Re: SecServerSignature not working

I'd like to follow up on Ryan's message here.

> While I am all for "Security WITH Obscurity" this is ultimately a
losing
> battle.   There is no way that you can totally obscure the platform
that
> you are running. 

When working with obscurity, you have to be very careful about your
intentions.
Obscurity lures you into a false security feeling. You mean to go
unnoticed,
while in fact it's plainly obvious what you are hiding.

However, there are things you really should do and it has to do with
modern style attacking.
Amichai Shulman presented on Google Hacking at the OWASP conference
in Belgium.
http://www.owasp.org/images/6/6a/AppSecEU08-BeyondGoogleHacking-AmichaiS
hulman.ppt

The point is, that you do not want to show up in google with your Apache
version
and possibly the PHP version string on top of that. So setting Apache
ServerSignature and
also ServerTokens is a must. See Ryan's CIS Apache Benchmark for
details.
-> http://www.cisecurity.org/bench_apache.html

And there is more to it. If you are obscuring your server, you are

How 2 fix it ?

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users

Re: How 2 fix it ?

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users

Re: How 2 fix it ?

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users

Logging

Hello,

In order to not have complete files (binary) in my log, I use 
"SecAuditLogParts  ABIFHZ"; I do not log the "C" part, as it contains 
the file content.
However, when doing this, I do not see the uploaded file name in the 
log, like with "C":
    Content-Disposition: form-data; name="userfile"; filename="..."
    Content-Type: application/msword

Wouldn't it be a good idea to add these two lines in the "I" part ?

Is there any work-around ?

Thanks

Nick

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

ModSecurity with Tivoli WebSeal

Did somebody integrated ModSecurity with Tivoli WebSeal ?
Are there any differences between WebSeal and Apache 2 architecture that 
could lead to an incompatibility ?

Thanks

Nick

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

Re: ModSecurity with Tivoli WebSeal

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users

Re: ModSecurity with Tivoli WebSeal

The primary goal would be to add ModSecurity to the Webseal instance ...

Nick

Terje Sannum wrote:
> If you with integrate mean using ModSecurity as a reverse proxy in front 
> of WebSeal, I have tested this and did not run into any problems.
> 
> On Tue, Jun 3, 2008 at 10:34 AM, Nick Gearls <nickgearls <at> gmail.com 
> <mailto:nickgearls <at> gmail.com>> wrote:
> 
>     Did somebody integrated ModSecurity with Tivoli WebSeal ?
>     Are there any differences between WebSeal and Apache 2 architecture that
>     could lead to an incompatibility ?
> 
>     Thanks
> 
> 
>     Nick
> 
> 
>     -------------------------------------------------------------------------
>     This SF.net email is sponsored by: Microsoft
>     Defy all challenges. Microsoft(R) Visual Studio 2008.
>     http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
>     _______________________________________________
>     mod-security-users mailing list
>     mod-security-users <at> lists.sourceforge.net
>     <mailto:mod-security-users <at> lists.sourceforge.net>
>     https://lists.sourceforge.net/lists/listinfo/mod-security-users
> 
> 

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

Re: REQUEST_BODY question.

Try with these directives

     SecRequestBodyAccess On
     SecResponseBodyAccess On

  SoFy DeNiro wrote:

> Hello,
> 
> I'm trying to make some files denied for any user,expect if he have 0 
> UID. I tried this rule :
> 
> SecRule SCRIPT_FILENAME|REQUEST_BODY "^/home/user/important\.php$" chain
> SecRule "SCRIPT_UID "!^0$".
> 
> then, I can't log to this file from browser and that's fine, but I can 
> get it from php codes, so that's mean the REQUEST_BODY didn't work..
> 
> any suggestions ?
> Thanks.
> 
> 
> ------------------------------------------------------------------------
> 
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> mod-security-users mailing list
> mod-security-users <at> lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/mod-security-users

-- 
_________________________________
Jordi Rubió Romero
Ingeniero de Software
Dpto. Seguridad Gestionada
jrubio <at> isecauditors.com

Internet Security Auditors, S.L.
c. Santander, 101. Edif. A. 2º
E-08030 Barcelona
Tel: +34 93 305 13 18
Fax: +34 93 278 22 48
www.isecauditors.com
           ____________________________________
Este mensaje y los documentos que, en su caso lleve anexos, pueden
contener información CONFIDENCIAL. Por ello, se informa al
destinatario que la información contenida en el mismo es reservada y
su uso no autorizado, publicación o difusión, entera o parcialmente,
tanto en formato o medio físico como electrónico, sin el previo
consentimiento de Internet Security Auditors, está prohibida legalmente.

Si ha recibido este correo por error, le rogamos que nos lo comunique
por la misma vía o por teléfono (93 305 13 18), se abstenga de
realizar copias del mensaje o remitirlo o entregarlo a otra persona y
proceda a borrarlo de inmediato.

