Questions tagged [mod-security]

ModSecurity supplies an array of request and response filtering rules and other security features to the Apache HTTP Server. ModSecurity is an open source web application layer firewall.

Filter by
Sorted by
Tagged with
0 votes
0 answers
10 views

How to block the executable file upload in web server

I am working on a web app project to block all the file executable from file upload. Example: user can upload, txt, png, image and video files and not any executable scripts like, Perl, Python, exe, ...
user avatar
  • 205
0 votes
0 answers
10 views

mod-security denying post method due to client's text matching pattern

I have a PHP application where a form has HTML textarea tag to collect multiline text. One of our client was having trouble posting, and we couldn't recreate the issue until we tried the exact text. ...
user avatar
0 votes
0 answers
13 views

Custom.regex.pm for CSF with mod security

I'm trying to create custom rule that block 403 access triggered by mod security, my modsec audit log look like this: 2022-06-14 02:15:19.241467 [INFO] [1554] [123.123.123.123:597-Q:189D4DD7523532AE-...
user avatar
  • 153
0 votes
0 answers
6 views

When Modsec is turned on. Google Publisher centre cannot read my RSS feeds

I have a strange issue with this When I have modsec turned on. My Google News RSS feeds wont work, And I cannot get instant indexing to work because the feeds wont show in my publisher centre. if I ...
user avatar
2 votes
0 answers
31 views

Efficient and comfortable mod_security monitoring with sentry.io or similar tools? [closed]

When using mod_security one might drown in error reports. sentry is a comfortable tool to monitor software errors, sort them, ignore unimportant ones and so on. I was wondering if it is possible to ...
user avatar
  • 456
1 vote
0 answers
21 views

ModSecurity: Block all IPs except for a list of defined IPs

I have an apache server with ModSecurity. I need to block all IPs except for a few ones. The list of IPs is like this: 194.83.128.0/21 191.143.32.0/19 145.126.72.0/21 101.28.248.0/22 40.64.64.0/22 180....
user avatar
  • 111
0 votes
0 answers
114 views

Nginx and Modsec version mismatch

I have installed nginx and modsec roughly following this tutorial https://www.linuxcapable.com/how-to-install-modsecurity-with-nginx-on-ubuntu-20-04/. After a couple of months working perfectly I am ...
user avatar
0 votes
0 answers
60 views

Mod_Security prevent brute force for Joomla

I am trying to find/create a Mod_Security rule to detect & block multiple login failures on the latest version of Joomla. I found an answer from March 2015 here: https://serverfault.com/a/646608/...
user avatar
  • 1
0 votes
0 answers
20 views

Modsecurity & LEMP Server Running Wordpress - Rule Exclusions for iOS Wordpress app

I am very new to mod-security, and have been struggling quite a bit with rule exclusions that are beyond the scope of examples shown in this tutorial from Linuxbabe.com. I am running a Wordpress LEMP ...
user avatar
  • 63
0 votes
1 answer
107 views

ModSecurity 403, COMODO WAF detects XSS while trying to access phpMyAdmin

I have a copy of phpMyAdmin in one of my server in a subdomain 'pma' and inside a directory in it named 'app' (manual installed from zip archive, not via yum), which I use for DB related management ...
user avatar
0 votes
0 answers
37 views

mod_security blocks redirects (to non-www and https)

httpd-vhosts.conf <VirtualHost *:80> ServerName example.com ServerAlias www.example.com DocumentRoot "c:/web/www/mysite" Alias /.well-known c:/web/www/...
user avatar
  • 1
0 votes
0 answers
23 views

Modsecurity Not working with beautified URLs

I have modsecurity on nginx and everything works except for URL like below: https://example.com/input_1.3=6111163&id=1' and 1=1 -- But it works for this one: https://example.com?input_1.3=6111163&...
user avatar
  • 146
0 votes
0 answers
64 views

Modsecurity failed to load configuration

Evening, i got some problem here. I compiled modsecurity into standalone mode and using haproxy too. I ran in -p 81 -f crs-setup.conf -d then it works. But, when i adding "Include /etc/..../rules/...
user avatar
  • 1
0 votes
0 answers
82 views

How to use modsecurity on AWS EC2 with ELB

Query attacks from outside are too frequent since AWS EC2 was used. AWS WAF is too expensive and burdensome. I'm trying to install modsecurity inside the server, but it's not working properly because ...
user avatar
0 votes
0 answers
51 views

Installing ModSecurity on NGINX

I'm trying to set up a reverse proxy using NGINX on CentOS7 and ModSecurity for use in between an Exchange server and the internet. I'll be honest and say I'm not all that great with Linux, but I've ...
user avatar
0 votes
1 answer
43 views

Which protections can I use on the server

I have read about server protection and I know how to work with fewalld protection because it is not demanding. My question is: Which of the following protections is best for the server and which of ...
user avatar
  • 17
0 votes
0 answers
27 views

Rewrite POST variable using modsecurity

Exists some way to rewrite POST form variables using modsecurity? This must be done before proxypass to backend. I was trying some rules unsuccessful. The test request is curl -i -X POST -d "...
user avatar
0 votes
0 answers
254 views

Prevent SlowLoris attack with ModSecurity (Apache)

I'm unable to stop a SlowLoris attack using ModSecurity in my apache (2.4) server from a computer that is in the same network. I'm on Debian 11. I add this to the /etc/modsecurity/modsecurity.conf : ...
user avatar
1 vote
1 answer
188 views

How to get the remote hostname resolved through DNS when using Nginx and ModSecurity?

