Questions tagged [mod-security]
ModSecurity supplies an array of request and response filtering rules and other security features to the Apache HTTP Server. ModSecurity is an open source web application layer firewall.
345
questions
0
votes
0
answers
5
views
Newbie: How to add mod_sec rule exception for specific use-case
maybe someone with experience or basic knowledge that knows what they're doing (unlike me :)) can help....
Currently, I have Ubuntu 20.04 installation with OpenLitespeed and Cyberpanel.
I've installed ...
-2
votes
0
answers
25
views
Website renders 403 errors on iPhone 13 and newer, but works perfectly on iPhone 12 and older. How to debug website for newer iPhones on LEMP server?
I have a live production website at https://www.mcmo.is . When I go to the site on my phone (iPhone 11) in safari, everything works perfectly and all of the links on the front page are clickable and ...
- 69
0
votes
0
answers
86
views
Is Apache mod_evasive really worthful
I read an article saying that apache mod_evasive is an old outdated module and does not real protection against Dos attack. After testing a scenario of load requests to a apache webpage it seems like ...
- 1
0
votes
1
answer
58
views
How enable modsecurity only one site? in edit .htaccess?
nano /etc/apache2/mods-enabled/security2.conf
<IfModule security2_module>
SecDataDir /var/cache/modsecurity
IncludeOptional /etc/modsecurity/*.conf
IncludeOptional /usr/...
0
votes
1
answer
51
views
bypassing mod_security for coding blog on dreamhost
I've written my own simple blog software to display syntax-highlighted code, and it all works perfectly on my localhost, but I'm having trouble with mod_security on my Dreamhost server.
[Wed Aug 02 06:...
- 101
0
votes
0
answers
37
views
Filtering Amazon servers by IP range AND URL
My server is often attacked by bots hosted on Amazon servers.
So I configured iptables to block the largest ip ranges from Amazon.
My problem is that let's encrypt use also Amazon servers to issue new ...
0
votes
0
answers
103
views
Modsecurity Nginx breaking Wordpress Woocommerce checkout page. Can't find working rule exclusions
I am running an Ubuntu 20.04 based LEMP server on a Raspberry Pi 4.
I am working on a Wordpress Woocommerce website at https://www.mcmo.is. Currently on iOS using Safari or Google Chrome, I can't get ...
- 69
0
votes
0
answers
233
views
Modsecurity block access from all countries except from a specific IP or specific remote host
I have the below 3 rules in modsecurity.
Rule 1: Block all countries defined as high risk except US:
SecAction \
"id:900600,\
phase:1,\
nolog,\
pass,\
t:none,\
setvar:'tx....
- 101
1
vote
0
answers
155
views
modsecurity regex not always matching simple rule
Im trying to create a simple modsecurity regex rule that stops processing the rules when a match is found and just returns status 200 on a POST request so that it doesnt continue and get blocked by ...
- 203
0
votes
1
answer
96
views
ModSecurity : How prevent the body to be displayed in the JSON output?
Using Modsecurity, I write the catched requests in a log, in a JSON format. The body field is too verbose for my ELK index, and generates a lot of parsing errors.
Can I disable the presence of the ...
- 123
0
votes
0
answers
27
views
Tx-Variable does not increment in modSecure
I use Apache2.4 and mod_security 2.
SecRuleEngine On
SecRule REQUEST_METHOD "@streq put" "id:12345,phase:1,pass,log,t:lowercase,chain,logdata:'TX:PUT_COUNT=%{tx.put_count}'"
...
- 173
0
votes
1
answer
125
views
ModSecurity : PCRE limit settings do not have any effects
I'm facing Rule execution error - PCRE limits exceeded (-8): (null). errors when I ask ModSecurity to analyse body data (using the SecRequestBodyAccess On directive).
I've read about the problem, and ...
- 123
0
votes
0
answers
26
views
mod-security replace characters in POST body
I want to replace all the non-alphanumerical characters in the request body (not in the parameters themselves, but their values) with nothing using mod-security. For example:
# Initial request
param-1=...
0
votes
0
answers
118
views
nginx IP Whitelist in http and stream directive
I use the following config for nginx with http and stream. Each of them should include the same IP whitelist.
The whitelist looks like this:
allow 78.153.123.0/20;
allow 2a01:123::/32;
deny all;
My ...
- 1
0
votes
0
answers
31
views
The ModSecurity WAF used with the authentication mode
I have two Apache VirtualHost allowing access to lists of files. The first directory or server is accessible without authentication. On the other hand, the second has the native Apache authentication ...
- 1
0
votes
0
answers
75
views
mod_security skips processing phase 2 rules looking for SecMarker
I'm trying to debug a mod_security2 issue where it at some point appears to stop processing phase:2 rules. I've installed libapache2-mod-security2 and modsecurity-crs from the default apt repositories ...
