headers
Jason Edgecombe | 1 Dec 01:09
Picon

Re: Trigger modsec log/deny from web script - logging web spam flagged by b2evolution

Ivan Ristic wrote:

>Jason Edgecombe wrote:
>  
>
>>Hi there,
>>
>>Is there a way to have mod_security deny and log a request based on the
>>action of a php/perl/cgi script?
>>
>>Specifically, I'm using b2evolution for weblogs and I want to have
>>mod_security log the requests that b2evolution marks as spam. Currently,
>>b2evolution returns a 403 when a comment/trackback is spam. I don't see
>>a way to trigger mod_security based on response code. Would setting an
>>environment variable from within a PHP script accomplish this?
>>    
>>
>
>  How about:
>
>  SecAuditLogRelevantStatus ^403$
>
>  
>
Excellent! I'll implement that.

Is there another way incase I don't want to use the http error code?

For example, a http request contains a spam referrer, but I still want 
to serve the page to the client.
(Continue reading)

Permalink | Reply | 1 comment |
headers
Ivan Ristic | 1 Dec 19:37
Gravatar

Re: Trigger modsec log/deny from web script - logging web spam flagged by b2evolution

Jason Edgecombe wrote:
>
> Excellent! I'll implement that.
> 
> Is there another way incase I don't want to use the http error code?
> 
> For example, a http request contains a spam referrer, but I still want
> to serve the page to the client.

  I don't know anything about your software but you can serve
  a perfectly normal looking page with code 403 (since the code
  is not shown to the user). But if your setup does not allow
  for that you can try to use output buffering and catch
  spammers with:

  SecFilterSelective OUTPUT "keyword in the response"

  This is a somewhat slower solution, though.

--

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
(Continue reading)

Permalink | Reply | 0 comments |
headers
Ivan Ristic | 1 Dec 19:40
Gravatar

Re: Exception

Randvo wrote:
>
> But what if i want to disable a specific rule in a specific file on a
> specific domain/user ??

  Option #1, add the <Location> tags to the <VirtualHost> container.

  Option #2, use <Directory>

  Also have a look at SecFilterRemove (in the manual).

--

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
Permalink | Reply | 0 comments |
headers
Ann Hopkins | 3 Dec 01:32

Apache 2.2.0 - Mod Security 1.9.1 - Webdav Folder


I moved my webdav folder out of the general root directory structure in apache,
and used "SecFilterInheritance Off", but it "Mod_security" still blocks the
request.  I would appreciate any ideas. Thanks

Error Message - Apache
========================
[Fri Dec 02 16:24:47 2005] [error] [client 192.168.254.XXX] mod_security: Access
denied with code 403. Pattern match
"!(^application/x-www-form-urlencoded$|^multipart/form-data;)" at
HEADER("Content-Type") [hostname "www.example.com"] [uri "/"]
[Fri Dec 02 16:24:47 2005] [error] [client 192.168.254.XXX] mod_security: Access
denied with code 403. Pattern match
"!(^application/x-www-form-urlencoded$|^multipart/form-data;)" at
HEADER("Content-Type") [hostname "www.example.com"] [uri "/tails"]

httpd-dav.conf
=========================
DavLockDB /usr/local/apache/var/DavLock
DAVMinTimeout 600

Alias /tails/ "/<non-standard location>/tails/"

<Directory "/<non-standard location>/tails">
    Dav On

    Options Indexes MultiViews

    AllowOverride AuthConfig
    Order allow,deny
(Continue reading)

Permalink | Reply | 5 comments |
headers
Ivan Ristic | 3 Dec 10:39
Gravatar

Re: Apache 2.2.0 - Mod Security 1.9.1 - Webdav Folder

Ann Hopkins wrote:
> I moved my webdav folder out of the general root directory structure in apache,
> and used "SecFilterInheritance Off", but it "Mod_security" still blocks the
> request.  I would appreciate any ideas. Thanks

  You appear to be doing the right thing. This may be a problem with
  the order in which contexts are inherited in Apache.

  Show us the part where you create ModSecurity configuration.

--

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
Permalink | Reply | 2 comments |
headers
Ann Hopkins | 3 Dec 18:57

Re: Apache 2.2.0 - Mod Security 1.9.1 - Webdav Folder


Apache 2.2.0 configuration now uses a modular configuration file with includes
and this is the portion at the the end of the "http.conf" file - modules are
activated at the beginning of this file.

