Apache mod-security

Victor Sartori | 22 Mar 2013 15:35

Re: Installing mod_security 2.7.2

Hi guys,

I have a similar problem ...

Compiling on CentOs 5.4, using libxml2 (2.0 and using --with-libxml=/opt/libxml2.9), the modules for apache compiles, but when I run a ldd on mod_security.so i have this output:

ldd mod_security2.so
./mod_security2.so: /usr/lib64/libxml2.so.2: no version information available (required by ./mod_security2.so)
./mod_security2.so: /usr/lib64/libxml2.so.2: no version information available (required by ./mod_security2.so)
./mod_security2.so: /usr/lib64/libxml2.so.2: no version information available (required by ./mod_security2.so)
./mod_security2.so: /usr/lib64/libxml2.so.2: no version information available (required by ./mod_security2.so)

[snipped]
libxml2.so.2 => /usr/lib64/libxml2.so.2 (0x00002ba9f4cf2000)
[snipped]

My libxml2 are on /opt/libxml2.9. If I remove the link /usr/lib64/libxml2.so.2 the "correct version " of libxml appears (on /opt..)

Anyone got this "issue"

[]´s

Victor

2013/3/21 Breno Silva <breno.silva <at> gmail.com>

I think you will need to download and compile a recent version libxml2 in your CentOS, then use it to compile apache and mod_security.

Thanks

Breno

On Thu, Mar 21, 2013 at 1:03 PM, Volkov, Pavel <Pavel.Volkov <at> nuance.com> wrote:

Trying to install mod_security 2.7.2 on CentOS 5.4. I am getting error while running “configure” saying that libxml must be at least 2.6.29 and I have 2.6.26. Is there a workaround this? I am afraid if I start installing it will require other dependencies which are missing for me.

Thanks,

Pavel

------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar
_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar
_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

headers

shiftzwei@gmail.com | 22 Mar 2013 14:27

Allow cd/

Hi,

I need a little help here:
we are using core ruleset/2.2.5 and we have to allow cd/ in GET Request and in Cookies. 

--f6931400-A--
[22/Mar/2013:14:10:44 +0100] UUxYVLwoPJYAABUXH9cAAABD x.x.x.x 55107 x.x.x.x 80
--f6931400-B--
GET /produktsuche/cd/ HTTP/1.1
Host: www.xxxxxxxx.de
Origin: http://www.xxxxxxxx.de
Accept-Encoding: gzip, deflate
Accept-Language: de-de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.57.2 (KHTML, like Gecko)
Version/5.1.7 Safari/534.57.2
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://www.xxxxxxxx.de/
Dnt: 1
Cookie: session_id=df79fc36af3d36c19c60b5c4cce59302;
__utmz=182827576.1363957841.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
__utmc=182827576; __utmb=182827576.1.10.1363957841; __utma=182827576.907144049.1363957841.1363957841.1363957841.1
Connection: keep-alive

--f6931400-F--
HTTP/1.1 403 Forbidden
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 186
Keep-Alive: timeout=5, max=73
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

--f6931400-E--

--f6931400-H--
Message: Access denied with code 403 (phase 2). Pattern match
"(?:\\b(?:(?:n(?:et(?:\\b\\W+?\\blocalgroup|\\.exe)|(?:map|c)\\.exe)|t(?:racer(?:oute|t)|elnet\\.exe|clsh8?|ftp)|(?:w(?:guest|sh)|rcmd|ftp)\\.exe|echo\\b\\W*?\\by+)\\b|c(?:md(?:(?:\\.exe|32)\\b|\\b\\W*?\\/c)|d(?:\\b\\W*?[\\/]|\\W*?\\.\\.)|hmod.{0,40}?\\
..." at REQUEST_FILENAME. [file
"/etc/modsecurity/activated_rules/modsecurity_crs_40_generic_attacks.conf"] [line "197"] [id
"950006"] [rev "2.2.5"] [msg "System Command Injection"] [data "cd/"] [severity "CRITICAL"] [tag
"WEB_ATTACK/COMMAND_INJECTION"] [tag "WASCTC/WASC-31"] [tag "OWASP_TOP_10/A1"] [tag "PCI/6.5.2"]
Action: Intercepted (phase 2)
Stopwatch: 1363957844764331 2715 (- - -)
Stopwatch2: 1363957844764331 2715; combined=1175, p1=201, p2=936, p3=0, p4=0, p5=38, sr=48, sw=0,
l=0, gc=0
Response-Body-Transformed: Dechunked
Producer: ModSecurity for Apache/2.6.3 (http://www.modsecurity.org/); core ruleset/2.2.5.
Server: Apache/2.2.22

