Re: [mod-security-users] [path=(null)]

[Ivan R. <iva...@gm...>]

On 4/13/06, joe barbish <joe...@ya...> wrote:
>
> In the debug log I see this.
> sec_check_access [path=3D(null)]
>
> Is this some default internal rule that gets executed?
> I there some form of this rule I can code my self to set the real path?

You should ignore that line. It just means transaction processing has
entered a certain phase.


> I have been using the apache httpd-access.log to see the raw request data=
.
> Is there some other method you would recommend?

It depends on what you want/need. The ModSecurity audit log contains
much more information.


> Is there some place I can find the maping of words like REQUEST_URI to th=
eir
> location in the  httpd_access.log logged records?

In the Apache documentation:
http://httpd.apache.org/docs/2.2/mod/mod_log_config.html


> I am interested in using    SecChrootDir /chroot/apache
> But the manual is not clear on setting it up.

So we've heard several times already :)

> Is this how I should code the rule?
>
> SecChrootDir /usr/local/www/data

You could. But in that case you'll have to change the directory root
from "/usr/local/www/data" to "/" (because that's how Apache will see
it in jail). BTW, you can only use the internal chroot feature if you
don't intend to run CGIs, send email from your scripts, etc. You won't
be able to restart Apache either (you'll have to "stop-start" it).
You'll find all this explained in the free chapter of my book:

http://www.apachesecurity.net/download/apachesecurity-ch02.pdf


> And change the path of httpd-error.log & httpd-access.log from /var/log t=
o
> /usr/local/www/data/ in the httpd.conf?

Logs can stay as they are.


> Since the logs will be in the jail how do I access the logs from outside =
the jail
> with out turning off mod_security?

The logs do not need to go in the jail. But even if they do you can
access the inside of the jail from the outside no problem.

--
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall