The default in 2.1.6 is "deny,status:403", so that is what it is doing.
Add the "pass" action:
SecAction "pass,log,phase:1,sanitiseRequestHeader:Authorization"
-B
Mike Gallant wrote:
> I have been upgrading our setup to newer versions an ran into an
> issue with modsecurity (2.1.6). We are looking to shield the
> request_header:authorization value from the receiving cgi/php/perl
> application.
>
> The operating system is Solairs 10 (0807) 5.10 Generic_120011-14
> sun4v sparc SUNW,Sun-Fire-T200
> Apache 2.0.61
>
> I have used the standard modsecurity_apache with the core rules, no
> modifications - things work and pages are displayed.
>
> I then create the modsecurity_crs_15_customrules.conf and add one line:
> SecAction log,phase:1,sanitiseRequestHeader:Authorization
>
> Which yields a "Forbidden - You don't have permission to access on
> this server."
>
> Having a little trouble sorting out why this might be failing......
>
>
> Thanks,
> Mike
>
> I have included the apache info and the modsecurity log and debug log.
>
> Server version: Apache/2.0.61
> Server built: Dec 17 2007 11:47:04
> Server's Module Magic Number: 20020903:12
> Server loaded: APR 0.9.16, APR-UTIL 0.9.15
> Compiled using: APR 0.9.16, APR-UTIL 0.9.15
> Architecture: 32-bit
> Server compiled with....
> -D APACHE_MPM_DIR="server/mpm/worker"
> -D APR_HAS_SENDFILE
> -D APR_HAS_MMAP
> -D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)
> -D APR_USE_FCNTL_SERIALIZE
> -D APR_USE_PTHREAD_SERIALIZE
> -D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
> -D APR_HAS_OTHER_CHILD
> -D AP_HAVE_RELIABLE_PIPED_LOGS
> -D HTTPD_ROOT="/opt/slis/apache2"
> -D SUEXEC_BIN="/opt/slis/apache2/bin/suexec"
> -D DEFAULT_SCOREBOARD="logs/apache_runtime_status"
> -D DEFAULT_ERRORLOG="logs/error_log"
> -D AP_TYPES_CONFIG_FILE="/etc/opt/slis/apache2/mime.types"
> -D SERVER_CONFIG_FILE="/etc/opt/slis/apache2/httpd.conf"
> Compiled in modules:
> core.c
> mod_access.c
> mod_auth.c
> mod_include.c
> mod_deflate.c
> mod_log_config.c
> mod_env.c
> mod_unique_id.c
> mod_setenvif.c
> mod_ssl.c
> worker.c
> http_core.c
> mod_mime.c
> mod_status.c
> mod_autoindex.c
> mod_asis.c
> mod_suexec.c
> mod_cgid.c
> mod_cgi.c
> mod_negotiation.c
> mod_dir.c
> mod_imap.c
> mod_actions.c
> mod_userdir.c
> mod_alias.c
> mod_rewrite.c
> mod_so.c
>
>
>
>
> modsec_audit.log
>
> --00007490-A--
> [04/Mar/2008:14:14:56 --0500] UeU954FPJBIAACl66mYAAAAY 129.79.36.56
> 61680 129.79.36.18 443
> --00007490-B--
> GET /~gallantm/joy.php HTTP/1.1
> Accept: */*
> Accept-Language: en
> Accept-Encoding: gzip, deflate
> Cookie: __utmz=189522035.1195250097.2.1.utmccn=(direct)|utmcsr=
> (direct)|utmcmd=(none);
> __utma=189522035.32106102.1173301404.1173301404.1195250097.2
> User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/
> 418.9.1 (KHTML, like Gecko) Safari/419.3
> Authorization: **********************************************
> Connection: keep-alive
> Host: iris.slis.indiana.edu
>
> --00007490-F--
> HTTP/1.1 403 Forbidden
> Content-Length: 219
> Keep-Alive: timeout=15, max=100
> Connection: Keep-Alive
> Content-Type: text/html; charset=iso-8859-1
>
> --00007490-H--
> Message: Access denied with code 403 (phase 1). Unconditional match
> in SecAction.
> Action: Intercepted (phase 1)
> Stopwatch: 1204658096127463 3166 (- - -)
> Producer: ModSecurity v2.1.6 (Apache 2.x)
> Server: Apache
> Sanitised-Request-Headers: "Authorization".
>
> --00007490-Z--
>
> modsec_debug.log
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][4] Initialising transaction (txid
> UeU954FPJBIAACl66mYAAAAY).
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][5] Adding request cookie: name
> "__utmz", value "189522035.1195250097.2.1.utmccn=(direct)|utmcsr=
> (direct)|utmcmd=(none)"
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][5] Adding request cookie: name
> "__utma", value "189522035.32106102.1173301404.1173301404.1195250097.2"
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][4] Transaction context created (dcfg
> 129fb0).
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][4] Starting phase REQUEST_HEADERS.
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][9] This phase consists of 1 rule(s).
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][4] Recipe: Invoking rule 1a47e8.
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][9] T (0) lowercase: /~gallantm/joy.php
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][9] T (0) replaceNulls: /~gallantm/
> joy.php
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][9] T (0) compressWhitespace: /
> ~gallantm/joy.php
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][4] Executing operator
> unconditionalMatch with param "" against REQUEST_URI.
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][9] Target value: /~gallantm/joy.php
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][4] Operator completed in 1 usec.
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][4] Rule returned 1.
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][9] Match, intercepted -> returning.
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][1] Access denied with code 403
> (phase 1). Unconditional match in SecAction.
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][4] Initialising logging.
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][4] Starting phase LOGGING.
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][9] This phase consists of 4 rule(s).
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][4] Recipe: Invoking rule 1ec710.
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][4] Executing operator rx with param
> "^400$" against RESPONSE_STATUS.
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][9] Target value: 403
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][4] Operator completed in 9 usec.
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][4] Rule returned 0.
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][9] No match, chained -> mode
> NEXT_CHAIN.
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][4] Recipe: Invoking rule 1ee410.
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][4] Rule returned 0.
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][9] No match, chained -> mode
> NEXT_CHAIN.
> [04/Mar/2008:14:14:56 --0500] [iris.slis.indiana.edu/sid#fc178]
> [rid#3e2c00][/~gallantm/joy.php][4] Audit log: Logging this transaction.
>
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> mod-security-users mailing list
> mod-security-users@...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
--
Brian Rectanus
Breach Security
|