gmane.comp.apache.mod-security.user

Re: New installation woes

On Thursday 02 July 2009 11:48:15 am you wrote:
> http://www.modsecurity.org/documentation/faq.ht
>ml#d0e400 should help you with the white list.
>
> On Thu, Jul 2, 2009 at 11:38 AM, Dimitri 
Yioulos<dyioulos <at> firstbhph.com> wrote:
> > I do have another question that I hope you'll
> > be kind enough to help me with.  I'd like to
> > whitelist my own network, as I'm getting the
> > following:
>
> --
> Walt Williams, CISSP, SSCP
> Ergo inimicus vobis factus sum, verum dicens
> vobis?

Walt,

I'm looking at the FAQ, but am not sure where to 
put the directive.  And, if I want to whitelist 
the entire network, would I use the 
construct "SecRule 
REMOTE_ADDR "^192\.168\.100\.0$" etcetc"?

Thanks.

Dimitri

--

-- 
This message has been scanned for viruses and

(Continue reading)

headers

Dimitri Yioulos | 2 Jul 17:38

Re: New installation woes

On Thursday 02 July 2009 11:14:39 am you wrote:
> On Thu, Jul 2, 2009 at 11:02 AM, Dimitri 
Yioulos<dyioulos <at> firstbhph.com> wrote:
> > LoadModule security2_module
> > modules/mod_security2.so
> > LoadFile /usr/lib/libxml2.so
> > LoadFile /usr/lib/liblua.so.5.0
> >
> > The LoadModule directive is all on one line.
>
> Do you have an include statement, as in
> "include conf/modsecurity/*.conf" ?
>
> --
> Walt Williams, CISSP, SSCP
> Ergo inimicus vobis factus sum, verum dicens
> vobis?

Ah, some light!

Just before your reply arrived, I saw a post that 
referred to  "include conf/modsecurity/*.conf".  
My httpd.conf still had the old "Include 
conf.d/*.conf" (conf.d is where the 
old "modsecurity.conf" lived.  I incorrectly 
thought that copying "modsecurity_example.conf" 
to "conf.d/modsecurity.conf", with appropriate 
changes, would work).  When I changed the 
httpd.conf directive to "Include 
conf.d/modsecurity/*.conf", I got the following

(Continue reading)

headers

Dimitri Yioulos | 2 Jul 16:32

New installation woes

Hello, all.

I've had version 1.9.4 running on a CentOS 4 box 
with httpd-2.0.2 for quite a while now.  
Yesterday, I decided to install the latest 
version.  I followed the installation guide, and  
apache started fine.  But, my tests with nikto 
and MetoScan don't seem to be caught.

I think I configured the logger correctly, but no 
data are written to /var/log/mlogc/data.  And, 
mlogc-error.log reports the following:

ModSecurity Audit Log collector 2.5.9 started
Queue file not found. New one will be created.

Is that normal?

What information should I provide so that someone 
might help me.  I'm pulling my hair out!

Many thanks.

Dimitri

--

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

(Continue reading)

headers

OSSEC junkie | 1 Jul 22:24

501 Message Not Implemented Question

I am trying to configure a user friendly error page to replace the 501 Method Not Implemented Page as suggested by the modsecurity_crs_10_config.conf file. I cannot for the life of me determine where this is located at. I am looking at my apache conf file for the correct path to the 501 error page, I modify the page, stop and restart Apache. Clear my cache and run the test and I still get the default Method Not Implemented Page instead of my custom page. I even went as far as deleting all the error pages from the machine, stop/start Apache, clear cache and I still received the error page. Is this something inside of ModSecurity itself I'm missing? I looked at the Reference Manual but nothing stood out as to what to do and where to go.

If you could point me in the right direction, that would be super.

------------------------------------------------------------------------------

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Appliances, Rule Sets and Support:
http://www.modsecurity.org/breach/index.html

headers

Ryan Barnett | 29 Jun 15:43

Generic Detection of RFI Attacks

I thought you all would be interested in my recent blog post on this topic - http://tacticalwebappsec.blogspot.com/2009/06/generic-remote-file-inclusion-attack.html

Cheers,

Ryan

------------------------------------------------------------------------------

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Appliances, Rule Sets and Support:
http://www.modsecurity.org/breach/index.html

headers

David Brown | 26 Jun 18:49

mod_security WSDL issue?

