ModSecurity supplies an array of request and response filtering rules and other security features to the Apache HTTP Server. ModSecurity is an open source web application layer firewall.
Questions tagged [mod-security]
334 questions
0
votes
0 answers
Nginx and Modsec version mismatch
I have installed nginx and modsec roughly following this tutorial https://www.linuxcapable.com/how-to-install-modsecurity-with-nginx-on-ubuntu-20-04/.
After a couple of months working perfectly I am now getting this error:
nginx: [emerg] module…
![](../../users/profiles/955455.webp)
andygozindy
- 11
- 3
0
votes
0 answers
Mod_Security prevent brute force for Joomla
I am trying to find/create a Mod_Security rule to detect & block multiple login failures on the latest version of Joomla. I found an answer from March 2015 here: https://serverfault.com/a/646608/960638 but in my own tests it does not detect login…
![](../../users/profiles/960638.webp)
Peter
- 1
0
votes
0 answers
Modsecurity & LEMP Server Running Wordpress - Rule Exclusions for iOS Wordpress app
I am very new to mod-security, and have been struggling quite a bit with rule exclusions that are beyond the scope of examples shown in this tutorial from Linuxbabe.com. I am running a Wordpress LEMP Server, and my issue is specific to getting the…
![](../../users/profiles/487106.webp)
DanRan
- 73
- 1
- 1
- 12
0
votes
1 answer
ModSecurity 403, COMODO WAF detects XSS while trying to access phpMyAdmin
I have a copy of phpMyAdmin in one of my server in a subdomain 'pma' and inside a directory in it named 'app' (manual installed from zip archive, not via yum), which I use for DB related management and it was working ok for couple of months. A…
![](../../users/profiles/942915.webp)
Nishu Ali
- 1
- 2
0
votes
0 answers
mod_security blocks redirects (to non-www and https)
httpd-vhosts.conf
ServerName example.com
ServerAlias www.example.com
DocumentRoot "c:/web/www/mysite"
Alias /.well-known c:/web/www/mysite/.well-known
Redirect permanent / https://example.com…
![](../../users/profiles/948569.webp)
impimp
- 1
0
votes
0 answers
Modsecurity Not working with beautified URLs
I have modsecurity on nginx and everything works except for URL like below:
https://example.com/input_1.3=6111163&id=1' and 1=1 --
But it works for this one:
https://example.com?input_1.3=6111163&id=1' and 1=1 --
Where is the problem?
![](../../users/profiles/157961.webp)
Abadis
- 156
- 3
0
votes
0 answers
Modsecurity failed to load configuration
Evening, i got some problem here. I compiled modsecurity into standalone mode and using haproxy too. I ran in -p 81 -f crs-setup.conf -d then it works. But, when i adding "Include /etc/..../rules/*.conf" it becomes
1639122879.787949 [00] ModSecurity…
![](../../users/profiles/942607.webp)
kolo
- 1
- 2
0
votes
0 answers
How to use modsecurity on AWS EC2 with ELB
Query attacks from outside are too frequent since AWS EC2 was used. AWS WAF is too expensive and burdensome. I'm trying to install modsecurity inside the server, but it's not working properly because of ELB. Is there any other alternative or way?
![](../../users/profiles/943418.webp)
LivePark
- 1
- 1
0
votes
0 answers
Installing ModSecurity on NGINX
I'm trying to set up a reverse proxy using NGINX on CentOS7 and ModSecurity for use in between an Exchange server and the internet. I'll be honest and say I'm not all that great with Linux, but I've learned how to do some things fairly well, and…
![](../../users/profiles/943064.webp)
SubnetMask
- 11
- 2
0
votes
1 answer
Which protections can I use on the server
I have read about server protection and I know how to work with fewalld protection because it is not demanding.
My question is:
Which of the following protections is best for the server and which of the offered ones can be used together on the…
![](../../users/profiles/546153.webp)
Edgar
- 17
- 4
0
votes
0 answers
Rewrite POST variable using modsecurity
Exists some way to rewrite POST form variables using modsecurity?
This must be done before proxypass to backend.
I was trying some rules unsuccessful.
The test request is curl -i -X POST -d "name=Pepe" http://localhost:8080/pepe
The idea is to be…
![](../../users/profiles/593058.webp)
Alex Trivel
- 11
- 1
0
votes
0 answers
Prevent SlowLoris attack with ModSecurity (Apache)
I'm unable to stop a SlowLoris attack using ModSecurity in my apache (2.4) server from a computer that is in the same network.
I'm on Debian 11.
I add this to the /etc/modsecurity/modsecurity.conf :
SecConnReadStateLimit 5
And set this to…
![](../../users/profiles/907060.webp)
Rodrigo Diaz
- 1
- 1
0
votes
1 answer
How to reduce Modsecurity disk IO
Modsecurity generates a lot of disk io operations, and the file www-data-ip.pag is read and written continuously.
Is there any solution that can effectively reduce this? Could it be moved to RAM in some way?
![](../../users/profiles/479127.webp)
AndreaF
- 205
- 1
- 8
0
votes
1 answer
How do I set the anomaly score in crs-setup.conf?
I am using v3.0.0 of CRS with ModSecurity set to DetectionOnly mode and the nginx connector.
I want to set the anomaly score to 100 or so to fine-tune the settings, but I can't see where or how to do that.
Looking in crs-setup.conf
nginx 1.18.0 if…
![](../../users/profiles/152066.webp)
richardwhitney
- 113
- 4
0
votes
0 answers
Can't get docker image owasp/modsecurity-crs:apache reverse proxy to work
I have an endpoint https://my-portal.nl and I wan't to place a WAF with the OWASP Core rule set before it. So I found a Docker image(owasp/modsecurity-crs:apache) that can proxy all the requests to my endpoint (https://my-portal.nl). For some reason…
![](../../users/profiles/786958.webp)
RAGI
- 1
- 1