The question mod_security with OWASP CRS: Custom rule for whitelisting googlebot provides the following rule as the answer to verify the client's hostname: SecRule REMOTE_HOST “@rx google(bot|)\.com$” ...
user avatar
  • 123
0 votes
0 answers
22 views

Where does modsecurity2 log to by default?

I'm running an Ubuntu 20.04 testbed with Apache2. I've installed modsecurity2 from the default repos. Hunting around, I can't seem to find logging output. Where does it log to by default on Ubuntu 20....
user avatar
  • 133
0 votes
1 answer
91 views

How to reduce Modsecurity disk IO

Modsecurity generates a lot of disk io operations, and the file www-data-ip.pag is read and written continuously. Is there any solution that can effectively reduce this? Could it be moved to RAM in ...
user avatar
  • 205
0 votes
1 answer
127 views

How do I set the anomaly score in crs-setup.conf?

I am using v3.0.0 of CRS with ModSecurity set to DetectionOnly mode and the nginx connector. I want to set the anomaly score to 100 or so to fine-tune the settings, but I can't see where or how to do ...
user avatar
0 votes
0 answers
290 views

Can't get docker image owasp/modsecurity-crs:apache reverse proxy to work

I have an endpoint https://my-portal.nl and I wan't to place a WAF with the OWASP Core rule set before it. So I found a Docker image(owasp/modsecurity-crs:apache) that can proxy all the requests to my ...
user avatar
  • 1
0 votes
1 answer
49 views

Is it okay to use core ruleset v3.3 on modsecurity v2.9

I am just a beginner in the field of security. I have installed ModSecurity v2.9 on my server using this link. But GitHub repository for the core rule set in the link was outdated, so later I removed ...
user avatar
0 votes
2 answers
338 views

How do I restrict a specific client, based on their host name, with ModSecurity SecRule?

I am trying to restrict specific hosts (e.g. AWS) from accessing my webserver. I tried different variations of these but it doesn't work. # Block AWS SecRule REQUEST_HEADERS:Host ".*\.amazonaws\....
user avatar
  • 81
0 votes
1 answer
440 views

mod_security with OWASP CRS: Custom rule for whitelisting googlebot

I am about to use OWASP CRS rules with mod_security on my WHM/cPanel enabled CentOS server (with apache). But I fear that accidentally Googlebot may be blocked by one rule or the other. After enabling ...
user avatar
  • 101
0 votes
1 answer
42 views

OWASP-CSR on ATS

I have some Apache Traffic Servers that use in CDN platform. Is it possible to configure OWASP-CSR on Apache Traffic Server? If yes, how can I implement it?
user avatar
0 votes
1 answer
524 views

Cannot find rule ID to whitelist an IP in ModSecurity

I have a local IP that was apparently banned. I would like to whitelist it. The subnet is already in my /etc/modsecurity/modsecurity.conf file: SecRule REMOTE_ADDR "@ipMatch 192.168.0.0/19" &...
user avatar
0 votes
1 answer
35 views

My centOS 7 minimal font screwed up when trying to tail modsecurity audit log

My font display was completely normal. But right after i cat or tail /var/log/modsec_audit.log, my font becomes like this. Any solution? Image link: https://i.stack.imgur.com/XkIyj.png
user avatar
1 vote
2 answers
124 views

Apache modsec + ssl proxy loop

I have a server where we have the following setup: http://example.com -(REDIRECT)-> https://example.com Now we would like to add a simple ssl proxy(on the same machine where the A record is also ...
user avatar
0 votes
1 answer
229 views

Which actions are retained on SecRuleUpdateActionById changes from the original rule?

So, SecruleUpdateActionById requires relisting action flags. At least that's my reading of "actions that can appear only once are overwritten". Which is fairly obvious for most of them, but ...
user avatar
  • 125
2 votes
0 answers
301 views

How to make mod_remoteip and mod_evasive work together

I have several Cento7 machines running Apache 2.4. They are behind a load balancer. The load balancer pass X-Forwarded-For header with client IP. In order to have mod_evasive to use the real client IP,...
user avatar
0 votes
0 answers
368 views

Compile ModSecurity 3.3 with YAJL

anyone could help? I'm stucked on this. I already compiled ModSecurity 3.3 on this machine (followed these instructions). Now I'm trying to compile with YAJL (Yet Another JSON Library) to be able to ...
user avatar
  • 1
0 votes
1 answer
383 views

apache server responding 403 to some clients, for a wordpress site

I rented a barebone server, installed Centos 7, then centos web panel, with server set to apache only, using apache 2.4.4x and php 7. I set up a wordpress site on one of the vhost, after editing for a ...
user avatar
0 votes
1 answer
405 views

REQUEST_URI exact match modsecurity

I need deny a portion of an url with modsecurity , example: index.php?page_num=users I have implemented this rule: SecRule REQUEST_URI "/index\.php\?page_num=users" "id:10000100,phase:1,...
user avatar
  • 1
0 votes
1 answer
453 views

Why don't the CRS rules in ModSecurity block all threats?

