Questions tagged [mod-security]

ModSecurity supplies an array of request and response filtering rules and other security features to the Apache HTTP Server. ModSecurity is an open source web application layer firewall.

Filter by
Sorted by
Tagged with
0
votes
2answers
75 views

How do I restrict a specific client, based on their host name, with ModSecurity SecRule?

I am trying to restrict specific hosts (e.g. AWS) from accessing my webserver. I tried different variations of these but it doesn't work. # Block AWS SecRule REQUEST_HEADERS:Host ".*\.amazonaws\....
0
votes
0answers
45 views

ModSecurity CoreRuleSet blocks cloudflare ip instead of attacker

so I just finished setting up my new webserver with nginx 1.19.8 and modsecurity. Now I have found coreruleset and configured everything as I wanted. But I started testing the modsecurity anti dos ...
0
votes
0answers
21 views

OWASP-CSR on ATS

I have some Apache Traffic Servers that use in CDN platform. Is it possible to configure OWASP-CSR on Apache Traffic Server? If yes, how can I implement it?
0
votes
0answers
113 views

Cannot find rule ID to whitelist an IP in ModSecurity

I have a local IP that was apparently banned. I would like to whitelist it. The subnet is already in my /etc/modsecurity/modsecurity.conf file: SecRule REMOTE_ADDR "@ipMatch 192.168.0.0/19" &...
0
votes
1answer
28 views

My centOS 7 minimal font screwed up when trying to tail modsecurity audit log

My font display was completely normal. But right after i cat or tail /var/log/modsec_audit.log, my font becomes like this. Any solution? Image link: https://i.stack.imgur.com/XkIyj.png
1
vote
2answers
40 views

Apache modsec + ssl proxy loop

I have a server where we have the following setup: http://example.com -(REDIRECT)-> https://example.com Now we would like to add a simple ssl proxy(on the same machine where the A record is also ...
0
votes
1answer
62 views

Which actions are retained on SecRuleUpdateActionById changes from the original rule?

So, SecruleUpdateActionById requires relisting action flags. At least that's my reading of "actions that can appear only once are overwritten". Which is fairly obvious for most of them, but ...
0
votes
0answers
43 views

I want to exclude “..” in url with mod_security

However, Apache does not run after setting. (in modsecurity.conf ) SecFilter "\.\./"
2
votes
0answers
141 views

How to make mod_remoteip and mod_evasive work together

I have several Cento7 machines running Apache 2.4. They are behind a load balancer. The load balancer pass X-Forwarded-For header with client IP. In order to have mod_evasive to use the real client IP,...
0
votes
0answers
123 views

Compile ModSecurity 3.3 with YAJL

anyone could help? I'm stucked on this. I already compiled ModSecurity 3.3 on this machine (followed these instructions). Now I'm trying to compile with YAJL (Yet Another JSON Library) to be able to ...
0
votes
0answers
33 views

Tuning nginx /var/lib/nginx/body and ModSecurity

I have nginx set up with ModSecurity (via ModSecurity-nginx). My /var/lib/nginx/body directory fills up quickly. Currently, my /var/lib/nginx/body directory is 2.4gb. I think this is due to something ...
0
votes
1answer
77 views

apache server responding 403 to some clients, for a wordpress site

I rented a barebone server, installed Centos 7, then centos web panel, with server set to apache only, using apache 2.4.4x and php 7. I set up a wordpress site on one of the vhost, after editing for a ...
0
votes
1answer
49 views

REQUEST_URI exact match modsecurity

I need deny a portion of an url with modsecurity , example: index.php?page_num=users I have implemented this rule: SecRule REQUEST_URI "/index\.php\?page_num=users" "id:10000100,phase:1,...
0
votes
1answer
95 views

Why don't the CRS rules in ModSecurity block all threats?

I'm in the process of configuring the new Ngnix v1.18.0 server together with ModSecurity-nginx v1.0.1. I've added OWASP CRS 3.3.0 rules to the configuration. Unfortunately, I can't clearly tell if the ...
2
votes
2answers
83 views

mod_security 403 forbidden response is returning homepage content with WordPress mod_rewrite

I'm using mod_security on various websites, some WordPress and some not. I notice that on a non WordPress website the following: https://test-site.com/?exec=/bin/bash returns a 403 forbidden error ...
0
votes
1answer
160 views

How to automatically block with MODSEC or CSF an IP Address when it tries to access a URL

We have in our server logs every day continuos bot trying to access the below for example: Requests with error response codes 404 Not Found /favicon.ico: 3 Time(s) /3ckkB-ZOp30: 2 Time(s) /adminer-3....
0
votes
0answers
290 views

nginx: [emerg] “modsecurity_rules_file” directive Rule id: 200000 is duplicated

I am trying to install on a server with nginx the OWASP rules for nginx but I run into the header error. sudo nginx -t nginx: [emerg] "modsecurity_rules_file" directive Rule id: 200001 is ...
0
votes
1answer
39 views

modsecurity3: replace rule with a custom one for a specific URI

In a crs 3.2 there is a rule with ID=941320 which prevents CKEditor to work within drupal. CKEditor is a wysiwyg that produces html and attempts to upload it to server. Modsecurity 3 with crs blocks ...
0
votes
0answers
28 views

ModSecurity rules for Apache SOLR injection protection?

