Re: [mod-security-users] Modsec on Tiger?

[BassPlayer <bas...@an...>]

I run a fairly basic set of rules (i've added 3 filters) and I get a crap
load of matches. I can send you my audit_log and it would give you more
URI's than you want that would trigger a match.  I'm also using Apache
1.3.x.

BP

li...@32... wrote:
> on 2/13/06 1:28 PM, Ivan Ristic at iv...@we... wrote:
>
>> li...@32... wrote:
>>>
>>
>>> Can someone else help me write a rule that looks for the word 'goober'
>>> in
>>> the uri?
>>
>>   You should really start using the "reply to all" function in your
>>   email client - I was the only recipient of your email.
>
>
> Sorry about that, normally don't do that with other lists. :)
>
>>> Can someone else help me write a rule that looks for the word 'goober'
>>> in
>>> the uri?
>>>
>>> I just want to see if modsec is working. I can then delete that
>>> rule. Did not realize it was that big of a request. :/
>>
>>   Here is the rule: SecFilter goober
>>
>>   Please do not tell us if it worked. BTW, the ModSecurity manual is
>>   right here:
>>
>>   http://www.modsecurity.org/documentation/modsecurity-apache/stable/
>
> Ivan, Not sure why the attitude? If I did not need help figuring this out,
> then I would not bother the list. I apologize if I have offended you
> somehow. I know where the manual is, but it is not helping me figure this
> out.
>
> I looked at the debug log, but do not see anything that might be causing
> the
> filters to not work.
>
> I can send you a snippet, if you would be willing to look at it?
>
>
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through log
> files
> for problems?  Stop!  Download the new AJAX search engine that makes
> searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>
> !DSPAM:43f0d6df213311238317075!
>