Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
14

These appear to be settings internal to the PCRE engine in order to limit the maximum amount of memory/time spent on trying to match some text to a pattern. The pcreapi manpage does little to explain it in layman's terms: The match_limit field provides a means of preventing PCRE from using up a vast amount of resources when running patterns that are ...


9

Well I suppose it is possible if you enable the configuration for mod security either in .htaccess or in the virtual host apache configuration for that particular domain using something like this : <IfModule mod_security2.c> SecRuleEngine On ...... (any other directives you might want to override from the defaul conf) </IfModule> Also ...


8

Which ModSecurity version are you using? ARGS variable only includes QUERY_STRING + POST_PAYLOAD in version 1.X. If you're running version 2.X, with your above rule, testing with a request as below: http://domain.com/a?b=km0ae9gr6m you'll see something like this in the audit_log: [modsecurity] [client x.x.x.x] [domain domain.com] [302] [/20120813/20120813-...


7

Holy recursion, Batman! I claim you have something wrong with your mod_security rules. That kind of recursion seems to be unnecessary and will most likely cause some serious load for your server. Fix the rules and/or Apache config, and don't try to "fix" this problem with arbitrarily large numbers.


7

The robots.txt file is only parsed by the robot. The webserver does not use it to decide if a client with that user-agent is allowed to access your website or not. A malicious bot will most likely ignore this file. If you want to improve security, mod_security is a much better way to do it.


7

Same issue here. I am using mod_security to block the user-agent SecRule REQUEST_HEADERS:User-Agent "Bittorrent" "id:10000002,rev:1,severity:2,log,msg:'Bittorrent Hit Detected'" I would change the log to nolog after you verify it is working to avoid filling up your log file SecRule REQUEST_HEADERS:User-Agent "Bittorrent" "id:10000002,rev:1,severity:2,...


6

Have a rule which turns on the AuditEngine for POST requests. Something like this (untested): SecRule REQUEST_METHOD "POST" "id:1000,phase:2,ctl:auditEngine=On,nolog,pass" Ctl actions only affect the current request so afterwards it will reset back to RelevantOnly for the next request. You can also create Sanitise rules to ensure sensitive data like ...


5

The mod_security action deny will produce a 403 response whereas drop will immediately close the connection. From the manual: drop Description: Immediately initiate a "connection close" action to tear down the TCP connection by sending a FIN packet. Action Group: Disruptive Example: The following example initiates an IP collection for tracking Basic ...


5

When you build software, you need the library development package, not the shared library package. So, install libxml2-devel and your build problems should go away (or at least the error message will change).


5

This sounds like a suitable situation for the <FilesMatch > directive, no need for mod_security at all. <FilesMatch sm6[0-9]+\.php> Order Allow,Deny Deny from all </FilesMatch> Of course, if you don't want anyone to access the file, why not delete it or move it out of the DocumentRoot ? If you edit your question to include more about ...


5

We are experiencing exactly the same issue with one of our client's sites. I added the following near the top of their : # Drop Bittorrent agent 2015-01-05 before redirect to https <IfModule mod_rewrite.c> RewriteEngine on # RewriteCond %{HTTP_USER_AGENT} =Bittorrent RewriteRule ^/announce$ - [F] RewriteRule ^/announce\.php$ - [F] <...


5

I wrote a blog post about how to properly tell BitTorrent clients to go away and never come back, similar to what Dan did, but using nginx. server { location /announc { access_log off; error_log off; default_type text/plain; return 410 "d14:failure reason13:not a tracker8:retry in5:nevere"; } } Torrent trackers (...


5

I'm having the same issue at the moment, having torrent trackers point at my server. I've experimented with iptables for the past couple of days and inspected headers and patterns of the requests and narrowed it down to a couple of iptables rules that filters pretty much all of the recent seemingly malicious traffic from Asia (China,Malaysia,Japan and Hong ...


5

You can do it by adding ModSecurity as dynamic module. Requirement:NGINX 1.11.5 and later. Step 1 : Installing needed packages apt-get install -y apt-utils autoconf automake build-essential git libcurl4-openssl-dev libgeoip-dev liblmdb-dev libpcre++-dev libtool libxml2-dev libyajl-dev pkgconf wget zlib1g-dev Step 2 : Download and Compile the ModSecurity ...