Is there anything similar to the SQL injection rules (from Trustwave SpiderLabs), but to harden a Apache SOLR already placed behind an Apache (with mod_proxy and mod_security2). I couldn't find ...
1
vote
1answer
128 views

mod_security: How to log POST requests for specific URI ONLY?

I am currently running Apache 2.4.25 on Debian 9.8. I'm trying to set up mod_security to log POST request payloads for a specific URI. I have several API on a Debian server and I have to log all of ...
0
votes
1answer
81 views

ModSecurity won't apply rules - no error log entries

I have a fresh installation of CentOS 8. I installed Apache 2.4.37 from the repo. Then installed the latest ModSecurity: dnf install mod_security -y Checked the installation dnf info mod_security ...
0
votes
0answers
66 views

WAF(modsecurity) / Plesk IP Banned, is it Googlebot? Is it a false positive? Is it a malicious IP?

I was alerted by my Plesk server that an IP Address had been banned. Normally I don't check banned IPs, but this one happened to coincide with our site going down for 1 minute at the same time. Banned ...
0
votes
0answers
204 views

fail2ban modsec failregex not working

I noticed by accident when checking jails that de modsec jail has no ip's then i checked my other servers and all modsec jails have nothing banned although the log files are full of modsec bans. so i ...
0
votes
0answers
70 views

Rule 933160 violated even though it's been excluded

I've installed nginx with modsec with the following versions: Modsec verion: v3.0.3 Nginx version: 1.13.6 and I've excluded rule 933160 as followed: SecRule REQUEST_URI "@beginsWith /a/b/c/d&...
0
votes
0answers
201 views

ModSecurity: Warning. detected SQLi libinjection: Matched Data: novc found within ARGS:password

I have configured Apache's mod_security but I'm getting trapped with this error message: [msg "SQL Injection Attack Detected via libinjection"][data "Matched Data: novc found within ...
0
votes
1answer
413 views

ModSecurity blocks legitimate client requests

Randomly, the modsecurity blocks legitimate clients requests giving the error 403. Here is para of the modsec_audit.log: ---d6e99f36-A-- [21/Jun/2020:07:14:45 +0100] Xu761X8AAAEAADI1YrAAAABQ xxx....
0
votes
1answer
213 views

Changing time format in Modsecurity log

I wonder if it's possible to change time format which Modsecurity 3 uses in its audit log. I came across that time format differs depending on SecAuditLogFormat setting. When it's Native, timezone is ...
0
votes
0answers
55 views

How can I selectively specify CRS rules as “detection only” while using Anomaly Scoring Mode?

I'm experimenting with mod_security (2.9) on an Apache 2.4 web server. I have created a rule to rate limit requests for a particular virtual host and location block, and this is working as expected. I'...
1
vote
2answers
1k views

How to exclude ModSecurity rules by hostname?

I'm using OWASP core rule set 3.2.0 set up with ModSecurity 3.0.4 and ModSecurity-nginx. If I have a rule exclusion like this, in REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf: SecRule REQUEST_URI "@...
1
vote
0answers
229 views

mod_evasive triggering client denied by server configuration: from SquirrelMail download.php

mod_evasive is triggering the below errors from SquirellMail on Apache 2.4.43-1 on Fedora 31. And since this causes a 403 Forbidden error, Fail2ban is also triggered and blocks the IP, as it appears ...
0
votes
0answers
369 views

ModSecurity, Create an IP Blacklist file

We have a list of IPs that we want blocked. I currently have them blocked at the firewall, I would like to create a file that ModSecurity will read, and block those IPs. This is a pretty big list, as ...
0
votes
1answer
482 views

Apache2 mod_evasive for only one virtual host

I'm testing a scenario where, I'm hosting two-site on same machine with help of apache web server. I'm looking to enable mod_evasive for only one site. I don't see any way to get it working. Following ...
1
vote
0answers
849 views

Modsecurity…Host header is a numeric IP address Cannot serve directory no matching directoryindex

my system is Debian 9 Apache2 php-fpm i am experiencing an error with one of the websites on my webserver. I have tried adding an index.html file into the public_html directory (and disabling ...
0
votes
0answers
465 views

ModSecurity not writing to new rotated log files?