...
# Distributed authoring and versioning (WebDAV)
Include conf/httpd-dav.conf

# Various default settings
Include conf/httpd-default.conf

# Modsecurity filtering (Specific)
Include conf/httpd-modsecurity.conf

# Handypaws - Directories - Aliases (Specific)
Include conf/httpd-handypaws.conf

# Secure (SSL/TLS) connections
Include conf/httpd-ssl.conf
#
# Note: The following must must be present to support
#       starting without SSL on platforms with no /dev/random equivalent
#       but a statically compiled-in mod_ssl.
#
<IfModule ssl_module>
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
</IfModule>
(Continue reading)

Permalink | Reply | 1 comment |
headers
Ivan Ristic | 3 Dec 19:16
Gravatar

Re: Apache 2.2.0 - Mod Security 1.9.1 - Webdav Folder

Ann Hopkins wrote:
> I moved my webdav folder out of the general root directory structure in apache,
> and used "SecFilterInheritance Off", but it "Mod_security" still blocks the
> request.  I would appreciate any ideas. Thanks

  The way you have Apache configured right now

    Alias /tails/ "/<non-standard location>/tails/"

  Alias "kicks in" only when you provide the / at the end of the
  URI. But this is not happening:

> [Fri Dec 02 16:24:47 2005] [error] [client 192.168.254.XXX] mod_security: Access
> denied with code 403. Pattern match
> "!(^application/x-www-form-urlencoded$|^multipart/form-data;)" at
> HEADER("Content-Type") [hostname "www.example.com"] [uri "/tails"]

  Without the / at the end Apache treats the request as one
  for the root context. (You would be getting a 404 response if it
  were not for ModSecurity.)

  You can test my assumption my making a request to "/tails/" instead
  of "/tails".

  Changing the Alias line to:

    Alias /tails "/<non-standard location>/tails"

  should fix the problem.
(Continue reading)

Permalink | Reply | 1 comment |
headers
Ann Hopkins | 3 Dec 19:35

Re: Apache 2.2.0 - Mod Security 1.9.1 - Webdav Folder


I forgot to add that I was using Windows XP to connect using Webdav.

"/tails/" did not work.  I also have to trick Windows XP to use basic
authentication otherwise it fails miserably.  "http://www.example.com:80/tails"
does work after changing the alias to what you suggested.

Weird that it worked before in pre-2.2.0 but I have a lot of those quirks yesterday.

Thank you.

Ivan Ristic wrote:
> Ann Hopkins wrote:
> 
>>I moved my webdav folder out of the general root directory structure in apache,
>>and used "SecFilterInheritance Off", but it "Mod_security" still blocks the
>>request.  I would appreciate any ideas. Thanks
> 
> 
>   The way you have Apache configured right now
> 
>     Alias /tails/ "/<non-standard location>/tails/"
> 
>   Alias "kicks in" only when you provide the / at the end of the
>   URI. But this is not happening:
> 
> 
>>[Fri Dec 02 16:24:47 2005] [error] [client 192.168.254.XXX] mod_security: Access
>>denied with code 403. Pattern match
>>"!(^application/x-www-form-urlencoded$|^multipart/form-data;)" at
(Continue reading)

Permalink | Reply | 0 comments |
headers
Philippe Bourcier | 5 Dec 10:37

Re: Apache 2.2.0 - Mod Security 1.9.1 - Webdav Folder


Hi,

If think I had issues with Webdav/IE too.

You should replace this :

>     SecFilterSelective HTTP_Content-Type
>"!(^application/x-www-form-urlencoded$|^multipart/form-data;)"

With this :
SecFilterSelective HTTP_Content-Type 
"!(^$|^application/x-www-form-urlencoded$|^multipart/form-data|^text/xml)"

It worked for me.

Sincerely,

Philippe Bourcier

-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
Permalink | Reply | 0 comments |
headers
Aviram Carmi | 6 Dec 22:07

problem compiling?

Hi all,

relatively new to this, so I am probably making a very obvious mistake...

I am getting errors installing/compiling mod_security.

can you help?

thanks,

-avi

here is the requested info

# cd apache2/
# apxs -cia mod_security.c
/etc/httpd/build/libtool --silent --mode=compile gcc -prefer-pic 
-DAP_HAVE_DESIGNATED_INITIALIZER -DLINUX=2 -D_REENTRANT 
-D_XOPEN_SOURCE=500 -D_BSD_SOURCE -D_SVID_SOURCE -g -O2 -pthread 
-DNO_DBM_REWRITEMAP -I/usr/include/httpd  -c -o mod_security.lo 
mod_security.c && touch mod_security.slo
mod_security.c: In function `sec_audit_logger_concurrent':
mod_security.c:5419: `APR_MD5_DIGESTSIZE' undeclared (first use in 
this function)
mod_security.c:5419: (Each undeclared identifier is reported only once
mod_security.c:5419: for each function it appears in.)
mod_security.c: In function `register_hooks':
mod_security.c:7959: incompatible type for argument 3 of 
`ap_register_input_filter'
mod_security.c:7959: too many arguments to function `ap_register_input_filter'
(Continue reading)

Permalink | Reply | 1 comment |

Gmane