Hi,

I've been working with mod_security and it's been running fine except when dealing with soap and specifically wsdl. If I'm just using soap, I don't have an issue, but if wsdl is used, I get 401 Unauthorized errors.

mod_security's logs all report rules that either "pass" or "SkipAfter" and nothing that appears to outright reject anything. I've been banging on this for hours and I just can't figure out how to get the wsdl through mod_security.

Does mod_security have issues with wsdl? Does it mangle part of the request? I would think it wouldn't alter a request at all. It would either let it pass, or discard it.

I've had these issues with using a URL in a browser window and also with Ruby's SOAP4R soap library.

Thanks,

Dave

------------------------------------------------------------------------------

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Appliances, Rule Sets and Support:
http://www.modsecurity.org/breach/index.html

headers

Yi Li | 25 Jun 22:41

modsecurity is not able to load the GeoIP.dat file

will appreciate if someone could give me an insight here.
thanks in advance.

installed mod_securiyt 2.5.9 on RHEL 5.
when starting mod_security by restart apache, see the error msg below:

./apachectl start
Syntax error on line 1301 of /opt/IBMIHS/conf/httpd.conf:
SecGeoLookupDB takes one argument, database for geographical lookups module.

here is the conf part in httpd.conf

# Load mod_security
           LoadModule security2_module modules/mod_security2.so
# Configure GeoIP blocking
           <IfModule mod_security2.c>
               SecGeoLookupDb /opt/GeoIP.dat            #specify GeoIP datafeed
               SecRuleEngine On
               SecRule REMOTE_ADDR " <at> geoLookup" "nolog"     # look up GEO data
               SecRule GEO:COUNTRY_CODE "! <at> streq US" "deny" # block all the ip address from outside US
           </IfModule>

------------------------------------------------------------------------------

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Appliances, Rule Sets and Support:
http://www.modsecurity.org/breach/index.html

headers

Ryan Barnett | 24 Jun 19:14

Anyone attending Blackhat USA?

Is anyone already planning to attend the Blackhat USA conf in Las Vegas? If so, let me know as we (Breach) are considering having some sort of ModSecurity User Group meeting/get-together.

-Ryan

------------------------------------------------------------------------------

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Appliances, Rule Sets and Support:
http://www.modsecurity.org/breach/index.html

headers

Yi Li | 24 Jun 16:32

compile mod_security on RHEL 5 with IBM http server fails

greetings all, i am running a lot of issue in compiling mod_security on IBM RHEL 5. will appreciate any help.

problem: make test fails.
env: RHEL 5 with IBM http server (not default apache), 32bit machine, mod_security 2.5.9 source downloaded from mod_security site.

questions:
1. which OS user should mod_security be compiled as? the Apache owner or root? or does it matter?
2. the --with-pcre option, should it point to pcre-config or some bin/lib dir?
3. for all the apxs, pcre, apr. apu, which both devel and binary package are installed, and some of which may have more than 1 binary package installed, such as pcre, how do I make sure mod_security knows to point to the right header in compiling and right lib in running? can I include the specif binary path in LD_PATH env? if so, but for which OS user?
thanks in advance.
4. is there an earlier version which is easier to compile? I do not have to use the latest one.

steps performed:
1. install the following devel packages;

# yum install libxml2-devel httpd-devel curl-devel pcre-devel

2. run configure with options:
./configure --with-apxs=/opt/IBMIHS/bin/apxs --with-apr=/opt/IBMIHS/bin/apr-config --with-apu=/opt/IBMIHS/bin/apu-config

this step completes but I suspect the right lib for apu is not located. see msg.