- 211
1
vote
1
answer
478
views
ModSecurity breaking the Wordpress Theme Editor - cannot write proper exclusion rules
This is a duplicate of a question I've just asked on StackOverflow, before realizing this was maybe a better place where to ask it.
I have ModSecurity 2.9.3 and the OWASP CRS 3.3.2 security rules ...
- 111
0
votes
1
answer
801
views
Modsecurity Rule that Would Block the IP After a Certain Amount of 403 Errors
I am trying to figure out how to write a ModSecurity rule that would block the IP from the server for a period of time when that IP is generating a certain amount of 403 errors, and I am struggling ...
0
votes
0
answers
271
views
Modsecurity Blocks the site on load because cdn-loop: cloudflare
A fresh install of Ubuntu 20.04, nginx version 1.23.2 and Modsecurity 3.3.4. When I visit www.example.com I get 403 Forbidden. When I change:
http {
modsecurity on;
to
http {
modsecurity off;
...
- 123
1
vote
0
answers
128
views
How to disable mod_security for a subdomain?
I'm trying to disable mod_security for a custom subdomain.
I tried to include the following in modsec/modsec2.user.conf.
SecRule SERVER_NAME "desktop.xyz.com" phase:1,nolog,allow,ctl:...
- 11
0
votes
0
answers
134
views
ModSecurity / CRS 3 - Tons of 920100 Warnings. Need Help Fixing/Explaining Rule Violation
Ubuntu 22.04
Nginx/1.23.2
ModSecurity-nginx v1.0.3
CRS 3.3.2
I found out today that my server froze up because ModSecurity created tons of log files 10GB each and the server ran out of disk space. ...
- 73
0
votes
1
answer
623
views
modsecurity wont start with an apache server
I have a Debian server where apache2 is running. I want to use modsecurity for throttling.
apache2 info
$ apache2ctl -v
Server version: Apache/2.4.29 (Debian)
Server built: 2018-01-14T11:01:58
I ...
- 201
0
votes
2
answers
317
views
How to block IPs making requests to specific domain?
I have a server with CSF and ModSecurity enabled.
I'd like to set up a rule or configuration that will automatically block (for a specified amount of time) any IP that makes incoming requests to a ...
- 173
0
votes
0
answers
93
views
Drop connection without sending packets
I would like to prevent default virtual host behaviour by dropping the connection, so that visitors who navigate to my server via IP or fqdn that isn't included in my virtual hosts get no indication ...
- 11
-1
votes
1
answer
96
views
Is ModSecurity intended for authentication or WAF?
What's the designed purpose of modsecurity for Apache/Nginx?
Does it play the role of authentication (Basic/Forms/Cookie)?
From my research, it appears to be a Web Application Firewall feature. The ...
- 143
3
votes
0
answers
60
views
Efficient and comfortable mod_security monitoring with sentry.io or similar tools? [closed]
When using mod_security one might drown in error reports.
sentry is a comfortable tool to monitor software errors, sort them, ignore unimportant ones and so on.
I was wondering if it is possible to ...
- 706
1
vote
0
answers
82
views
ModSecurity: Block all IPs except for a list of defined IPs
I have an apache server with ModSecurity. I need to block all IPs except for a few ones.
The list of IPs is like this:
194.83.128.0/21
191.143.32.0/19
145.126.72.0/21
101.28.248.0/22
40.64.64.0/22
180....
- 111
1
vote
1
answer
638
views
Nginx and Modsec version mismatch
I have installed nginx and modsec roughly following this tutorial https://www.linuxcapable.com/how-to-install-modsecurity-with-nginx-on-ubuntu-20-04/.
After a couple of months working perfectly I am ...
- 31
0
votes
0
answers
259
views
Mod_Security prevent brute force for Joomla
I am trying to find/create a Mod_Security rule to detect & block multiple login failures on the latest version of Joomla. I found an answer from March 2015 here: https://serverfault.com/a/646608/...
- 1
0
votes
1
answer
399
views
ModSecurity 403, COMODO WAF detects XSS while trying to access phpMyAdmin
I have a copy of phpMyAdmin in one of my server in a subdomain 'pma' and inside a directory in it named 'app' (manual installed from zip archive, not via yum), which I use for DB related management ...
0
votes
0
answers
36
views
Modsecurity Not working with beautified URLs
I have modsecurity on nginx and everything works except for URL like below:
https://example.com/input_1.3=6111163&id=1' and 1=1 --
But it works for this one:
https://example.com?input_1.3=6111163&...
- 156
0
votes
0
answers
211
views
How to use modsecurity on AWS EC2 with ELB
Query attacks from outside are too frequent since AWS EC2 was used. AWS WAF is too expensive and burdensome. I'm trying to install modsecurity inside the server, but it's not working properly because ...
- 1
0
votes
1
answer
74
views
Which protections can I use on the server
I have read about server protection and I know how to work with fewalld protection because it is not demanding.
My question is:
Which of the following protections is best for the server and which of ...
- 17
1
vote
1
answer
622
views
How to get the remote hostname resolved through DNS when using Nginx and ModSecurity?