4

The problem was SELinux #less /var/log/audit/audit.log type=AVC msg=audit(1311546944.235:1040): avc: denied { read } for pid=1396 comm="httpd" name="hosts" dev=dm-0 ino=262931 scontext=user_u:system_r:httpd_t:s0 tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=file In my case the following solved it: # ls -lZ /etc/hosts -rw-r--r-- root root ...


4

Another way to find it out is by simply restarting your Apache server and look in the logs for info: $ sudo service apache2 restart $ grep -i modsecurity /var/log/apache2/error.log [Sun Mar 08 19:14:02.000210 2015] [:notice] [pid 1912] ModSecurity for Apache/2.7.7 (http://www.modsecurity.org/) configured. [Sun Mar 08 19:14:02.000278 2015] [:notice] [pid ...


4

Apache has to handle the request in some way, it can't just ignore them. Responding with 403 Forbidden is as close as you get.


4

/etc/modsecurity/whmcs_rules.conf Shows it as phase:4, this is the reponse_body bit, you probably want phase:1 (or maybe 2) which is request_headers (and request_body) That way modsecurity will trigger earlier


4

From the perspective of defense from attack, not filtering in/out data of course does not add anything of value. One could argue that proxying without forethought in fact lowers security in that: greater complexity is introduced, often with a vengeance. less transparency in that multiple log and alerting layers need correlation per transaction. attack ...


4

We use fail2ban It automatically blocks the IP of the spambot or malicious user for a user defined period of time once it detects a user defined number of requests to non-existent pages, failed login attempts etc. We currently use it to protect against ssh attacks but are now extending it to our website.


4

You can use SecRuleUpdateTargetById to modify the rule SecRuleUpdateTargetById 981231 !REQUEST_COOKIES:/^ _CERTAINSTRING/ Which would disable the rule that is causing you pain for request cookies whose name begins with _CERTAINSTRING. Update: The rule above needs to be placed after the rule to which it refers is defined. This is normally done by ...


4

Probably you're using Ubuntu 14.04. there are a couple of changes on that version. To add the rules you want, edit the following file instead: sudo vi /etc/apache/mods-enabled/security2.conf


4

A quick search of the interwebs suggests that one of the steps you will have undertaken to enable mod_security is to create the file /etc/modsecurity/modsecurity.conf. To disable modsecurity, all we need to do is remove/rename that file and restart apache.


3

Watching this closely as I have exactly the same issue and your config looks similar to mine. I'm a first timer to modsecurity, it's not exactly noob friendly! Agree with Janne. Only advice I have so far is to remove all the core rules and re-introduce them 1 by 1 to start narrowing the problem down. I'm about to do that now. Also you should change your ...


3

I managed to fix this with the following config: <VirtualHost *:80> ServerName default.only SecRuleEngine On SecRule REMOTE_ADDR "^\d" drop,phase:1 </VirtualHost>


3

SecRule REQUEST_LINE "@rx sm6[0-9]{1,}\.php" \ "phase:2,block,severity:2,msg:'Blocking access to sm6#.php files.'"


3

I didn't write these rules but as I understand it, there is a strong correlation between clients that don't include this header and malicious clients and also between clients that do include it and benign clients. You may find certain bots (for example: Pingdom, HostTracker, UpDowner, magpie-crawler, Yandex, Yodao, MJ12, GigaBot and the LinkedInBot in a ...


3

mod_security is a WAF, but not a F. You are mixing technologies in your post: I use ssh (port 22) and http (80) to access this and I've read horror stories from other EC2 users claiming they were locked out of their sites once they put up a firewall. The WAF inspects web traffic, that is to say, HTTP. It will have no effect on other Layer 7 (...


3

I'd be looking for typos and other "stupidly simple" mistakes we all make from time to time (I use my wife as a proof-reader), but if that doesn't work I'd just fire up strace to see what mod_security is trying to do. It might not be reading /etc/hosts -- perhaps it's taking a failure to resolve the name via DNS as some sort of hard failure instead, or ...


3

There's several free/open source options out there. A close friend of mine who's a Web applications pen tester uses none of these (with exception to Nessus, but only the Professional Feed) as their toolset is quite a bit more sophisticated and contains many unpublished zero day exploits. However, they're very expensive and require certain certifications/...


Only top voted, non community-wiki answers of a minimum length are eligible