I've the following logs rotation set up in the OS for nginx's and modsec's logs, and it works for nginx's logs but not for modsec's. The result for modsec is that, it made a copy for the log file but ...
1
vote
1answer
2k views

Apache too many child process - mpm_event caught SIGTERM shutting down

My Apache with ModSecurity, mod_evasive20 enabled occasionally geting crashed: These are glimpse of error log: [core:warn]**: child process 24709 still did not exit, sending a SIGTERM [core:error]**:...
1
vote
1answer
63 views

mod_security default_SESSION.pag file huge size

default_SESSION.pag file showing 575G though df -h showing less. /dev/xvda1 40G 19G 19G 51% / What for this default_SESSION.pag file actually used? It is updated when there is entries ...
0
votes
1answer
683 views

Apache2 error “ModSecurity: Found another rule with the same id” Ubuntu18.04

downloaded v3.2.0 https://coreruleset.org/installation/ following instructions located in file INSTALL But apache cannot start and returns this error - AH00526: Syntax error on line 800 of /etc/...
0
votes
1answer
30 views

Can mod_security be configured to create log only?

I've installed mod_security on openSUSE and want to make it log only. I want absolutely no blocking or filtering of any kind. I've created a config file as: SecAuditEngine On SecAuditLog /siteA/...
0
votes
1answer
396 views

Modsecurity only allow access from two particular REFERER HEADERs

I have a Modsecurity rule which blocks all requests where the browser Referer Header is different from this: sub1.example.com. So basically the rule only allows requests when the Header Referer is ...
0
votes
0answers
117 views

mod_security does not block invalid URI requests

I am quite new to Modsecurity and need some help to secure my development server. I have Apache 2.4 installed with Mod Security 2.8.0 I have also installed OWASP ModSecurity Core Rule Set ver.3.2.0 ...
1
vote
1answer
178 views

Apache - Custom error page returning error AH01071 only for file requests

I have a site hosted with a shared hosting provider. It is an Apache with FPM/FastCGI and PHP 7.2 Being shared hosting, the only configuration I have access to is htaccess, but obviously not any of ...
0
votes
1answer
194 views

ModSecurity dependency not found?

1. yum groupinstall 'Development tools' 2. yum install -y geoip-devel libcurl-devel libxml2-devel libxslt-devel libgb-devel lmdb-devel openssl-devel pcre-devel perl-ExtUtils-Embed yajl-devel zlib-...
0
votes
1answer
167 views

Drop and Nolog HTTP CONNECT request with modsecurity

In my virtualhost I have this modsecurity setup SecRuleEngine On SecRule REQUEST_METHOD "@streq CONNECT" "id:1,nolog,drop,phase:1" Despite the 'nolog' instruction I got in apache access log the ...
0
votes
1answer
176 views

mod security blocking basic authentication

I have a vps with centos 7, apache with mod_security and mod_evasive. I have a form in php with basic authentication. When I try to authenticate through the application (before activating mod security ...
0
votes
1answer
910 views

mod_security X-Forwarded-For not being blocked

I made some changes to my config as per this suggestion: SecAction \ "id:901321,\ phase:1,\ pass,\ t:none,\ nolog,\ initcol:global=global,\ initcol:ip=%{x-forwarded-for}_%{...
0
votes
0answers
238 views

Logging POST request body in modsecurity

Hello I'm using libmodsecurity (4e6e4243|v3.0.3) on nginx(1.15.12) with the connector being the current master (d7101e13685) and OWASP CRS on (ab24a20faf28156f0|v3.1.0). I am trying to log the POST ...
0
votes
1answer
520 views

ModSecurity CRS 3 - Disable SQLi Rule For URI Pattern

I am trying to disable rule 942100 (an SQLi rule) when certain values are present in the URI, but apache won't start so something is wrong. My attempt (in REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf):...
0
votes
1answer
216 views

ModSecurity, expirevar wont work

I've enabled modsecurity in my nginx k8s ingress using this guide, then I've added the following custom rules to block potential brute force attack # Block by ip # Retrieve the username SecAction "...
0
votes
2answers
85 views

Can Modsecurity detect and block infected client computers that connect to a server?

I have the latest version of Modsecurity (as of March 25th 2019) installed on my server. I am using OWASP rulesets along with fail2ban on Linux. I know it is designed to block hacking attempts. ...
0
votes
1answer
1k views

Updating ModSecurity when using OWASP rule sets

I am somewhat new to Modsecurity and still have a long way to go so bear with me. Ubuntu 18.04 I'm currently running Modsecurity 2.9.2-1 and OWASP rules 3.0.2 I would like to update the rules to ...

1
2 3 4 5
7