Disabling Mod based on a specific URI -
=20
If you do not have any rules running in phase:1, then you can use Apache
scope directives to disable Mod based on the URI location -
=20
<Location "/myscripts/script.php">
SecRuleEngine Off
</Location>
=20
If you do have phase:1 rules, then you will need to use only Mod rules -
=20
SecRule REQUEST_FILENAME "^/myscripts/script\.php$"
"phase:1,t:none,nolog,allow,ctl:ruleEngine=3DOff"
=20
Excluding the ARGS:message variable from inspection -
=20
If you want to exclude the ARGS:message variable since there are too
many false positives, you first need to figure out exactly which
rulesets are causing the FPs. I would guess that this is mostly
contained to the modsecurity_crs_40_generic_attacks.conf file. What you
will need to do is to update each rule with "!ARGS:message" variable
exclusion like this -
=20
# Session fixation
SecRule
REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:Refere
r|!ARGS:message
"(?:\.cookie\b.*?;\W*?(?:expires|domain)\W*?=3D|\bhttp-equiv\W+set-cookie=
\
b)" \
"capture,ctl:auditLogParts=3D+E,log,auditlog,msg:'Session
Fixation. Matched signature <%{TX.0}>',,id:'950009',severity:'2'"
=20
Excluding the ARGS:message variable only if it is part of the
"/myscripts/script.php" script -
=20
Combine the two previous concepts. =20
=20
<Location "/myscripts/script.php">
# Session fixation
SecRule
REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:Refere
r|!ARGS:message
"(?:\.cookie\b.*?;\W*?(?:expires|domain)\W*?=3D|\bhttp-equiv\W+set-cookie=
\
b)" \
"capture,ctl:auditLogParts=3D+E,log,auditlog,msg:'Session
Fixation. Matched signature <%{TX.0}>',,id:'950009',severity:'2'"
</Location>
=20
You could also have these new rules in separate files and then call them
up with Apache Includes -
=20
<Location "/myscripts/script.php">
Include conf/rules/custom_rules.conf
</Location>
=20
FYI - we are working on some ModSecurity enhancements that will help
with exclusions such as have SecRuleRemoveById and skipto actions.
These will help with controlling when and where to apply exceptions.
=20
Hope this helps.
=20
--=20
Ryan C. Barnett
ModSecurity Community Manager
Breach Security: Director of Training
Web Application Security Consortium (WASC) Member
CIS Apache Benchmark Project Lead
SANS Instructor, GCIA, GCFA, GCIH, GSNA, GCUX, GSEC
Author: Preventing Web Attacks with Apache
=20
=20
=20
> -----Original Message-----
> From: donnydark [mailto:donnydark@...]
> Sent: Saturday, September 01, 2007 9:37 AM
> To: Ryan Barnett
> Cc: mod-security-users@...
> Subject: Re[2]: [mod-security-users] how to except a url
>=20
> >> How exactly do you make an exception for a specific script and arg?
> >> SecRule REQUEST_FILENAME "^/myscripts/script\.php$" "nolog,allow"
> >> SecRule ARGS:message
> >[Ryan Barnett] What version of ModSecurity are you using? From your
use
> >of SecRule, I am assuming v2.x. So, is your intent to disable rule
> >processing entirely for the /myscripts/script.php file or for any
> >argument whose name is "message" or a combination of both where you
just
> >want to exclude the message parameter on that one page?
>=20
> 2.1.2
>=20
> I am interested in the solutions to all three examples you name.
>=20
> However what I intended to ask for was the third. "a combination of
> both where you just want to exclude the message parameter on that
> one page".
>=20
> Can you provide an example please?
>=20
> --
> Best regards,
> donnydark mailto:donnydark@...
=20
|