0

I recently installed mod_security on apache 2.4.6 using owasp rule set, But there'e some problems with google recaptcha and non-english utf8 characters. I googled and for recaptcha I should add following custom rule to mod_security

SecRuleUpdateTargetById 981319 !ARGS:'g-recaptcha-response'

But When I add it to mod_security main configuration file... httpd won't restart. I tried searching but I can't seem to find a way to add custom rule set file for mod_security. Apache log for banning recaptcha is:

[Thu Sep 08 07:04:18.084361 2016] [:error] [pid 14084] [client 5.232.165.32] ModSecurity: Access denied with code 403 (phase 2). Pattern match "([\\~\\!\\@\\#\\$\\%\\^\\&\\*\\(\\)\\-\\+\\=\\{\\}\\[\\]\\|\\:\\;\"\\'\\\xc2\xb4\\\xe2\x80\x99\\\xe2\x80\x98\\`\\<\\>].*?){5,}" at ARGS:g-recaptcha-response. [file "/etc/httpd/crs-tecmint/owasp-modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "159"] [id "981173"] [rev "2"] [msg "Restricted SQL Character Anomaly Detection Alert - Total # of special characters exceeded"] [data "Matched Data: - found within ARGS:g-recaptcha-response: 03AHJ_VuuPCp_JmWQJpW2-kP9sujeJEyunQ12UKtw5EHTJ0yDo9AY8SUvOkQ4l9gRPee1gkbtYzFIe-5NoWyWsM1N7Yo3i7nqqEg0c7PW2AyCshxZC-hnqmlOY0qUPIHcf9rHIzYPjHfppCEoNTtkw6PSkvHlLKwqulFwSDATG_2l8_C3lnF1fTtkgKgtMk2nrfYzNItUkIa6MzgTC3yj9qK1oq4kqMKff1RrQLLvVYk-XnJTItGfoRdatb5z-uwr6my4H28N9WwxFhARrTCLQ9Blhm5JwPA5xVLOQsPyJmtCVNYlAAdTZQQVshLBdPypPaLEvEPjCjxaEteCt-nelbrIsqdGT6fkgUR5uomlhJjMuyEbmTbGssPYjtzoWu-GcX4vNezPJiAJ1j-MRkkpmZo-T33s7QDnL9yJzBO_kgRNe_FQZbtUlnZuWLFghAfnF13Q..."] [ver "OWASP_CRS/2.2.9"] [maturity "9"] [acc [hostname "domain.com"] [uri "/login.php"] [unique_id "V9DOKgRETzQ748oMLD4k9AAAAAg"]

What should I do?

Ehphan
  • 111
  • 2
  • 8
  • I've added that rule (user config file that contain rules, included in main config file, but tested in both just in case) and httpd restarted fine. What error do you get when httpd restarts? – RonanW. Sep 08 '16 at 15:10
  • Updating target by ID with no ruleset in this context – Ehphan Sep 09 '16 at 07:47
  • "AH00526: Syntax error on line 7 of /etc/httpd/modsecurity.d/tecmint.conf" "Updating target by ID with no ruleset in this context" which line 7 is "SecRuleUpdateTargetById 981319 !ARGS:'g-recaptcha-response'" – Ehphan Sep 09 '16 at 07:55
  • Can you add modsec or apache log with entries when modsec blocked google recaptcha – RonanW. Sep 09 '16 at 08:55

0 Answers0