mod-security-developers

[Mod-security-developers] SLR rules don't work with 2.7.0

[Muenz, M. <m....@sp...>]

Hey Dev-Team,

just updated to 2.7.0 and got this error while running apachectl configtest:

Syntax error on line 17 of 
/etc/apache2/modsecurity/slr_rules/modsecurity_crs_46_slr_et_joomla_attacks.conf:
ModSecurity: No action id present within the rule
Action 'configtest' failed.
The Apache error log may have more information.

Rules are from the current ruleset and work with 2.6.6, no more 
information in the apache error log.

Best regards
Michael

Re: [Mod-security-developers] SLR rules don't work with 2.7.0

[Breno S. <bre...@gm...>]

Hello Michael,

This is an issue in the Core Ruleset and it is maintained by

https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project

Please submit this issue to CRS project list.

Thanks

Breno

On Wed, Oct 17, 2012 at 8:59 AM, Muenz, Michael <m....@sp...>wrote:

> Hey Dev-Team,
>
> just updated to 2.7.0 and got this error while running apachectl
> configtest:
>
> Syntax error on line 17 of
>
> /etc/apache2/modsecurity/slr_rules/modsecurity_crs_46_slr_et_joomla_attacks.conf:
> ModSecurity: No action id present within the rule
> Action 'configtest' failed.
> The Apache error log may have more information.
>
> Rules are from the current ruleset and work with 2.6.6, no more
> information in the apache error log.
>
> Best regards
> Michael
>
>
> ------------------------------------------------------------------------------
> Everyone hates slow websites. So do we.
> Make your web apps faster with AppDynamics
> Download AppDynamics Lite for free today:
> http://p.sf.net/sfu/appdyn_sfd2d_oct
> _______________________________________________
> mod-security-developers mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-developers
> ModSecurity Services from Trustwave's SpiderLabs:
> https://www.trustwave.com/spiderLabs.php
>

Re: [Mod-security-developers] SLR rules don't work with 2.7.0

[Diego E. P. <fla...@gm...>]

On 17/10/2012 06:59, Muenz, Michael wrote:
> Rules are from the current ruleset and work with 2.6.6, no more 
> information in the apache error log.

This is not limited to the SLR rules; some optional and experimental
rules have problems as well.

For reference, about around rc1 I wrote a script to validate my ruleset
(which needed, though, some extra fixes). You can find it at

https://github.com/Flameeyes/modsec-flameeyes/blob/master/verify.rb

if you want. I have tweaked it this morning to get it to run properly
over the CRS, but there might still be a few kinks that require manual
intervention, it should be fine though.

-- 
Diego Elio Pettenò — Flameeyes
fla...@fl... — http://blog.flameeyes.eu/