Greets,
Chris
------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar
_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

headers

Volkov, Pavel | 21 Mar 2013 18:29

Capturing username with the rules

I am using mod_security 2.6.8 with Apache 2.2.3 on CentOS 5.4. Basic authentication is setup for all requests. I would like to be able to capture username if request fails authentication, I am ab;e to catch the response status code 401 in phase 3 but I have no access to the username. In the audit log I see that the user name is getting logged in Apache-Error as part of trailer header:

--90867733-H--

Apache-Error: [file "/builddir/build/BUILD/httpd-2.2.3/modules/aaa/mod_auth_basic.c"] [line 265] [level 3] user pvolkov: authentication failure for "/escription/mypage.html": Password Mismatch

Stopwatch: 1363866444706410 1123 (- - -)

Producer: ModSecurity for Apache/2.5.10-dev2 (http://www.modsecurity.org/).

Server: Apache/2.2.3 (CentOS)

Is there a way to extract this message using rules?

Thanks,

Pavel

------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

headers

Volkov, Pavel | 21 Mar 2013 17:03

Installing mod_security 2.7.2

Trying to install mod_security 2.7.2 on CentOS 5.4. I am getting error while running “configure” saying that libxml must be at least 2.6.29 and I have 2.6.26. Is there a workaround this? I am afraid if I start installing it will require other dependencies which are missing for me.

Thanks,

Pavel

------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

headers

Ben WIlliams | 20 Mar 2013 22:31

SpiderLabs rules slow to load

After upgrading to modsecurity 2.7.2, the apache reload time has increased to over 30 seconds. It was less than 2 seconds with 2.6.8. The cause appears to be the SpiderLabs ruleset. These are the rules enabled:

slr_vuln_rules/owasp_crs_integration/attack_type/modsecurity_slr_46_lfi_attacks.conf

slr_vuln_rules/owasp_crs_integration/attack_type/modsecurity_slr_46_rfi_attacks.conf

slr_vuln_rules/owasp_crs_integration/attack_type/modsecurity_slr_46_sqli_attacks.conf

slr_vuln_rules/owasp_crs_integration/attack_type/modsecurity_slr_46_xss_attacks.conf

slr_vuln_rules/modsecurity_slr_50_malware_detection.conf

Anyone else experienced this and know how to reduce reload time?

Thanks

Ben

------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

headers

zach | 20 Mar 2013 21:18

standalone hostname in error logs

Hello,

   I got modsecurity (https://github.com/SpiderLabs/ModSecurity) 
installed and configured behind NGINX with php5-fpm, and it blocks 
malicious requests just fine.  The problem is that in the error logs, it 
outputs [hostname "standalone"] instead of the actual hostname of the 
site being hit.  Is this intentional, or a bug?

Example output:

2013/03/20 15:16:57 [error] 8161#0: [client 189.14.0.122] ModSecurity: 
Access denied with code 403 (phase 2). Pattern match