The question mod_security with OWASP CRS: Custom rule for whitelisting googlebot provides the following rule as the answer to verify the client's hostname:
SecRule REMOTE_HOST “@rx google(bot|)\.com$” ...
- 73
0
votes
1
answer
174
views
How to reduce Modsecurity disk IO
Modsecurity generates a lot of disk io operations, and the file www-data-ip.pag is read and written continuously.
Is there any solution that can effectively reduce this? Could it be moved to RAM in ...
- 215
0
votes
1
answer
458
views
How do I set the anomaly score in crs-setup.conf?
I am using v3.0.0 of CRS with ModSecurity set to DetectionOnly mode and the nginx connector.
I want to set the anomaly score to 100 or so to fine-tune the settings, but I can't see where or how to do ...
- 113
0
votes
0
answers
600
views
Can't get docker image owasp/modsecurity-crs:apache reverse proxy to work
I have an endpoint https://my-portal.nl and I wan't to place a WAF with the OWASP Core rule set before it. So I found a Docker image(owasp/modsecurity-crs:apache) that can proxy all the requests to my ...
- 1
0
votes
1
answer
135
views
Is it okay to use core ruleset v3.3 on modsecurity v2.9
I am just a beginner in the field of security. I have installed ModSecurity v2.9 on my server using this link. But GitHub repository for the core rule set in the link was outdated, so later I removed ...
0
votes
2
answers
1k
views
How do I restrict a specific client, based on their host name, with ModSecurity SecRule?
I am trying to restrict specific hosts (e.g. AWS) from accessing my webserver. I tried different variations of these but it doesn't work.
# Block AWS
SecRule REQUEST_HEADERS:Host ".*\.amazonaws\....
- 81
0
votes
1
answer
1k
views
mod_security with OWASP CRS: Custom rule for whitelisting googlebot
I am about to use OWASP CRS rules with mod_security on my WHM/cPanel enabled CentOS server (with apache). But I fear that accidentally Googlebot may be blocked by one rule or the other. After enabling ...
- 101
0
votes
1
answer
69
views
OWASP-CSR on ATS
I have some Apache Traffic Servers that use in CDN platform. Is it possible to configure OWASP-CSR on Apache Traffic Server? If yes, how can I implement it?
Samira Rahighi
0
votes
1
answer
1k
views
Cannot find rule ID to whitelist an IP in ModSecurity
I have a local IP that was apparently banned. I would like to whitelist it. The subnet is already in my /etc/modsecurity/modsecurity.conf file:
SecRule REMOTE_ADDR "@ipMatch 192.168.0.0/19" &...
- 348
0
votes
1
answer
42
views
My centOS 7 minimal font screwed up when trying to tail modsecurity audit log
My font display was completely normal. But right after i cat or tail /var/log/modsec_audit.log, my font becomes like this. Any solution?
Image link:
https://i.stack.imgur.com/XkIyj.png
- 1
1
vote
2
answers
189
views
Apache modsec + ssl proxy loop
I have a server where we have the following setup:
http://example.com -(REDIRECT)-> https://example.com
Now we would like to add a simple ssl proxy(on the same machine where the A record is also ...
- 11
0
votes
1
answer
428
views
Which actions are retained on SecRuleUpdateActionById changes from the original rule?
So, SecruleUpdateActionById
requires relisting action flags. At least that's my reading of "actions that can appear only once are overwritten".
Which is fairly obvious for most of them, but ...
- 125
3
votes
0
answers
425
views
How to make mod_remoteip and mod_evasive work together
I have several Cento7 machines running Apache 2.4. They are behind a load balancer. The load balancer pass X-Forwarded-For header with client IP. In order to have mod_evasive to use the real client IP,...
- 163
0
votes
0
answers
612
views
Compile ModSecurity 3.3 with YAJL
anyone could help? I'm stucked on this.
I already compiled ModSecurity 3.3 on this machine (followed these instructions). Now I'm trying to compile with YAJL (Yet Another JSON Library) to be able to ...
- 1
0
votes
1
answer
620
views
apache server responding 403 to some clients, for a wordpress site
I rented a barebone server, installed Centos 7, then centos web panel, with server set to apache only, using apache 2.4.4x and php 7.
I set up a wordpress site on one of the vhost, after editing for a ...
1
vote
1
answer
1k
views
REQUEST_URI exact match modsecurity
I need deny a portion of an url with modsecurity , example:
index.php?page_num=users
I have implemented this rule:
SecRule REQUEST_URI "/index\.php\?page_num=users" "id:10000100,phase:1,...
- 11
0
votes
1
answer
910
views
Why don't the CRS rules in ModSecurity block all threats?
I'm in the process of configuring the new Ngnix v1.18.0 server together with ModSecurity-nginx v1.0.1. I've added OWASP CRS 3.3.0 rules to the configuration. Unfortunately, I can't clearly tell if the ...
- 101