Questions tagged [mod-security]
ModSecurity supplies an array of request and response filtering rules and other security features to the Apache HTTP Server. ModSecurity is an open source web application layer firewall.
18
questions
16
votes
5
answers
18k
views
mod_security block requests by http-host header
The last few days I noticed some servers being hammered with unknown requests.
Most of them are like the following:
60.246.*.* - - [03/Jan/2015:20:59:16 +0200] "GET /announce.php?info_hash=%80%85%...
- 2,460
2
votes
2
answers
8k
views
What rule can I use in ModSecurity to log POST payload for a specific site?
I need to inspect POST payload for a specific website (the server is rather busy and I wouldn't turn on POST logging for the entire server).
The server is LiteSpeed 5.0.7.
SecRequestBodyAccess is set ...
- 105
4
votes
4
answers
9k
views
How to drop all requests using mod_security
I have an apache2 server with several sites enabled on it, including the default one (000default). The default server is catching lots of spammy requests that are doing nothing but consume bandwidth ...
- 191
2
votes
6
answers
12k
views
mod_security: another rule with same ID
I have installed httpd 2.2.15 on CentOS 6.5 (minimal installation with no cPanel) with modsecurity 2.8. When I am starting httpd I am getting this error:
Starting httpd: Syntax error on line 23 of /...
- 21
13
votes
4
answers
28k
views
mod_security - PCRE limits exceeded
Just about on every request I am getting the following error:
Rule execution error - PCRE limits exceeded (-8): (null).
After a bunch of googling the only solutions seem to be
a) Add the following ...
- 302
7
votes
1
answer
9k
views
How to get mod_security to log all POST data?
I currently have a CentOS system that is successfully logging relevant mod_security actions to the audit log file. The following is my configuration:
<IfModule mod_security2.c>
SecRuleEngine ...
- 273
5
votes
1
answer
9k
views
how to whitelist a certain cookie string in ModSecurity
We are getting a lot of False Positives from using 3rd part software on our server. They themselves can't seem to fix it and I'm trying to work out how to allow cookies through that contain "...
- 97
3
votes
2
answers
2k
views
mod_security IP collection key not being set correctly
I'm using an IP collection in a load balanced setup, I therefor want mod_security to act on the x-forwarded for header instead of the REMOTE_ADDR. Here is my rule:
SecAction "phase:1,nolog,pass,...
- 73
3
votes
2
answers
11k
views
mod_unique_id: unable to find IPv4 address of FQDN despite setting etc/hosts and Apache ServerName
I'm trying to get mod_security and hit the very common hostname error of
[alert] (EAI 2)Name or service not known: mod_unique_id: unable to find IPv4 address of "computername.domain.com"
This ...
- 968
2
votes
1
answer
3k
views
mod_security: How to log POST requests for specific URI?
I'm trying to set up mod_security to log POST requests payload for a specific URI, as it seems that a customers webpage is used as a spam relay and these requests corrupt the server side cache.
I ...
- 65
2
votes
1
answer
945
views
Mod security anomaly scoring in the audit log
I have configured my anomaly scoring level to 8 within my CRS-setup.conf When I review my audit log I see the following entry:
--f0d8a724-H--
Message: Warning. detected XSS using libinjection. [file ...
- 23
2
votes
2
answers
1k
views
Does ModSecurity 2.7.1 work with ASP.NET MVC 3?
I'm trying to get ModSecurity 2.7.1 to work with an ASP.NET MVC 3 website.
The installation ran without errors and looking at the event log, ModSecurity is
starting up successfully.
I am using the ...
- 133
1
vote
1
answer
4k
views
mod_security not working at all
I'm trying to make the mod_security work, I searched a lot on the web, and followed this tutorial to configure mod_security (all my configuration files are the same as the tutorial), and when I run ...
- 107
1
vote
2
answers
2k
views
How do I enable mod_security in Ubuntu 10.04?
A quick run through of what I've done:
apt-get install libapache-mod-security
a2enmod mod-security
create /etc/apache2/mod_security_rules/ with base_rules and optional_rules from the latest core ...
- 8,162
1
vote
1
answer
3k
views
Modsecurity : Creating a new Request Header from SecRule
Consider the following redirect SecRule which is activated from a Lua script
SecRule &TX:SQLI "@eq 1" "id:'129793',phase:2,t:none,redirect:http://www.example.com/failed.html,msg:'SQLi Injection ...
- 17
1
vote
1
answer
645
views
Changing ModSecurity Logging on a Per Transaction Basis
I am trying to trace all requests being made to a website on a shared hosting server. Packet capture is just going to be too cumbersome.
We use Mod Security (2.8) with good effect, although due to ...
- 263
0
votes
1
answer
1k
views
Does a mod_security error block a visitor?
Does a mod_security execution/rule error or errors in general block users from visiting my website? Ive got many rule and execution errors, Ive just whitelisted these rules but maybe I could just ...
- 1
0
votes
1
answer
964
views
Mod security exceptions not working
I would like to exclude a directory from mod security. I have tried everything under the sun in every config file to no avail. I have put stuff in the vhost file, the crs-setup file, the modsecurity....
- 23