"(/\\*!?|\\*/|[';]--|--[\\s\\r\\n\\v\\f]|(?:--[^-]*?-)|([^\\-&])#.*?[\\s\\r\\n\\v\\f]|;?\\x00)" 
at REQUEST_COOKIES:slimstat_tracking_code. [file 
"/etc/nginx/conf/modsecurity.conf"] [line "1122"] [id "981231"] [rev 
"2"] [msg "SQL Comment Sequence Detected."] [data "Matched Data: 
--rgdwMr7GCwS3RrtaF5P6- found within 
REQUEST_COOKIES:slimstat_tracking_code: 
--rgdwMr7GCwS3RrtaF5P6-FGQUAsUMqX9QsDmlx1nuXBB4RND8oibj2cAnC1yRhqj-k-W8WxGt4BS20WjqJpA.."] 
[severity "CRITICAL"] [ver "OWASP_CRS/2.2.7"] [maturity "8"] [accuracy 
"8"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"] [tag "WASCTC/WASC-19"] 
[tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/CIE1"] [tag "PCI/6.5.2"] 
[hostname "standalone"] [uri "/press-feed/"] [unique_id "12345"]

# /etc/nginx/sbin/nginx -V
nginx version: nginx/1.3.14
built by gcc 4.4.5 (Debian 4.4.5-8)
TLS SNI support enabled
configure arguments: --with-http_ssl_module --with-http_realip_module 
--add-module=../ModSecurity/nginx/modsecurity 
--with-http_gzip_static_module --without-http_ssi_module 
--without-http_userid_module --without-http_auth_basic_module 
--without-http_geo_module --without-http_map_module 
--without-http_split_clients_module --without-http_uwsgi_module 
--without-http_scgi_module --without-http_memcached_module 
--without-http_empty_gif_module --without-http_browser_module 
--with-cc-opt='-fstack-protector-all -fomit-frame-pointer -Os -pipe 
-falign-functions=64 -falign-loops=32 -fforce-addr -ffast-math' 
--prefix=/etc/nginx --with-poll_module --with-select_module 
--with-file-aio --without-mail_pop3_module --without-mail_imap_module 
--without-mail_smtp_module --with-pcre

~/ModSecurity$ ./configure --enable-standalone-module

Is there something I am missing, or do I need to pass another option to 
./configure ?

Thanks!
Zach

------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar
_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

headers

Volkov, Pavel | 20 Mar 2013 21:20

not running rules in phase 1 and phase 2

Hi,

I have Basic Authentication setup for Apache. I am trying to configure rules to block user after 3 consecutive unsuccessful login. The problem for me is that rules are not executed in phase1,2 unless authentication succeeds. It looks like request is being handled by Apache before it gets to mod_security. I am using Apache 2.2.3 on CentOS 5.4, mod_security version is 2.6.8. In the debug log I don’t see any sign of why phase1 and 2 are skipped.

[20/Mar/2013:10:25:29 --0400] [10.1.82.164/sid#8977c10][rid#89874a8][/escription/mypage.html][4] Initialising transaction (txid -m-PDH8AAAEAAB33iMYAAAAA).

[20/Mar/2013:10:25:29 --0400] [10.1.82.164/sid#8977c10][rid#89874a8][/escription/mypage.html][4] Transaction context created (dcfg 8900888).

[20/Mar/2013:10:25:29 --0400] [10.1.82.164/sid#8977c10][rid#89874a8][/escription/mypage.html][4] Hook insert_error_filter: Adding output filter (r 89874a8).

[20/Mar/2013:10:25:29 --0400] [10.1.82.164/sid#8977c10][rid#89874a8][/escription/mypage.html][9] Output filter: Receiving output (f 8989398, r 89874a8).

[20/Mar/2013:10:25:29 --0400] [10.1.82.164/sid#8977c10][rid#89874a8][/escription/mypage.html][4] Starting phase RESPONSE_HEADERS.

[20/Mar/2013:10:25:29 --0400] [10.1.82.164/sid#8977c10][rid#89874a8][/escription/mypage.html][9] This phase consists of 7 rule(s).

Does anyone have any ideas?

Thanks,

Pavel

------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

headers

Michael Henry | 19 Mar 2013 18:26

Using X-Forwarded-For as the source address?

Pardon me if I missed the obvious, but I spent some time searching around, reading documentation, and even checking the mod-security-users archive and I missed it.

Is there any way to set modsecurity 2 to use X-Forwarded-For as the source address?

My servers are behind a proxy (appliance, unfortunately), so all the source IP's look the same. It's an easy fix for access logs, but I'm failing to figure it out for modsecurity.

Anyone have suggestions?

