Re: horde becoming dead-slow after modsec2 withgotroot rules installed
Éliás Tamás <eliast <at> nagykanizsa.hu>
2006-12-03 01:10:06 GMT
Udv / Greetings!
these are my apache and php compilation options:
#Compile settings
SET_COMPILESETTINGS="--sysconfdir=$SET_SYSCONFDIR --localstatedir=$SET_VARDATADIR
--disable-userdir \
--disable-pie --disable-actions --disable-asis --disable-cgi --disable-cgid --disable-imap \
--disable-autoindex --disable-so --disable-suexec --disable-rewrite --disable-ldap
--disable-ftp \
--disable-status --disable-info --enable-usertrack --enable-unique-id --enable-mime-magic \
--enable-deflate --with-pcre --enable-mime --enable-ssl --with-ssl=$CLI_OSSLDIR
--enable-headers \
--enable-include"
#
# Application specific settings
#
SET_PHPCONF="--disable-all --with-config-file-path=/etc/php5-portal
--with-openssl=$CLI_OSSLDIR \
--with-zlib --with-bz2 --with-curl --enable-mbstring --enable-calendar --with-pear --without-db4 \
--with-pcre-regex --enable-memory-limit --enable-ssl --enable-dom --with-dom \
--enable-session --with-tsrm-pthreads --enable-inline-optimization --enable-libxml
--with-kerberos \
--enable-dio --with-ldap --enable-mbregex --with-png-dir=/usr --with-jpeg-dir=/usr --enable-ftp
--enable-xml \
--with-gettext --with-mcrypt --with-mhash --with-iconv --with-gd --with-gettext --with-mcrypt
--with-iconv --with-imap \
--with-imap-ssl --enable-mime-magic --with-mime-magic --enable-memcache --enable-ctype
--with-dom-xslt \
--disable-cgi --disable-safe-mode --disable-short-tags --enable-zend-memory-manager"
also I'm using some C options:
CLI_CFLAGS="-O3 -march=pentium4 -ffast-math -pipe -fomit-frame-pointer -mfpmath=sse,387 -msse2
-mmmx -msse"
the apache is running chrooted.
> 2) You are using way too many/unneeded rules from Gotroot.
possible, I've never looked it on them deeply, only when I did need
it. with 1.9 modsec I had to tune it up to work with phpmyadmin (for
SQL scripts to work and not give an injection attack error) and horde.
I did these tunes for the new ruleset too. and they are working, but
DEAD slow, especially the horde framework. phpldapadmin and phpmyadmin
works fine.
> Don't get me wrong (Mike Shinn, if you are reading this :), Gotroot
> is a great resource for ModSecurity attack signatures however most
yeah, it is.
> people are implementing ALL of the signatures and that is overkill.
> Keep in mind that ModSecurity is a WAF and not an IDS. The big
> difference here is that IDS sensors need to have more and more
> negative sigs to be able to catch attacks. They don't really have a
> fear of negatively impacting the actual connection. When you are
> inline, as Modsecurity is, you need your rulesets to be tight and
> efficient. Point being, if I am an Apache shop using Java, why
> would I want to include 300 rules for ASP/PHP attacks? It will do
> nothing but impact my performance.
Yeah, sure. But my bosses want's secure applications in even hours, so
I sadly do not have time to revise and optimize. If I say: well,
security needs my time, they say no. If I say, well security means
buying a plus processor and some ram and pplying security rules that
we will never use, they say, ok. :(
--
Thomas Elias
Title: *NIX Sysadmin, PHP/Delphi/C++ programmer, Certified IBM UDB DB2 Database Administrator
mailto: eliast <at> venk.hu, eliast <at> kanizsanet.hu
Tel.: +3630/3484202
ICQ UIN: 206-714-459
Quote: "Non Omnis Moriar"
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
RSS Feed