Re: [mod-security-users] Custom Operation

[Brian R. <Bri...@br...>]

Yaniv Negrea wrote:
> Hi Brian how are you?
> I'm trying to deploy a custom operation for mod security i saw a
> directory called API in moodsecurity source code and an example file
> which called mod_op_strstr.c
>
>
> i wrote a simple operation for testing that returns always 1 (int) for
> matching anything
> i compiled it as the README describe to do it:
> apxs2 -I /home/yaniv/modsecurity/ -I /usr/include/libxml2/ -cia
> mod_op_aly.c
>
> and inserted a new rule that use this operation into modsecurity
> configuration:
> SecRule REQUEST_HEADERS:Accept-Encoding "@aly 0"
> "t:none,deny,log,auditlog,status:501,msg:'ModSecurity hits aly!!!'"
>
> and when i restart the apache for letting modsecurity to re-compile the
> ruleset i get the next error:
> Error creating rule: Failed to resolve operator: aly
>
>
> what shall i do in order to deploy my custom operation and to make it work?

The module you built for aly is just an Apache module.  It needs to be 
installed with your other Apache modules and loaded (LoadModule) before 
mod_security2.so.

>
>
> Another question:
> i see many talking about the modsecurity console, where can i get it?
> looked in modsecurity.org <http://modsecurity.org> and breach website
> but i didn't found any link for direct download.

http://breach.com/products/modsecurity-pro-m1100.html

And there is a link in the Resources box: "ModSecurity Community 
Console".  Fill out the form and download.  Don't forget to grab the 
updated license file on the download page as well.

I am CCing the list so others can benefit from this question as well.

-B

-- 
Brian Rectanus
Breach Security