I'm in the process of configuring the new Ngnix v1.18.0 server together with ModSecurity-nginx v1.0.1. I've added OWASP CRS 3.3.0 rules to the configuration. Unfortunately, I can't clearly tell if the ...
user avatar
2 votes
2 answers
231 views

mod_security 403 forbidden response is returning homepage content with WordPress mod_rewrite

I'm using mod_security on various websites, some WordPress and some not. I notice that on a non WordPress website the following: https://test-site.com/?exec=/bin/bash returns a 403 forbidden error ...
user avatar
  • 345
0 votes
1 answer
633 views

How to automatically block with MODSEC or CSF an IP Address when it tries to access a URL

We have in our server logs every day continuos bot trying to access the below for example: Requests with error response codes 404 Not Found /favicon.ico: 3 Time(s) /3ckkB-ZOp30: 2 Time(s) /adminer-3....
user avatar
0 votes
1 answer
107 views

modsecurity3: replace rule with a custom one for a specific URI

In a crs 3.2 there is a rule with ID=941320 which prevents CKEditor to work within drupal. CKEditor is a wysiwyg that produces html and attempts to upload it to server. Modsecurity 3 with crs blocks ...
user avatar
  • 1
1 vote
1 answer
483 views

mod_security: How to log POST requests for specific URI ONLY?

I am currently running Apache 2.4.25 on Debian 9.8. I'm trying to set up mod_security to log POST request payloads for a specific URI. I have several API on a Debian server and I have to log all of ...
user avatar
0 votes
1 answer
512 views

ModSecurity won't apply rules - no error log entries

I have a fresh installation of CentOS 8. I installed Apache 2.4.37 from the repo. Then installed the latest ModSecurity: dnf install mod_security -y Checked the installation dnf info mod_security ...
user avatar
  • 171
0 votes
0 answers
162 views

WAF(modsecurity) / Plesk IP Banned, is it Googlebot? Is it a false positive? Is it a malicious IP?

I was alerted by my Plesk server that an IP Address had been banned. Normally I don't check banned IPs, but this one happened to coincide with our site going down for 1 minute at the same time. Banned ...
user avatar
  • 141
0 votes
0 answers
223 views

Rule 933160 violated even though it's been excluded

I've installed nginx with modsec with the following versions: Modsec verion: v3.0.3 Nginx version: 1.13.6 and I've excluded rule 933160 as followed: SecRule REQUEST_URI "@beginsWith /a/b/c/d&...
user avatar
  • 155
1 vote
2 answers
1k views

ModSecurity blocks legitimate client requests

Randomly, the modsecurity blocks legitimate clients requests giving the error 403. Here is para of the modsec_audit.log: ---d6e99f36-A-- [21/Jun/2020:07:14:45 +0100] Xu761X8AAAEAADI1YrAAAABQ xxx....
user avatar
0 votes
1 answer
530 views

Changing time format in Modsecurity log

I wonder if it's possible to change time format which Modsecurity 3 uses in its audit log. I came across that time format differs depending on SecAuditLogFormat setting. When it's Native, timezone is ...
user avatar
  • 11
4 votes
2 answers
4k views

How to exclude ModSecurity rules by hostname?

I'm using OWASP core rule set 3.2.0 set up with ModSecurity 3.0.4 and ModSecurity-nginx. If I have a rule exclusion like this, in REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf: SecRule REQUEST_URI "@...
user avatar
  • 298
1 vote
0 answers
431 views

mod_evasive triggering client denied by server configuration: from SquirrelMail download.php

mod_evasive is triggering the below errors from SquirellMail on Apache 2.4.43-1 on Fedora 31. And since this causes a 403 Forbidden error, Fail2ban is also triggered and blocks the IP, as it appears ...
user avatar
1 vote
0 answers
788 views

ModSecurity, Create an IP Blacklist file

We have a list of IPs that we want blocked. I currently have them blocked at the firewall, I would like to create a file that ModSecurity will read, and block those IPs. This is a pretty big list, as ...
user avatar
  • 11
0 votes
1 answer
1k views

Apache2 mod_evasive for only one virtual host

I'm testing a scenario where, I'm hosting two-site on same machine with help of apache web server. I'm looking to enable mod_evasive for only one site. I don't see any way to get it working. Following ...
user avatar
  • 1
1 vote
0 answers
2k views

Modsecurity...Host header is a numeric IP address Cannot serve directory no matching directoryindex

my system is Debian 9 Apache2 php-fpm i am experiencing an error with one of the websites on my webserver. I have tried adding an index.html file into the public_html directory (and disabling ...
user avatar
  • 11

1
2 3 4 5
7