En cumplimiento de la Ley Orgánica 15/1999 de 13 de diciembre de
protección de datos de carácter personal, Internet Security Auditors
S.L., le informa de que sus datos personales se han incluido en
ficheros informatizados titularidad de Internet Security Auditors
S.L., que será el único destinatario de dichos datos, y cuya finalidad
exclusiva es la gestión de clientes y acciones de comunicación
comercial, y de que tiene la posibilidad de ejercer los derechos de
acceso, rectificación, cancelación y oposición previstos en la ley
mediante carta dirigida a Internet Security Auditors, c. Santander,
101. Edif. A. 2º, 08030 Barcelona, o vía e-mail a la siguiente dirección 
de correo: legal <at> isecauditors.com

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

Mailman mod-security rules

Hi,

I tried searching for this problem, but since this list uses Mailman
my searching skills became futile 

Here's my problem:

I'm using mod-security (current rules) with a Mailman system.   All
works well except for one small problem.... If an administrator
rejects a moderated post, and includes additional (optional) rejection
text via the message detailed form, mod-security blocks the post with
these details:

H:
   Message: Access denied with code 500 (phase 2). Pattern match
"\\n[[:space:]]*(to|b?cc)[[:space:]]*:.*@" at ARGS:headers-58.

C: (sanitized)
58=2&forward-addr-58=list-owner%40domain.tld&comment-58=Your+message+was+deemed+inappropriate+by+the+moderator.++Blah...test+text...%0D%0Athis+is+more+text...&headers-58=Return-Path%3A+%26lt%3Badmin%40domain.tld%26gt%3B%0D%0AX-Original-To%3A+list%40domain.tld%0D%0AReceived%3A+from+mx.domain.tld+%28localhost.localdomain+%5B127.0.0.1%5D%29%0D%0A%09by+mx.domain.tld+%28Postfix%29+with+ESMTP+id+4403F254204%0D%0A%09for+%26lt%3Blist%40domain.tld%26gt%3B%3B+Tue%2C++3+Jun+2008+13%3A32%3A57+-0400+%28EDT%29%0D%0AReceived%3A+by+mx.domain.tld+%28Postfix%2C+from+userid+65534%29%0D%0A%09id+327FA374009%3B+Tue%2C++3+Jun+2008+13%3A32%3A57+-0400+%28EDT%29%0D%0AX-Spam-Checker-Version%3A+SpamAssassin+3.2.3+%282007-08-08%29+on+mx.domain.tld%0D%0AX-Spam-Level%3A+%0D%0AX-Spam-Status%3A+No%2C+score%3D-0.3+required
 %3D3.5+list%3DBAYES_00%2CFORGED_YAHOO_RCVD%0D%0A%09autolearn%3Dno+version%3D3.2.3%0D%0AReceived%3A+from+wx-out-0506.google.com+%28wx-out-0506.google.com+%5B66.249.82.230%5D%29%0D%0A%09by+mx.
 domain.tld+%28Postfix%29+with+ESMTP+id+E7754254204%0D%0A%09for+%26lt%3Blist%40domain.tld%26gt%3B%3B+Tue%2C++3+Jun+2008+13%3A32%3A55+-0400+%28EDT%29%0D%0AReceived%3A+by+wx-out-0506.google.com+with+SMTP+id+i30so1140636wxd.2%0D%0A%09for+%26lt%3Blist%40domain.tld%26gt%3B%3B+Tue%2C+03+Jun+2008+10%3A32%3A56+-0700+%28PDT%29%0D%0AReceived%3A+by+10.90.101.7+with+SMTP+id+y7mr13478646agb.119.1212514376528%3B%0D%0A%09Tue%2C+03+Jun+2008+10%3A32%3A56+-0700+%28PDT%29%0D%0AReceived%3A+by+10.90.75.3+with+HTTP%3B+Tue%2C+3+Jun+2008+10%3A32%3A56+-0700+%28PDT%29%0D%0AMessage-ID%3A+%26lt%3B7ff145960806031032y26261f9etc8d36c7f1d283373%40mail.gmail.com%26gt%3B%0D%0ADate%3A+Tue%2C+3+Jun+2008+13%3A32%3A56+-0400%0D%0AFrom%3A+%26quot%3BUser+Name%26quot%3B+%26lt%3Bposter%40domain.tld%26gt%3B%0D%0ASender%3A+admin%40do
 main.tld%0D%0ATo%3A+list%40domain.tld%0D%0ASubject%3A+Test+email%0D%0AMIME-Version%3A+1.0%0D%0AContent-Type%3A+text%2Fplain%3B+charset%3DISO-8859-1%0D%0AContent-Transfer-Encoding%3A+7bit%0D%
 0AContent-Disposition%3A+inline%0D%0AX-Virus-Scanned%3A+ClamAV+on+mx.domain.tld&fulltext-58=Test+email%0D%0A%0D%0A&submit=Submit+All+Data

This action makes sense for non-Mailman systems, how can I override
this for specific hosts/text/etc?

Thanks!

-Jim P.

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/