Apache mod-security

headers

Tinext Support (Tinext | 1 Jul 2010 17:20

Rules 2.0.5 to 2.0.7 don't block

Hello,

We just updated the rules from 2.0.5 to 2.0.7, but now it doesn’t block the attack.

For example

http://xxxxxxx/test.jsp?file=/etc/passwd

Is not blocked.

But with the 2.0.5 it blocks. What is wrong?

Thank you,

Regards

J

------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Appliances, Rule Sets and Support:
http://www.modsecurity.org/breach/index.html

headers

JASPREET BINDRA | 5 Jul 2010 14:58

Reverse proxying configuration for using mod-security

Dear ALL 

I am a newbie at Mod-Security and my web servers are Windows Based (IIS in
particular). I will be using mod-security with Apache in Reverse-proxy Mode.
Now I have a particular requirement with respect to apache working in
reverse-proxy mode 

 Well i have a very peculiar question for reverse proxy 

In my netwrok there are different internal web servers hosting different web
applications eg 

i have three webserver(IIS) and they have different web applications serverd

let say the websites are :http://internal1.example.com hosted on internal1
machine 

http://internal2.example.com hosted on internal2 machine and
http://internal3.example.com hosted on internal3 machine

so my query is that my reverse proxy should work in such a way that any
external  request from Internet World 

a)for internal1.example.com should map to internal1.example.com and 

b)internal2.example.com should map to internal2.example.com and 

c) internal3.example.com should point to internal3 .example.com

so in all there are three web servers hosting 3 web websites. so my
questions is what will be the reverse proxying configuration and
architecture for this scenario ?

thanks

Jaspreet

THIS MAIL IP/VPN HAS BEEN SCANNED BY MCAFEE e-APPLIANCE

------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Appliances, Rule Sets and Support:
http://www.modsecurity.org/breach/index.html

headers

Mark Watts | 5 Jul 2010 16:08

Re: Reverse proxying configuration for using mod-security

On Mon, 2010-07-05 at 18:28 +0530, JASPREET BINDRA wrote:
> Dear ALL 
> 
>  
> 
> I am a newbie at Mod-Security and my web servers are Windows Based
> (IIS in particular). I will be using mod-security with Apache in
> Reverse-proxy Mode. Now I have a particular requirement with respect
> to apache working in  reverse-proxy mode 
> 
>  
> 
>  Well i have a very peculiar question for reverse proxy 
> 
>  
> 
> In my netwrok there are different internal web servers hosting
> different web applications eg 
> 
> i have three webserver(IIS) and they have different web applications
> serverd 
> 
>  
> 
> let say the websites are :http://internal1.example.com hosted on
> internal1 machine 
> 
> http://internal2.example.com hosted on internal2 machine and
> http://internal3.example.com hosted on internal3 machine
> 
>  
> 
> so my query is that my reverse proxy should work in such a way that
> any external  request from Internet World 
> 
> a)for internal1.example.com should map to internal1.example.com and 
> 
> b)internal2.example.com should map to internal2.example.com and 
> 
> c) internal3.example.com should point to internal3 .example.com
> 
>  
> 
> so in all there are three web servers hosting 3 web websites. so my
> questions is what will be the reverse proxying configuration and
> architecture for this scenario ?

Reverse proxying has little to do with mod_security - you would be
better asking on the Apache users mailing list.

Mark.

-- 
Mark Watts BSc RHCE MBCS
Senior Systems Engineer, Managed Services Manpower
www.QinetiQ.com
QinetiQ - Delivering customer-focused solutions
GPG Key: http://www.linux-corner.info/mwatts.gpg

------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Appliances, Rule Sets and Support:
http://www.modsecurity.org/breach/index.html

headers

Jamuse | 5 Jul 2010 15:32

Re: Reverse proxying configuration for using mod-security

On Mon, Jul 5, 2010 at 3:58 PM, JASPREET BINDRA <jaspreet.bindra <at> eil.co.in> wrote:

so my query is that my reverse proxy should work in such a way that any external request from Internet World

a)for internal1.example.com should map to internal1.example.com and

b)internal2.example.com should map to internal2.example.com and

c) internal3.example.com should point to internal3 .example.com

Hi JASPREET,

You can create three virtual hosts files, which include something like:

<VirtualHost 1.2.3.4:80>
ServerName internal1.example.com
ProxyPass / http://internal1.example.com/
ProxyPassReverse / http://interna1.example.com/

# Other configuration settings here ...
# ...

</VirtualHost>

Then set the IP address in internal1.example.com in the hosts file, e.g.:
2.3.4.5 internal1.example.com

--
- Josh

------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Appliances, Rule Sets and Support:
http://www.modsecurity.org/breach/index.html

headers

Robert Stackhouse | 5 Jul 2010 19:52

Installing ModSecurity on Windows

Is there a windows binary for this somewhere?

