Re: [mod-security-users] Modsec_audit.log contains regular 403-Errors

[Manuel S. <spa...@gm...>]

Hi Peter, this is not a modsecurity issue, check your Apache configuration
instead and grant the access to the URL

*Apache-Error*: [file "mod_authz_core.c"] [line 884] [level 3] AH01630:
*client denied by server configuration*: /var/www/html/xxx/server-info

El lun., 17 jun. 2019 a las 9:25, logo (<lo...@kr...>) escribió:

> Hi,
>
> my first time in this mailing list.
>
> I see regular 403 denied messages in the modsec_audit-Log. Is there a
> way to prevent this?
>
> --d5087f62-A--
> [17/Jun/2019:11:01:29 +0200] XQdW6W@ny6FqDbnEOUblnQAAAAQ 172.19.0.1
> 40528 172.19.0.2 443
> --d5087f62-B--
> GET /server-info HTTP/1.1
> Host: <xxx>
> Connection: keep-alive
> Upgrade-Insecure-Requests: 1
> User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
> (KHTML, like Gecko) Chrome/75.0.3770.90 Safari/537.36
> Accept:
>
> text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
> Accept-Encoding: gzip, deflate, br
> Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
>
> --d5087f62-F--
> HTTP/1.1 403 Forbidden
> Content-Length: 9
> Keep-Alive: timeout=5, max=100
> Connection: Keep-Alive
> Content-Type: text/html; charset=iso-8859-1
>
> --d5087f62-E--
>
> --d5087f62-H--
> Apache-Error: [file "mod_authz_core.c"] [line 884] [level 3] AH01630:
> client denied by server configuration: /var/www/html/xxx/server-info
> Stopwatch: 1560762089814529 28970 (- - -)
> Stopwatch2: 1560762089814529 28970; combined=1221, p1=700, p2=0, p3=137,
> p4=180, p5=204, sr=199, sw=0, l=0, gc=0
> Response-Body-Transformed: Dechunked
> Producer: ModSecurity for Apache/2.9.3 (http://www.modsecurity.org/);
> OWASP_CRS/3.1.0.
> Server: Apache
> Engine-Mode: "ENABLED"
>
> --d5087f62-Z--
>
> Apparently there is no ruleid that I could exclude.
>
> Thanks
>
> Peter
>
>
>
>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>