With respect,

Mike

------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

headers

Greg Wroblewski | 19 Mar 2013 08:16

Re: modsecurity causing IIS Applicaiton pool to crash

It's hard to tell without the crash dump, but I found a crash in the sample place caused by the audit log. Could you make sure that the audit log directory has proper permissions, or change its location? I will try to reproduce this problem as well.

Greg

> Date: Mon, 18 Mar 2013 11:30:14 +0800
> From: Qiushi Wang <ddtghost <at> outlook.com>
> Subject: [mod-security-users] modsecurity causing IIS Applicaiton pool
> to crash
> To: "mod-security-users <at> lists.sourceforge.net"
> <mod-security-users <at> lists.sourceforge.net>
> Message-ID: <BAY145-W1921043684A8F9717CBC0BCFE80 <at> phx.gbl>
> Content-Type: text/plain; charset="gb2312"
>
> Hi,
>
> I'm using Modsecurity 2.7.2 with Windows server 2008 R2 64bit/IIS 7.5/Mysql 5.6/PHP 5.4/Fastcgi/Wordpress. When disabling Modsecurity, everything is OK. When enabling Modsecurity, the application pool crashes. I saw you fixed a modsecurity.dll issue in 2.7.1. But now is libapr-1.dll in 2.7.2. Any idea this is a bug or my config issue? I attached web.config and modsec config files.
>
> Application error:
> Faulting application name: w3wp.exe, version: 7.5.7601.17514, time stamp: 0x4ce7afa2
> Faulting module name: libapr-1.dll, version: 1.4.6.0, time stamp: 0x502f86ed
> Exception code: 0xc0000005
> Fault offset: 0x0000000000004e21
> Faulting process id: 0xb68
> Faulting application start time: 0x01ce238423787a3e
> Faulting application path: c:\windows\system32\inetsrv\w3wp.exe
> Faulting module path: C:\Windows\system32\inetsrv\libapr-1.dll
> Report Id: 613f3441-8f77-11e2-86f6-005056b85fd5
>
> Br,
> Mark
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
> -------------- next part --------------
> A non-text attachment was scrubbed...
> Name: web.config
> Type: application/octet-stream
> Size: 363 bytes
> Desc: not available
> -------------- next part --------------
> An embedded and charset-unspecified text was scrubbed...
> Name: modsecurity.conf

------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

headers

Paul Beckett | 18 Mar 2013 17:31

mod_security behind network load-balancer

We are looking to configure 2 Apache servers running mod_security. These would act as a dedicated reverse-proxy WAF layer (proxying to other application servers). They mod_security WAF servers would be load balanced using a network load-balancer, primarily for resilience rather than capacity. We are likely to be primarily using the CRS rules (at least initially).

Is there any advice / documentation available regarding using mod_security in a load-balanced environment. In particular I'm thinking about how various collections (session tracking etc.) will be affected, by potentially only seeing half of the traffic. Is there any supported / recommended way of synchronising collections between servers?

Any thoughts, would be greatly appreciated.

Thanks,

Paul

------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

headers

Qiushi Wang | 18 Mar 2013 04:30

modsecurity causing IIS Applicaiton pool to crash

Hi,

I'm using Modsecurity 2.7.2 with Windows server 2008 R2 64bit/IIS 7.5/Mysql 5.6/PHP 5.4/Fastcgi/Wordpress. When disabling Modsecurity, everything is OK. When enabling Modsecurity, the application pool crashes. I saw you fixed a modsecurity.dll issue in 2.7.1. But now is libapr-1.dll in 2.7.2. Any idea this is a bug or my config issue? I attached web.config and modsec config files.