configure: checking httpd version
configure: httpd is recent enough
Use of uninitialized value in concatenation (.) or string at /opt/IBMIHS/bin/apxs line 275.
checking for libpcre config script... /usr/bin/pcre-config
configure: using '-lpcre' for pcre Library
checking for libapr config script... /opt/IBMIHS/bin/apr-config
configure: using ' -lrt -lm -lcrypt -lnsl -ldl' for apr Library
checking for libapr-util config script... /opt/IBMIHS/bin/apu-config
configure: using ' -L/opt/IBMIHS/lib -laprutil-0' for apu Library
checking for libxml2 config script... /usr/bin/xml2-config
configure: using '-L/usr/lib -lxml2 -lz -lm' for libxml Library
checking for pkg-config script for lua library... no
configure: optional lua library not found
checking for libcurl config script... /usr/bin/curl-config
configure: using '-L/usr/kerberos/lib -lcurl -ldl -lgssapi_krb5 -lkrb5 -lk5crypto -lcom_err -lidn -lssl -lcrypto -lz ' for curl Library
configure: creating ./config.status

3. run make test to verify and see errors here;

gcc re.o re_operators.o re_actions.o re_tfns.o re_variables.o msc_logging.o msc_xml.o msc_multipart.o modsecurity.o msc_parsers.o msc_util.o msc_pcre.o persist_dbm.o msc_reqbody.o msc_geo.o acmp.o msc_lua.o msc_release.o -o msc_test msc_test.o -lpcre -L/usr/lib -lxml2 -lz -lm -L/opt/IBMIHS/lib /opt/IBMIHS/lib/libapr-0.so /opt/IBMIHS/lib/libaprutil-0.so -Wl,--rpath -Wl,/opt/IBMIHS/lib -Wl,--rpath -Wl,/opt/IBMIHS/lib
gcc: re.o: No such file or directory
gcc: re_operators.o: No such file or directory
gcc: re_actions.o: No such file or directory
gcc: re_tfns.o: No such file or directory
gcc: re_variables.o: No such file or directory
gcc: msc_logging.o: No such file or directory
gcc: msc_xml.o: No such file or directory

------------------------------------------------------------------------------

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Appliances, Rule Sets and Support:
http://www.modsecurity.org/breach/index.html

headers

Yi Li | 24 Jun 00:58

mod_security, strange thing when run it

on RHEL 5 IBM, I build mod_security from source and when trying to load it from htttpd, see really strange thing

scenario 1: run apachectl start from conf dir, fails:
[root <at> aw-ecweb01s conf]# ../bin/apachectl start
Syntax error on line 5 of /opt/IBMIHS/conf/mod_security.conf:
API module structure `security2_module' in file /usr/lib/httpd/modules/mod_security2.so is garbled - perhaps this is not an Apache module DSO?
scenario 2: run apachectl start from bin dir, httpd starts, but seems mod_security is not loaded:
[root <at> aw-ecweb01s conf]# cd ../bin
[root <at> aw-ecweb01s bin]# apachectl start

questions:
1. why the starting dir make such difference?
2. how do i know whether mod_security is loaded? I have debug logs but seems do not see any log being generated.

thanks!

------------------------------------------------------------------------------

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Appliances, Rule Sets and Support:
http://www.modsecurity.org/breach/index.html

headers

clau . | 23 Jun 15:09

problems installing mod_security

Hello,

I've tried installing mod_security (on ubuntu 8.10). I have installed libxml and libxml2.so is in usr/lib but mod_security (when I ./configure) doesn't see it. I have search the internet for a solution but nothing worked for me. (I have tried --with-libxml=/usr/lib/libxml2.so but no luck).

Thanks,
Symba

------------------------------------------------------------------------------
Are you an open source citizen? Join us for the Open Source Bridge conference!
Portland, OR, June 17-19. Two days of sessions, one day of unconference: $250.
Need another reason to go? 24-hour hacker lounge. Register today!
http://ad.doubleclick.net/clk;215844324;13503038;v?http://opensourcebridge.org

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Appliances, Rule Sets and Support:
http://www.modsecurity.org/breach/index.html

Mon	Tue	Wed	Thu	Fri	Sat	Sun

		1	2	3	4	5
6	7	8	9	10	11	12
13	14	15	16	17	18	19
20	21	22	23	24	25	26
27	28	29	30	31