add security to my application, but I have a problem. My application sends a request to the server that can be simple text or XML. When I send text the application ...
1
vote
1answer
94 views

Configuring modsecurity for nginx

I have installed nginx using apt-get and now I want to implement modsecurity, a web application firewall on it now. All the solutions and procedures available online show the manual configuration of ...
0
votes
0answers
85 views

Could a WordPress plugin communicate with ModSecurity in this stack?

I am configuring a modern web stack. Basically it is a LAMP stack. Apache is set to use Event MPM. It will directly work with files and directories, as I'm running WordPress which has plugins relying ...
2
votes
1answer
207 views

Mod security anomaly scoring in the audit log

I have configured my anomaly scoring level to 8 within my CRS-setup.conf When I review my audit log I see the following entry: --f0d8a724-H-- Message: Warning. detected XSS using libinjection. [file ...
3
votes
1answer
320 views

Apache 2.2 / CentOS: Denying Bad Bots

I'm having all kinds of problems trying to restrict bad bots on my Apache 2.2 server, and am hoping somebody can assist. I have banged my head on the wall for days trying to get this working, and ...
2
votes
1answer
41 views

Some mod_security rules not being applied

We've been seeing a lot of referral spam to one of our servers so I decided to add some custom modsecurity rules to try and stop at least some of them. I've added several rules, for instance : ...
0
votes
1answer
393 views

Mod_security exclusion not fully working, still blocking CSS and images

I have put either of the following in my rules: SecRule REQUEST_URI "@beginsWith /directory" "phase:1,id:12345,allow" SecRule REQUEST_URI "@beginsWith /directory" "phase:1,id:12345,ctl:ruleEngine=off"...
0
votes
1answer
221 views

Mod security exceptions not working

I would like to exclude a directory from mod security. I have tried everything under the sun in every config file to no avail. I have put stuff in the vhost file, the crs-setup file, the modsecurity....
0
votes
2answers
360 views

Submit form forbidden when Enabling modsecurity crs sql injection

My site turns on Ubuntu 16, Apache 2.4, php 5.6 and I use the CMS Drupal 8 I installed the module mod_security. I activated it then I enabled the modsecurity_crs_41_sql_injection_attacks.conf. For ...
2
votes
1answer
748 views

Apache cannot access mod_security log

I have an Apache2 server that cannot access the mod-security log: prim@x.x.x.x:~$ apachectl -V AH00526: Syntax error on line 196 of /etc/modsecurity/modsecurity.conf: ModSecurity: Failed to open the ...
0
votes
1answer
618 views

Apache LocationMatch not matching

I'm trying to set up request throttling for certain sensitive URIs in an apache (v2.2) virtualhost with mod_security, but finding trouble with the use of LocationMatch. So far the configuration is as ...
0
votes
1answer
7k views

Can't increase max POST size in Apache2

I'm trying to increase the POST requests size in order to let the users upload "big" files, after lots of "413 Request Entity Too Large" errors with small uploads (around 2 Mb). My Apache2 is running ...
1
vote
0answers
2k views

mod_security gives “Multipart parser detected a possible unmatched boundary” for Wordpress

I have mod_security (apache2) installed on my server hosting Wordpress websites. When I attempt to install a plugin by uploading a .zip file from the disk it fails with 403 Forbidden and "Multipart ...
0
votes
1answer
605 views

Can I print apache environment variable in error log?

I want to print mod_security anomaly score to apache error log. I use setenv to set enviroment variable, and %{name}e syntax to print it in log. Modsecurity config: SecAction "id:90100,phase:5,pass, ...
-1
votes
1answer
289 views

specify the order of IDS , Firewall , WAF

i have an ubuntu system and i want to implement iptables as firewall, modsecurity as WAF and snort as IDS in this system and i have a server behind this system and i want to protect the server with ...
1
vote
1answer
725 views

Mod_evasive No logs, No IP blocking, No errors - What's going on?

I'm experiencing an anomaly on my Ubuntu 16.04 Machine. I installed LAMP, ufw, fail2ban e now as a DOS protection I installed mod_evasive. Mod_evasive doesn't seem to block anything, doesn't log ...
1
vote
1answer
218 views

Exclude sensitive data from modsecurity log

I'm setting up Modsecurity, and I have noticed that some sensitive data (credit card numbers) ends up in the log. How should I prevent this? Preferably I would want it logged, but with the sensitive ...