ModSecurity supplies an array of request and response filtering rules and other security features to the Apache HTTP Server. ModSecurity is an open source web application layer firewall.
Questions tagged [mod-security]
334 questions
1
vote
1 answer
Apache server fault after configure mod-security2
I configured mod-security, from https://www.digitalocean.com/community/tutorials/how-to-set-up-mod_security-with-apache-on-debian-ubuntu . After that a restart apache service but i caught error:
The apache2 configtest failed. Output of config test…
![](../../users/profiles/264367.webp)
Jan Richter
- 21
- 1
- 2
1
vote
0 answers
ModSecurity on Apache 2.2 in EC2 - HTTP Status 413 messages dropped
Hi I am running Mod_Security on Ubuntu instances in EC2 behind an Elastic Loadbalancer. The app is a Ruby App.
I have set
SecRequestBodyLimit 293601280
When I upload files below that size, they are processed as expected. When I exceed the size…
![](../../users/profiles/258073.webp)
Dan Goldberg
- 11
- 1
1
vote
1 answer
mod_security RBL - apparent false positive
I'm struggling with an RBL rule in mod_security under apache 2.2 that seems to be giving me a false positive. I see the following in the audit log (IP address redacted):
Message: RBL lookup of 4.3.2.1.sbl-xbl.spamhaus.org succeeded at REMOTE_ADDR.…
![](../../users/profiles/157157.webp)
KenB
- 162
- 1
- 6
1
vote
1 answer
Proper SSL config for SSL - Apache2 ignores DocumentRoot
So here's my current config:
DocumentRoot "/var/www/keypad"
ServerName keypad.io
SSLOptions +StrictRequire
SSLRequireSSL
SSLProtocol -all +TLSv1
SSLEngine on
…
![](../../users/profiles/249242.webp)
subdavis
- 111
- 3
1
vote
1 answer
Changing ModSecurity Logging on a Per Transaction Basis
I am trying to trace all requests being made to a website on a shared hosting server. Packet capture is just going to be too cumbersome.
We use Mod Security (2.8) with good effect, although due to the load we only have limited logging…
![](../../users/profiles/238865.webp)
Santrix
- 253
- 3
- 10
1
vote
1 answer
Simple DoS protection with mod_security?
I have mod security2 in ubuntu 14.04 LTS server.
I saw the below tutorial:
http://blog.cherouvim.com/simple-dos-protection-with-mod_security/
The above sadly do not work on me apache error :
* Restarting web server apache2 …
![](../../users/profiles/236728.webp)
Shake-the-World
- 11
- 5
1
vote
2 answers
PHP and Text Area Triggering Mod_Security
I have some text areas in a form that are posted back and stored using PHP / MySQL. However, if a user presses return for a new line in the text area, mod_security is blocking it with the below log entry:
Pattern match "\\W{4,}" at ARGS:notes.…
![](../../users/profiles/160944.webp)
Jason
- 371
- 1
- 7
- 19
1
vote
1 answer
Apache mod_security crs blocking PDF files
I've just installed CRS for Apache mod_security and it's reporting all PDF files as possible attacks. Specificaly, it's the modsecurity_crs_20_protocol_violations.conf that's causing the trouble saying those files begin with 0.
When a user tries to…
![](../../users/profiles/229780.webp)
Petr
- 11
- 3
1
vote
1 answer
Apache error_log filled with modsec blocks
Ever since I enabled Apache modsecurity I've been checking the logs and been seeing the following constantly like 24/7:
[Wed Jun 25 12:40:07 2014] [error] [client 112.215.65.61] ModSecurity: Access denied with code 501 (phase 2). Pattern match…
![](../../users/profiles/225491.webp)
Ivan
- 893
- 2
- 9
- 23
1
vote
2 answers
ModSecurity Error Entries
Recently, I was passed some error logs to take a look into, since we'd had some network spikes recently. However, I've never worked with modsecurity (I'm a programmer just doing this since we don't have a real sysadmin), and something alarming came…
![](../../users/profiles/2894.webp)
waiwai933
- 156
- 1
- 2
- 14
1
vote
0 answers
Curl Sourced DDoS: How to detect it & how to stop?
Okay, an Ubuntu server I manage fell victim to a DDoS attack today. Usually this is unpleasant but not that big a deal. A few high server load moments & then it passes. Today was clearly different. For the record, I have years of server attack…
![](../../users/profiles/100013.webp)
Giacomo1968
- 3,522
- 25
- 38
1
vote
2 answers
mod_security configuration issue: Error parsing actions: Unknown action: ver
I am trying to install / configure mod-sec using this tutorial, which uses the OWASP ModSecurity Core Rule Set. However when I go to restart apache, I get the following error:
Syntax error on line 53 of…
![](../../users/profiles/156809.webp)
Bob Flemming
- 1,175
- 3
- 13
- 17
1
vote
0 answers
nginx with fail2ban and mod_security
I forgot to update my fail2ban config for nginx. I just moved to nginx from apache.
Today, I got a lot of cals from a single IP.
IP tried to access login pages with post and get methods
IP tried to use nginx as a proxy (GET http:/...)
IP searched…
![](../../users/profiles/187886.webp)
Mahesh
- 237
- 1
- 3
- 16
1
vote
1 answer
How do I handle apache2 modsecurity2 warnings like Match of "rx ^OPTIONS$" against "REQUEST_METHOD" required?
After upgrade from squeeze to wheezy I get loads of these messages in my apache errorlog when I open a webpage on myserver, (changed to myserver.de here):
[Sat Oct 19 01:06:21 2013] [error] [client 213.239.220.106] ModSecurity: Warning. Match of "rx…
![](../../users/profiles/128892.webp)
rubo77
- 2,282
- 3
- 32
- 63
1
vote
0 answers
apache DirectoryMatch matching filenames
I have the following code in my security.conf file of apache
Options -ExecCGI
php_flag engine off
This is to prevent php execution…
![](../../users/profiles/139965.webp)
Virendra
- 111
- 4