Thursday, 12 December 2013

Modsecurity

ModSecurity is a web application firewall for the Apache web server. In addition to providing logging capabilities, ModSecurity can monitor the HTTP traffic in real time in order to detect attacks. ModSecurity also operates as a web intrusion detection tool, allowing you to react to suspicious events that take place at your web systems.
The rules are in the file "/usr/local/apache/conf/modsec2.user.conf" depending on apache version.

The error related with mod security is specified in the apache error log

The rule must be removed for this site, by creating custom conf in the apache conf for this domain and remove the id. Create below file using username, domain name, file name-mod_sec2.conf. Location match and Id obtained from the apache error_log. 

=================
root@server [/usr/local/apache/conf/userdata/std/2/username/domain_name]# cat mod_sec2.conf <IfModule mod_security2.c>
<LocationMatch "URL">
SecRuleRemoveById id
</LocationMatch>
</IfModule>
=================


Disable mod sec for a domain completely.

Just create a directory:

 mkdir -p /usr/local/apache/conf/userdata/std/2/username/domain.com

Then create a file:   /usr/local/apache/conf/userdata/std/2/username/domain.com/mod_security.conf

In that file add:

 <IfModule mod_security.c>
SecRuleEngine Off
</IfModule>

Save it.

 Then run:   /scripts/ensure_vhost_includes --user=username


No comments:

Post a Comment