Re: [mod-security-users] Fwd: basics

[Flavio T. <fla...@li...>]

JiJo Robert escreveu:
> 
> I have
> installed mod_security with apached 2.x I have added
> the follwoing line in httpd.conf file. 
> 
> "LoadModule security_module   
> modules/mod_security/mod_security.so" to httpd.conf
> file.
> 
> How can I test with a sample application? Should the
> sample application be in Apache webapps directory?


Hi,

for Apache 2.0:

make syslink.

root@Amenhotep:/# ls -lah /etc/apache2/mods-enabled/ | grep security
lrwxrwxrwx 1 root root   45 2006-10-05 09:50 mod-security.load ->
/etc/apache2/mods-available/mod-security.load


Include on apache2.conf

root@Amenhotep:/# grep mod_security /etc/apache2/apache2.conf
# Incluindo configuracoes do mod_security
Include /etc/apache2/mod_security.conf

and get a mod_security.conf ( example )

http://pastebin.com/802571

Restart apache, check logs on /var/log/apache2/ ( tail -f
/var/log/apache2/audit_log )

So, make a test : http://URL/?a=/bin/sh and check the logs.

CheerS