Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [mod-security]

ModSecurity supplies an array of request and response filtering rules and other security features to the Apache HTTP Server. ModSecurity is an open source web application layer firewall.

-1
votes
0answers
23 views

Apache security - Drupal 8 related

In one of the log entries I see something strange which to me suggest an attempt to execute code. I have never seen this and cannot yet decipher this, does anyone have any idea what this log entry ...
0
votes
0answers
14 views

Wordpress wp-admin login behind modsecurity reverse proxy

Ok, i've been fighting with this error, and I'm running out of options. I have previously asked a question with a redirect issue when accessing /wp-admin: wp-admin redirect loop when behind apache ...
0
votes
2answers
63 views

Can Modsecurity detect and block infected client computers that connect to a server?

I have the latest version of Modsecurity (as of March 25th 2019) installed on my server. I am using OWASP rulesets along with fail2ban on Linux. I know it is designed to block hacking attempts. ...
0
votes
0answers
14 views

Libapache2-mod-security2 causes error 403 and prevents access even after uninstall

I have an Ubuntu 18.04 server with Nextcloud installed in an Apache2 (Apache/2.4.29 (Ubuntu)) virtual host. I am using PHP 7.3. In an attempt to harden the server, I installed libapache2-mod-security2....
0
votes
0answers
19 views

Is it safe / OK to send ModSecurity Detail Logs to an ISP after hack attempts?

Would it be ill advisable to send a copy of the Mod Security Audit Log to an ISP abuse department after a hack attempt? Someone just tried an SQL Injection attack against my server and fortunately ...
0
votes
1answer
181 views

Updating ModSecurity when using OWASP rule sets

I am somewhat new to Modsecurity and still have a long way to go so bear with me. Ubuntu 18.04 I'm currently running Modsecurity 2.9.2-1 and OWASP rules 3.0.2 I would like to update the rules to ...
1
vote
1answer
43 views

Modsecurity - entire web pages being posted to log

I am running the latest version of Modsecurity on Ubuntu 18.04 and I'm having an odd problem that I cannot find through searching. The problem is that certain visitors to my server are posting the ...
0
votes
0answers
42 views

Apache config test failed because of duplicate ID in mod security.conf

I have installed mod security and cloned the rules and then added the rules in security2.conf. <IfModule security2_module> # Default Debian dir for modsecurity's persistent data ...
0
votes
0answers
18 views

How to whitelist Ip so that the IP can pass the Mod_security rules

I am finding that mod_security 3.0.3 will block wordpress user to post an article. The question is How I whitelist an IP so that I can post an article via the IP ? Mod_security : 3.0.3 OS : Centos 7 ...
0
votes
0answers
18 views

My nginx log not read the web activity in real time

I am confused, my nginx log does not read the web activity in real time. The log will tell what happens after several time (it is hours ). Do you know why? Thanks
0
votes
0answers
80 views

Compilation Error : Nginx with pagespeed,http2,brotli and mod security

After searching for whole internet i didnt found anything on how to build all these together , there are tutorials for individual but not together so i tried on my own. Error : .........................
0
votes
1answer
226 views

ModSecurity for Apache 2.4.34 Failing with Invalid command 'SecRuleEngine'

I have A Ubuntu 18.04 server, installed Apache 2.4.34, and have compiled ModSecurity 3 with the apache module. I can successfully load the module, by adding: LoadModule security3_module modules/...
1
vote
1answer
17 views

Whitelisting browser agents in ModSecurrity

I'm using ModSecurity WAF with Apache. I wanted to know if there's a way I can restrict to only few browser agent type? I want to do this for two reasons: Force the users to use an updated browser. ...
0
votes
0answers
19 views

Can ModSecurity Sniffing on Mirror (SPAN) Trafic?

My Debian Linux has an interface which configured in promiscuous mode and receives Mirror (SPAN) Traffic from Cisco Switch. Is there any way to running ModSecurity for sniffing this traffic to ...
0
votes
0answers
54 views

Enable mod_security only for specific directory

Current settings: - mod-security 2.9 Mod-security itself work as expected if enabled globally with SecRuleEngine on on main config but I need to enable it only for one specific folder for testing ...
1
vote
1answer
56 views

Can I setup redirects with Modsec?

The web servers I managed are all running Apache 2.4 with Modsec. Is it possible to write a rule that will serve up a different page if matched by Modsec? I want this to be independent of the domain. ...
0
votes
0answers
37 views

Apache modsecurity and htaccess which comes first?

Are htaccess rules executed before modsecurity rules? Sending illegal requests to couple of domains some of them trigger modsecurity but some of them with same illegal requests are not showing ...
0
votes
0answers
48 views

Mod security syntax error

when i ran the command apache2ctl configtest it is showing this error AH00526: Syntax error on line 193 of /etc/modsecurity/modsecurity.conf: ModSecurity: Failed to open the audit log file: /var/log/...
0
votes
0answers
320 views

PHP is not working after installing ModSecurity for NGINX on Ubuntu 16.04

My server is running on Ubuntu 16.04. One of my web app(php app) was running on my nginx server. To install ModSecurity I removed the NGINX completely and then followed the following steps to complie ...
0
votes
0answers
57 views

how can I whitelist dyndns host in mod security?

I'm using mod security with apache on Debian 8 and I'd like to add an exception for my IP. However I'm behind a dynamic IP address so it keeps changing. Is there a way to whitelist a hostname instead ...
0
votes
0answers
251 views

ModSecurity false positive 941100 and 941160 when saving WordPress page

I'm relatively new to ModSecurity and I have been trying to get my head around the rules for weeks. When saving a page in WordPress I was getting the following in modsecurity_audit.log: Message: ...
1
vote
2answers
413 views

ModSecurity SecRule based on original browser url, not internal rewrite (index.php, app.php, etc.)

I'm working on a Symfony 2 site, and am trying to create a ModSecurity rule to match a particular browser URL. IE example.com/results Symfony 2 internally rewrites all requests to app.php using ...
0
votes
0answers
24 views

Mod-Security whitelist page or more narrowly with query string?

I'm getting some Mod-Security 2 rule false positives from content updates in my cms. (300015 - generic sql injection) Since all admin.php.* URLs are login-walled, is there any risk in whitelisting ...
0
votes
0answers
35 views

Modsecurity v3 CRS + Nginx - separate vhost inclusions

I have the following setup: Nginx 1.14 ModSecurity v3 CRS v3 ModSecurity nginx connector I want to be able to specify in every vhost different collection of rules. For example: vhost1: filter all ...
0
votes
0answers
75 views

Get total number of cookie's from modsecurity using LUA script

I'm trying to access total number of cookies sent in response intercepted by mod-security and passed to LUA script. Below is an example response from server HTTP/1.1 200 OK Date: Tue, 21 Aug 2018 ...
0
votes
0answers
119 views

SPOE and modsecurity contrib Failed to decode HELLO frame

I'm compile modsec as described in the instructions contib/modsec/README, but have the next errors: # /usr/local/bin/modsecurity -n 4 -d -f /etc/haproxy/waf/modsecurity.conf 1534409877.286475 [00] ...
1
vote
1answer
91 views

How to use modsecurity with lighttpd

I'm not an expert and I'm looking to use modsecurity with lighttpd Can someone explain me how to compile or install modsecurity for lighttpd because I can't find any documentation online
0
votes
0answers
33 views

Modsecurity connector does not allow rule update

I am using nginx and modsecurity compiled with nginx-modsecurity connector. When I try to add a custom rule: SecRuleUpdateActionById 200004 "allow" the following error occurs when nginx is restarted:...
-1
votes
1answer
226 views

Modsecurity block request

How can I block in modsecurity these requests: 12.54.87.55:443 https://12.54.87.55 tried SecRule REQUEST_URI "12.54.87.55:443" phase:1,id:1008,log,deny,status:403 but seems like it's not working....
1
vote
1answer
2k views

ModSecurity: setenv within SecAction not effective

I am trying to debug an issue with ModSecurity. Using ModSecurity 2.9.2 on Apache 2.4.33. I've simplified the situation as far as possible, but have run into a wall. I'm working within a virtualhost ...
0
votes
3answers
1k views

Disable server signature on nginx with modsecurity

I have compiled modsecurity and headers_more_module with nginx(1.13.6) on my ubuntu server. When modsecurity is not enabled at the nginx configuration, I am able to hide the origin server's name in ...
1
vote
1answer
168 views

How to deactivate base64 logging in modsecurity

In my modsecurity audit log there are base64-encoded Images which were logged from owncloud uploads. How can I add a custom rule in my virtualhost definition so that uploads are not logged as base64-...
2
votes
2answers
882 views

ModSecurity not working on IIS

I've installed the ModSecurity IIS module on a Windows Server 2012 VM. I have a simple test application running on its own app pool. default.aspx -- Just a simple page that spits out the date/time. ...
0
votes
2answers
281 views

Docker multi-stage build with nginx and modsecurity - cannot open shared object

I have created a docker multi-stage build to be able to end up with a small, lean container with the most recent nginx version and some modules compiled from source. At the end I copy over the binary ...
1
vote
1answer
96 views

Configuring modsecurity for nginx

I have installed nginx using apt-get and now I want to implement modsecurity, a web application firewall on it now. All the solutions and procedures available online show the manual configuration of ...
2
votes
1answer
224 views

Mod security anomaly scoring in the audit log

I have configured my anomaly scoring level to 8 within my CRS-setup.conf When I review my audit log I see the following entry: --f0d8a724-H-- Message: Warning. detected XSS using libinjection. [file ...
3
votes
1answer
346 views

Apache 2.2 / CentOS: Denying Bad Bots

I'm having all kinds of problems trying to restrict bad bots on my Apache 2.2 server, and am hoping somebody can assist. I have banged my head on the wall for days trying to get this working, and ...
2
votes
1answer
48 views

Some mod_security rules not being applied

We've been seeing a lot of referral spam to one of our servers so I decided to add some custom modsecurity rules to try and stop at least some of them. I've added several rules, for instance : ...
0
votes
1answer
420 views

Mod_security exclusion not fully working, still blocking CSS and images

I have put either of the following in my rules: SecRule REQUEST_URI "@beginsWith /directory" "phase:1,id:12345,allow" SecRule REQUEST_URI "@beginsWith /directory" "phase:1,id:12345,ctl:ruleEngine=off"...
0
votes
1answer
232 views

Mod security exceptions not working

I would like to exclude a directory from mod security. I have tried everything under the sun in every config file to no avail. I have put stuff in the vhost file, the crs-setup file, the modsecurity....
0
votes
2answers
395 views

Submit form forbidden when Enabling modsecurity crs sql injection

My site turns on Ubuntu 16, Apache 2.4, php 5.6 and I use the CMS Drupal 8 I installed the module mod_security. I activated it then I enabled the modsecurity_crs_41_sql_injection_attacks.conf. For ...
2
votes
1answer
798 views

Apache cannot access mod_security log

I have an Apache2 server that cannot access the mod-security log: prim@x.x.x.x:~$ apachectl -V AH00526: Syntax error on line 196 of /etc/modsecurity/modsecurity.conf: ModSecurity: Failed to open the ...
0
votes
1answer
672 views

Apache LocationMatch not matching

I'm trying to set up request throttling for certain sensitive URIs in an apache (v2.2) virtualhost with mod_security, but finding trouble with the use of LocationMatch. So far the configuration is as ...
0
votes
1answer
8k views

Can't increase max POST size in Apache2

I'm trying to increase the POST requests size in order to let the users upload "big" files, after lots of "413 Request Entity Too Large" errors with small uploads (around 2 Mb). My Apache2 is running ...
1
vote
0answers
2k views

mod_security gives “Multipart parser detected a possible unmatched boundary” for Wordpress

I have mod_security (apache2) installed on my server hosting Wordpress websites. When I attempt to install a plugin by uploading a .zip file from the disk it fails with 403 Forbidden and "Multipart ...
0
votes
1answer
624 views

Can I print apache environment variable in error log?

I want to print mod_security anomaly score to apache error log. I use setenv to set enviroment variable, and %{name}e syntax to print it in log. Modsecurity config: SecAction "id:90100,phase:5,pass, ...
-1
votes
1answer
297 views

specify the order of IDS , Firewall , WAF

i have an ubuntu system and i want to implement iptables as firewall, modsecurity as WAF and snort as IDS in this system and i have a server behind this system and i want to protect the server with ...
1
vote
1answer
789 views

Mod_evasive No logs, No IP blocking, No errors - What's going on?

I'm experiencing an anomaly on my Ubuntu 16.04 Machine. I installed LAMP, ufw, fail2ban e now as a DOS protection I installed mod_evasive. Mod_evasive doesn't seem to block anything, doesn't log ...
1
vote
1answer
239 views

Exclude sensitive data from modsecurity log

I'm setting up Modsecurity, and I have noticed that some sensitive data (credit card numbers) ends up in the log. How should I prevent this? Preferably I would want it logged, but with the sensitive ...
0
votes
1answer
707 views

mod_security on Apache 2.4: Can I disable all rules for a specific request element?

I have an application served by Apache, on which mod_security is enabled, and I have been successfully tuning exceptions to avoid false positives using the likes of: SecRuleUpdateTargetById 981260 !...