Thanks,

Robert

------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Appliances, Rule Sets and Support:
http://www.modsecurity.org/breach/index.html

headers

Ivan Ristic | 5 Jul 2010 20:09

Re: Installing ModSecurity on Windows

Yes, there is, at:

http://www.apachelounge.com/download/

On Mon, Jul 5, 2010 at 6:52 PM, Robert Stackhouse
<robertstackhouse <at> gmail.com> wrote:
> Is there a windows binary for this somewhere?
>
> Thanks,
> Robert
> ------------------------------------------------------------------------------
> This SF.net email is sponsored by Sprint
> What will you do first with EVO, the first 4G phone?
> Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
> _______________________________________________
> mod-security-users mailing list
> mod-security-users <at> lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Appliances, Rule Sets and Support:
> http://www.modsecurity.org/breach/index.html
>
>

--

-- 
Ivan Ristic
ModSecurity Handbook [http://www.modsecurityhandbook.com]
SSL Labs [https://www.ssllabs.com/ssldb/]

------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Appliances, Rule Sets and Support:
http://www.modsecurity.org/breach/index.html

headers

Robert Stackhouse | 5 Jul 2010 22:14

I would like to log only specific requests and no others

I am trying to only log requests whose REQUEST_URI is of the form "/statusnet/api/statuses/update.xml"

Here is how I tried to do this:

SecRuleEngine On

SecAuditEngine On

SecAuditLogType Concurrent

SecAuditLogStorageDir C:/xampp/audit_log/data/

SecAuditLog C:/xampp/audit_log/index

#Log everything

SecAuditLogParts ABCDEFGHZ

#Don't want to log all requests to the audit log

SecDefaultAction "nolog,noauditlog,pass,phase:2"

#Only want to match /statusnet/api/statuses/update.xml

SecRule REQUEST_URI "^/statusnet/api/statuses/update\.xml$" "auditlog,pass,phase:2"

Obviously, my approach is not working. I have been over the documentation several times, but cannot find what I am looking for. Any help would be greatly appreciated.

Thanks,

Robert

------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Appliances, Rule Sets and Support:
http://www.modsecurity.org/breach/index.html

headers

Ryan Barnett | 6 Jul 2010 02:42

Re: I would like to log only specific requests and no others

Try switching the SecAuditEngine to RelevantOnly. When it is set to On, it will log all transactions regardless of whether or not a rule matches.

--
Ryan Barnett
Senior Security Researcher
SpiderLabs Research Team
Trustwave
www.trustwave.com

From: Robert Stackhouse
To: mod-security-users <at> lists.sourceforge.net
Sent: Mon Jul 05 16:14:07 2010
Subject: [mod-security-users] I would like to log only specific requests and no others
I am trying to only log requests whose REQUEST_URI is of the form "/statusnet/api/statuses/update.xml"

Here is how I tried to do this:

SecRuleEngine On

SecAuditEngine On

SecAuditLogType Concurrent

SecAuditLogStorageDir C:/xampp/audit_log/data/

SecAuditLog C:/xampp/audit_log/index

#Log everything

SecAuditLogParts ABCDEFGHZ

#Don't want to log all requests to the audit log

SecDefaultAction "nolog,noauditlog,pass,phase:2"

#Only want to match /statusnet/api/statuses/update.xml

SecRule REQUEST_URI "^/statusnet/api/statuses/update\.xml$" "auditlog,pass,phase:2"

Obviously, my approach is not working. I have been over the documentation several times, but cannot find what I am looking for. Any help would be greatly appreciated.

Thanks,

Robert

------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Appliances, Rule Sets and Support:
http://www.modsecurity.org/breach/index.html

headers

Robert Stackhouse | 6 Jul 2010 15:10

Re: I would like to log only specific requests and no others

Ryan,

Thanks, switching SecAuditEngine to RelevantOnly did the trick.

-Robert

On Mon, Jul 5, 2010 at 7:42 PM, Ryan Barnett <Ryan.Barnett <at> breach.com> wrote:

Try switching the SecAuditEngine to RelevantOnly. When it is set to On, it will log all transactions regardless of whether or not a rule matches.