Application error:
Faulting application name: w3wp.exe, version: 7.5.7601.17514, time stamp: 0x4ce7afa2
Faulting module name: libapr-1.dll, version: 1.4.6.0, time stamp: 0x502f86ed
Exception code: 0xc0000005
Fault offset: 0x0000000000004e21
Faulting process id: 0xb68
Faulting application start time: 0x01ce238423787a3e
Faulting application path: c:\windows\system32\inetsrv\w3wp.exe
Faulting module path: C:\Windows\system32\inetsrv\libapr-1.dll
Report Id: 613f3441-8f77-11e2-86f6-005056b85fd5

Br,
Mark

Attachment (web.config): application/octet-stream, 363 bytes

# Only inspect dynamic requests
# (YOU MUST TEST TO MAKE SURE IT WORKS AS EXPECTED)

#On, Off, DetectionOnly
#could only use DetectionOnly for testing use
SecRuleEngine On

# Maximum request body size we will
# accept for buffering
SecRequestBodyAccess On
SecResponseBodyAccess On
SecResponseBodyMimeType "(null) text/html text/plain text/xml"
SecRequestBodyLimit 524288
# Store up to 128 KB in memory
SecRequestBodyInMemoryLimit 131072

# Reject requests with status 500
# phase:1 - in request header phase
SecDefaultAction "log,deny,phase:1,status:500"

SecUploadKeepFiles off

# Server masking is optional
#fake server banner - NOYB used - no one needs to know what we are using
SecServerSignature "Microsoft-IIS/7.5"

SecDataDir C:\inetpub\logs\modsecurity\run

# Only record the interesting stuff
SecAuditEngine RelevantOnly
SecAuditLog C:\inetpub\logs\modsecurity\audit_log.txt
SecAuditLogParts ABCFHZ
SecAuditLogRelevantStatus "^[45]"
#SecAuditLogRelevantStatus "^5"

# You normally won't need debug logging
SecDebugLogLevel 0
SecDebugLog C:\inetpub\logs\modsecurity\modsec_debug_log.txt

# Now only include sql injection rule
#Include modsecurity_crs_10_setup.conf
#Include activated_rules\*.conf

------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

106	May 2013
69	April 2013
107	March 2013
96	February 2013
96	January 2013
60	December 2012
42	November 2012
52	October 2012
62	September 2012
64	August 2012
95	July 2012
60	June 2012
39	May 2012
11	April 2012
46	March 2012
123	February 2012
80	January 2012
44	December 2011
51	November 2011
78	October 2011
108	September 2011
104	August 2011
111	July 2011
66	June 2011
185	May 2011
54	April 2011
72	March 2011
69	February 2011
76	January 2011
26	December 2010
51	November 2010
69	October 2010
79	September 2010
67	August 2010
67	July 2010
59	June 2010
88	May 2010
59	April 2010
130	March 2010
117	February 2010
99	January 2010
80	December 2009
156	November 2009
112	October 2009
73	September 2009
134	August 2009
92	July 2009
78	June 2009
132	May 2009
104	April 2009
127	March 2009
131	February 2009
137	January 2009
85	December 2008
82	November 2008
84	October 2008
154	September 2008
167	August 2008
187	July 2008
95	June 2008
115	May 2008
89	April 2008
97	March 2008
134	February 2008
159	January 2008
56	December 2007
205	November 2007
135	October 2007
97	September 2007
162	August 2007
130	July 2007
250	June 2007
191	May 2007
150	April 2007
181	March 2007
161	February 2007
166	January 2007
104	December 2006
172	November 2006
103	October 2006
83	September 2006
101	August 2006
92	July 2006
116	June 2006
65	May 2006
139	April 2006
82	March 2006
148	February 2006
61	January 2006
74	December 2005
104	November 2005
49	October 2005
28	September 2005
51	August 2005
27	July 2005
71	June 2005
26	May 2005
53	April 2005
82	March 2005
61	February 2005
67	January 2005
12	December 2004
22	November 2004
28	October 2004
31	September 2004
24	August 2004
36	July 2004
20	June 2004
15	May 2004
47	April 2004
21	March 2004
13	February 2004
44	January 2004
18	December 2003
13	November 2003
11	October 2003
9	September 2003
7	August 2003
16	July 2003
1	June 2003

Mon	Tue	Wed	Thu	Fri	Sat	Sun

		1	2	3	4	5
6	7	8	9	10	11	12
13	14	15	16	17	18	19
20	21	22	23	24	25	26
27	28	29	30	31