2

I need to add the following line into my .htaccess file in order to get my website working with mod_security

SecFilterScanPOST Off

but then I get an error

Internal Server Error

The server encountered an internal error or misconfiguration and was unable to complete your request.

In my WebHost manager I see the following message: "mod_security is installed and running!"

I do not know what I did wrong?

MrWhite
  • 11,643
  • 4
  • 25
  • 40
Elitmiar
  • 775
  • 3
  • 15
  • 31
  • 3
    Check apache logs for details – Ivan Nevostruev Jan 13 '10 at 16:29
  • In the logs I get the following message [Wed Jan 13 18:29:12 2010] [alert] [client .............] /home/..../public_html/.htaccess: Invalid command 'secfilterscanpost', perhaps mis-spelled or defined by a module not included in the server configuration – Elitmiar Jan 13 '10 at 16:32

5 Answers5

4

That module is probably not loaded. Try it within a <IfModule> block to avoid such error:

<IfModule mod_security.c>
    SecFilterScanPOST Off
</IfModule>

But note that this doesn’t solve your problem. It just avoids that internal error.

To solve your problem, make sure that the mod_security module is loaded. This is done with the LoadModule directive.

Gumbo
  • 436
  • 2
  • 6
  • In my WebHost manager I see the following message: mod_security is installed and running! – Elitmiar Jan 13 '10 at 16:35
  • @Roland: Then your mod_security module is probably not intended to be used in a .htaccess file. Maybe it’s just allowed in the server/virtual host configuration. – Gumbo Jan 13 '10 at 16:46
2

You said in your comments than in your log file you can read "invalid command 'secfilterscanpost', perhaps mis-spelled or defined"

If you are using mod_security2, the SecFilterScanPOST is obsolete and you should migrate it to SecRequestBodyAccessas , this is explained in the migration document.

http://www.modsecurity.org/documentation/ModSecurity-Migration-Matrix.pdf

Oscar Raig Colon
  • 121
  • 2
1

Check your apache error log (on linux it is usually in /var/log/http/error_log or similar).

jckdnk111
  • 111
  • 3
1

You can check if the SecFilterScanPOST directive is allowed in .htaccess files (probably via an AllowOverride option in your Apache or VirtualHost config file).

juba
  • 121
  • 5
0

If your mod_security version is 2 or greater you can't put directives in a .htaccess file - only httpd.conf will do. I suppose they'll add this to the FAQ sooner or later.

djn
  • 130
  • 4