--
Ryan Barnett
Senior Security Researcher
SpiderLabs Research Team
Trustwave
www.trustwave.com

From: Robert Stackhouse
To: mod-security-users <at> lists.sourceforge.net
Sent: Mon Jul 05 16:14:07 2010
Subject: [mod-security-users] I would like to log only specific requests and no others

I am trying to only log requests whose REQUEST_URI is of the form "/statusnet/api/statuses/update.xml"

Here is how I tried to do this:

SecRuleEngine On

SecAuditEngine On

SecAuditLogType Concurrent

SecAuditLogStorageDir C:/xampp/audit_log/data/

SecAuditLog C:/xampp/audit_log/index

#Log everything

SecAuditLogParts ABCDEFGHZ

#Don't want to log all requests to the audit log

SecDefaultAction "nolog,noauditlog,pass,phase:2"

#Only want to match /statusnet/api/statuses/update.xml

SecRule REQUEST_URI "^/statusnet/api/statuses/update\.xml$" "auditlog,pass,phase:2"

Obviously, my approach is not working. I have been over the documentation several times, but cannot find what I am looking for. Any help would be greatly appreciated.

Thanks,

Robert

--
Robert Stackhouse

http://robertstackhouse.com/flavorsof
http://agilebcs.org
http://bcsbloggers.org
http://uweb.tamu.edu

------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Appliances, Rule Sets and Support:
http://www.modsecurity.org/breach/index.html

headers

Dropbox | 7 Jul 2010 06:07

Sedthakit Prasanphanich has invited you to Dropbox

We're excited to let you know that Sedthakit Prasanphanich has invited you to Dropbox!

Sedthakit Prasanphanich has been using Dropbox to sync and share files online and across computers, and thought you might want it too.

Visit www.dropbox.com to get started.

- The Dropbox Team

To stop receiving invites from Dropbox, click here

------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Appliances, Rule Sets and Support:
http://www.modsecurity.org/breach/index.html

Mon	Tue	Wed	Thu	Fri	Sat	Sun

			1	2	3	4
5	6	7	8	9	10	11
12	13	14	15	16	17	18
19	20	21	22	23	24	25
26	27	28	29	30	31

92	May 2013
69	April 2013
107	March 2013
96	February 2013
96	January 2013
60	December 2012
42	November 2012
52	October 2012
62	September 2012
64	August 2012
95	July 2012
60	June 2012
39	May 2012
11	April 2012
46	March 2012
123	February 2012
80	January 2012
44	December 2011
51	November 2011
78	October 2011
108	September 2011
104	August 2011
111	July 2011
66	June 2011
185	May 2011
54	April 2011
72	March 2011
69	February 2011
76	January 2011
26	December 2010
51	November 2010
69	October 2010
79	September 2010
67	August 2010
67	July 2010
59	June 2010
88	May 2010
59	April 2010
130	March 2010
117	February 2010
99	January 2010
80	December 2009
156	November 2009
112	October 2009
73	September 2009
134	August 2009
92	July 2009
78	June 2009
132	May 2009
104	April 2009
127	March 2009
131	February 2009
137	January 2009
85	December 2008
82	November 2008
84	October 2008
154	September 2008
167	August 2008
187	July 2008
95	June 2008
115	May 2008
89	April 2008
97	March 2008
134	February 2008
159	January 2008
56	December 2007
205	November 2007
135	October 2007
97	September 2007
162	August 2007
130	July 2007
250	June 2007
191	May 2007
150	April 2007
181	March 2007
161	February 2007
166	January 2007
104	December 2006
172	November 2006
103	October 2006
83	September 2006
101	August 2006
92	July 2006
116	June 2006
65	May 2006
139	April 2006
82	March 2006
148	February 2006
61	January 2006
74	December 2005
104	November 2005
49	October 2005
28	September 2005
51	August 2005
27	July 2005
71	June 2005
26	May 2005
53	April 2005
82	March 2005
61	February 2005
67	January 2005
12	December 2004
22	November 2004
28	October 2004
31	September 2004
24	August 2004
36	July 2004
20	June 2004
15	May 2004
47	April 2004
21	March 2004
13	February 2004
44	January 2004
18	December 2003
13	November 2003
11	October 2003
9	September 2003
7	August 2003
16	July 2003
1	June 2003