Questions tagged [mod-security]

ModSecurity supplies an array of request and response filtering rules and other security features to the Apache HTTP Server. ModSecurity is an open source web application layer firewall.

Filter by
Sorted by
Tagged with
1
vote
2answers
29 views

How to exclude ModSecurity rules by hostname?

I'm using OWASP core rule set 3.2.0 set up with ModSecurity 3.0.4 and ModSecurity-nginx. If I have a rule exclusion like this, in REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf: SecRule REQUEST_URI "@...
0
votes
0answers
30 views

mod_evasive triggering client denied by server configuration: from SquirrelMail download.php

mod_evasive is triggering the below errors from SquirellMail on Apache 2.4.43-1 on Fedora 31. And since this causes a 403 Forbidden error, Fail2ban is also triggered and blocks the IP, as it appears ...
0
votes
0answers
22 views

Is there a security option on Linux servers that stops the submission of certain HTML tags in forms [closed]

One of our client's websites has started showing some strange behaviour. When a <form> tag is submitted on a form, the POST method seems to refuse to accept it. It produces the following error......
0
votes
0answers
13 views

ModSecurity, Create an IP Blacklist file

We have a list of IPs that we want blocked. I currently have them blocked at the firewall, I would like to create a file that ModSecurity will read, and block those IPs. This is a pretty big list, as ...
0
votes
0answers
13 views

Apache2 mod_evasive for only one virtual host

I'm testing a scenario where, I'm hosting two-site on same machine with help of apache web server. I'm looking to enable mod_evasive for only one site. I don't see any way to get it working. Following ...
0
votes
0answers
15 views

Writing ModSecurity Rule to inspect Body and/or Cookie

Can someone give me insight on how to write a ModSecurity Rule To inspect for either ToBinary or ToString It would be in form fields, Body or cookies of the request sent to our web server.
0
votes
0answers
23 views

Modsecurity…Host header is a numeric IP address Cannot serve directory no matching directoryindex

my system is Debian 9 Apache2 php-fpm i am experiencing an error with one of the websites on my webserver. I have tried adding an index.html file into the public_html directory (and disabling ...
0
votes
0answers
36 views

ModSecurity not writing to new rotated log files?

I've the following logs rotation set up in the OS for nginx's and modsec's logs, and it works for nginx's logs but not for modsec's. The result for modsec is that, it made a copy for the log file but ...
0
votes
0answers
16 views

ModSecurity3.0 + Nginx + DDOS is there any way to configure the rules?

I read in documentation by Nginx, that ModSecurity 3.0 is not supporting DDOS mitigation rules(REQUEST-912-DOS-PROTECTION.conf) for Nginx. That documentation was published in 2018, Any idea is there ...
0
votes
0answers
13 views

How to use modsecurity RemoveTargetById to modify an existing rule

I have a rule I am trying to modify for just one host. Here is the rule: SecRule REQUEST_FILENAME "@pmFromFile restricted-files.data" \ "id:930130,\ phase:2,\ block,\ capture,\ t:...
0
votes
0answers
101 views

Apache too many child process - mpm_event caught SIGTERM shutting down

My Apache with ModSecurity, mod_evasive20 enabled occasionally geting crashed: These are glimpse of error log: [core:warn]**: child process 24709 still did not exit, sending a SIGTERM [core:error]**:...
0
votes
0answers
22 views

No space left on device alert for mod_security

Following error in mod_security error log: /var/lib/mod_security/default_SESSION": No space left on device We are using DETECTION_ONLY. ls -lh /var/lib/mod_security total 11M -rw-r----- 1 daemon ...
0
votes
0answers
16 views

Can I disable ModSecurity when a specific IP is in the X-Forwarded-For header?

We have an external WAF that should handle any security rules, however I want mod_security to be enabled if any request hits the server directly. If the X-Forwarded-For Header looks like "1.2.3.4, 10....
0
votes
0answers
17 views

ModSecurity 3 - POST hitting rule 2x and getting 403 while GET only 1x (no 403)?

Doing some testing on site I'm working on (without a name/domain currently which is TBD). I can HTTP GET resources fine, although ModSecurity throws warnings that my request hostname was only IP ...
1
vote
1answer
16 views

mod_security default_SESSION.pag file huge size

default_SESSION.pag file showing 575G though df -h showing less. /dev/xvda1 40G 19G 19G 51% / What for this default_SESSION.pag file actually used? It is updated when there is entries ...
0
votes
1answer
88 views

Apache2 error “ModSecurity: Found another rule with the same id” Ubuntu18.04

downloaded v3.2.0 https://coreruleset.org/installation/ following instructions located in file INSTALL But apache cannot start and returns this error - AH00526: Syntax error on line 800 of /etc/...
0
votes
1answer
19 views

Can mod_security be configured to create log only?

