Re: [mod-security-users] How do I block mail attempts?

[Ivan R. <iv...@we...>]

Mark wrote:
> I have no proxy running on the web server. The exploit attempt
> was simply something I found in the mod_security log (trapped for
> other reasons). I compiled the web server to disallow relays on port 25,
> and it does. I just wanted mod_security to log attempts of such.

   That I have time to check. Try this:

   SecFilterSelective REQUEST_URI ^http:/.+:25

   (I didn't test it with a proxy compiled into Apache.)

-- 
Ivan Ristic (http://www.modsecurity.org)