I've installed mod_security on openSUSE and want to make it log only. I want absolutely no blocking or filtering of any kind. I've created a config file as: SecAuditEngine On SecAuditLog /siteA/...
0
votes
1answer
104 views

Modsecurity only allow access from two particular REFERER HEADERs

I have a Modsecurity rule which blocks all requests where the browser Referer Header is different from this: sub1.example.com. So basically the rule only allows requests when the Header Referer is ...
0
votes
0answers
42 views

mod_security does not block invalid URI requests

I am quite new to Modsecurity and need some help to secure my development server. I have Apache 2.4 installed with Mod Security 2.8.0 I have also installed OWASP ModSecurity Core Rule Set ver.3.2.0 ...
0
votes
0answers
138 views

Syslog and modsecurity logging

I need to send syslog from e.g. /var/log/modsecurity.log. The main question is how to send logs from modsecurity as one item/event, e.g.: --id(2646as12)--A data --id(2646as12)--B data --id(2646as12)...
0
votes
0answers
41 views

ModSecurity rules for Wordpress running on IIS server for blocking multiple login tries (unable to use Locationmatch)

has someone tried to run ModSecurity on IIS server and block login attempts to wp-login.php (xmlrpc.php too) after X tries in some period of time (or without any period of time but after Z seconds ...
1
vote
1answer
104 views

Apache - Custom error page returning error AH01071 only for file requests

I have a site hosted with a shared hosting provider. It is an Apache with FPM/FastCGI and PHP 7.2 Being shared hosting, the only configuration I have access to is htaccess, but obviously not any of ...
0
votes
1answer
132 views

ModSecurity dependency not found?

1. yum groupinstall 'Development tools' 2. yum install -y geoip-devel libcurl-devel libxml2-devel libxslt-devel libgb-devel lmdb-devel openssl-devel pcre-devel perl-ExtUtils-Embed yajl-devel zlib-...
0
votes
1answer
67 views

Drop and Nolog HTTP CONNECT request with modsecurity

In my virtualhost I have this modsecurity setup SecRuleEngine On SecRule REQUEST_METHOD "@streq CONNECT" "id:1,nolog,drop,phase:1" Despite the 'nolog' instruction I got in apache access log the ...
0
votes
1answer
134 views

mod security blocking basic authentication

I have a vps with centos 7, apache with mod_security and mod_evasive. I have a form in php with basic authentication. When I try to authenticate through the application (before activating mod security ...
0
votes
1answer
389 views

mod_security X-Forwarded-For not being blocked

I made some changes to my config as per this suggestion: SecAction \ "id:901321,\ phase:1,\ pass,\ t:none,\ nolog,\ initcol:global=global,\ initcol:ip=%{x-forwarded-for}_%{...
0
votes
0answers
123 views

Logging POST request body in modsecurity

Hello I'm using libmodsecurity (4e6e4243|v3.0.3) on nginx(1.15.12) with the connector being the current master (d7101e13685) and OWASP CRS on (ab24a20faf28156f0|v3.1.0). I am trying to log the POST ...
0
votes
1answer
325 views

ModSecurity CRS 3 - Disable SQLi Rule For URI Pattern

I am trying to disable rule 942100 (an SQLi rule) when certain values are present in the URI, but apache won't start so something is wrong. My attempt (in REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf):...
0
votes
1answer
108 views

ModSecurity, expirevar wont work

I've enabled modsecurity in my nginx k8s ingress using this guide, then I've added the following custom rules to block potential brute force attack # Block by ip # Retrieve the username SecAction "...
0
votes
2answers
79 views

Can Modsecurity detect and block infected client computers that connect to a server?

I have the latest version of Modsecurity (as of March 25th 2019) installed on my server. I am using OWASP rulesets along with fail2ban on Linux. I know it is designed to block hacking attempts. ...
0
votes
1answer
624 views

Updating ModSecurity when using OWASP rule sets

I am somewhat new to Modsecurity and still have a long way to go so bear with me. Ubuntu 18.04 I'm currently running Modsecurity 2.9.2-1 and OWASP rules 3.0.2 I would like to update the rules to ...
1
vote
1answer
78 views

Modsecurity - entire web pages being posted to log

I am running the latest version of Modsecurity on Ubuntu 18.04 and I'm having an odd problem that I cannot find through searching. The problem is that certain visitors to my server are posting the ...
0
votes
0answers
50 views

My nginx log not read the web activity in real time

I am confused, my nginx log does not read the web activity in real time. The log will tell what happens after several time (it is hours ). Do you know why? Thanks
0
votes
1answer
1k views

ModSecurity for Apache 2.4.34 Failing with Invalid command 'SecRuleEngine'

I have A Ubuntu 18.04 server, installed Apache 2.4.34, and have compiled ModSecurity 3 with the apache module. I can successfully load the module, by adding: LoadModule security3_module modules/...
1
vote
1answer
259 views

Whitelisting browser agents in ModSecurrity

I'm using ModSecurity WAF with Apache. I wanted to know if there's a way I can restrict to only few browser agent type? I want to do this for two reasons: Force the users to use an updated browser. ...
1
vote
1answer
425 views

Can I setup redirects with Modsec?

The web servers I managed are all running Apache 2.4 with Modsec. Is it possible to write a rule that will serve up a different page if matched by Modsec? I want this to be independent of the domain. ...
0
votes
0answers
54 views

Apache modsecurity and htaccess which comes first?

Are htaccess rules executed before modsecurity rules? Sending illegal requests to couple of domains some of them trigger modsecurity but some of them with same illegal requests are not showing ...
0
votes
0answers
201 views

Mod security syntax error

when i ran the command apache2ctl configtest it is showing this error AH00526: Syntax error on line 193 of /etc/modsecurity/modsecurity.conf: ModSecurity: Failed to open the audit log file: /var/log/...
0
votes
0answers
601 views

PHP is not working after installing ModSecurity for NGINX on Ubuntu 16.04

My server is running on Ubuntu 16.04. One of my web app(php app) was running on my nginx server. To install ModSecurity I removed the NGINX completely and then followed the following steps to complie ...
1
vote
2answers
1k views

ModSecurity SecRule based on original browser url, not internal rewrite (index.php, app.php, etc.)

I'm working on a Symfony 2 site, and am trying to create a ModSecurity rule to match a particular browser URL. IE example.com/results Symfony 2 internally rewrites all requests to app.php using ...
0
votes
1answer
252 views

SPOE and modsecurity contrib Failed to decode HELLO frame

I'm compile modsec as described in the instructions contib/modsec/README, but have the next errors: # /usr/local/bin/modsecurity -n 4 -d -f /etc/haproxy/waf/modsecurity.conf 1534409877.286475 [00] ...
1
vote
1answer
176 views

How to use modsecurity with lighttpd

I'm not an expert and I'm looking to use modsecurity with lighttpd Can someone explain me how to compile or install modsecurity for lighttpd because I can't find any documentation online
-1
votes
1answer
743 views

Modsecurity block request

How can I block in modsecurity these requests: 12.54.87.55:443 https://12.54.87.55 tried SecRule REQUEST_URI "12.54.87.55:443" phase:1,id:1008,log,deny,status:403 but seems like it's not working....
1
vote
1answer
2k views

ModSecurity: setenv within SecAction not effective

I am trying to debug an issue with ModSecurity. Using ModSecurity 2.9.2 on Apache 2.4.33. I've simplified the situation as far as possible, but have run into a wall. I'm working within a virtualhost ...
0
votes
3answers
3k views

Disable server signature on nginx with modsecurity

I have compiled modsecurity and headers_more_module with nginx(1.13.6) on my ubuntu server. When modsecurity is not enabled at the nginx configuration, I am able to hide the origin server's name in ...
1
vote
1answer
330 views

How to deactivate base64 logging in modsecurity

In my modsecurity audit log there are base64-encoded Images which were logged from owncloud uploads. How can I add a custom rule in my virtualhost definition so that uploads are not logged as base64-...
2
votes
2answers
2k views

ModSecurity not working on IIS

I've installed the ModSecurity IIS module on a Windows Server 2012 VM. I have a simple test application running on its own app pool. default.aspx -- Just a simple page that spits out the date/time. ...
0
votes
3answers
469 views

Docker multi-stage build with nginx and modsecurity - cannot open shared object

I have created a docker multi-stage build to be able to end up with a small, lean container with the most recent nginx version and some modules compiled from source. At the end I copy over the binary ...
1
vote
1answer
116 views

Configuring modsecurity for nginx

I have installed nginx using apt-get and now I want to implement modsecurity, a web application firewall on it now. All the solutions and procedures available online show the manual configuration of ...
2
votes
1answer
408 views

Mod security anomaly scoring in the audit log

I have configured my anomaly scoring level to 8 within my CRS-setup.conf When I review my audit log I see the following entry: --f0d8a724-H-- Message: Warning. detected XSS using libinjection. [file ...

1
2 3 4 5 6