mod-security-users — General discussion about mod_security

[mod-security-users] Modsecurity Nginx: Audit log not being populated

[Christian V. <cv...@it...>]

Hello, I’ve conpiled a nginx and Modsecurity today, every works fine except the audit log. The audit log is not being populated, the attacks are logged only in the error log but not in the audit log.
If I change modsecurity to “DetectionOnly” the audit logs start to being populated but if I set modsecurity in “On” the audit log does not work…
This is my setup:

nginx version: 1.15.8.1
Modsecurity: branch v3/Master from GitHub

I have this lines to log the transactions:

SecRuleEngine On
SecDefaultAction "phase:1,log,auditlog,deny,status:403"
SecDefaultAction "phase:2,log,auditlog,deny,status:403"


SecAuditLogDirMode 1733
SecAuditLogFileMode 0550
SecAuditLogFormat JSON
SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4)”
SecAuditLogParts ABCHIZ
SecAuditLogType Serial
SecAuditLog /opt/waf/nginx/var/log/nnoc.vtr.cl/nnoc.vtr.cl_audit.log



Maybe I need to fix my configuration ?
Does anybody else is experimenting the same ?

Thanks in advanced.
Cheers.
Chris.

Re: [mod-security-users] FW: modsecurity pause action seems to be causing request to be dropped

[Christian F. <chr...@ne...>]

Hey Paul,

Sorry, I do not have time to look into this. But I do agree is an action that
has an unexpected behaviour. I remember this clearly from when I wrote the
book and played around with it.

I do not think a lot of people are using it. Probably for this reason.

Best,

Christian

On Fri, Feb 07, 2020 at 05:23:21PM +0000, Paul Beckett wrote:
> Alexandre Schaff very kindly replied to me directly, and set me on the right path. Things are now sort of working, but I believe the behaviour of pause is not as I'd expect.
> 
> My SecDefaultAction is pass.
> The ModSecurity Handbook v2, described the pause action as "Pause for a period of time, then execute allow". For this reason I removed the "pass" as it seemed to be being ignored.
> Although it sounds like the behaviour of pause in relation to other actions was modified back in 2013 : https://github.com/SpiderLabs/ModSecurity/issues/445 . I'd hope that this had been updated into ubuntu's libapache2-mod-security2 package.
> 
> However I think the behaviour I am seeing doesn't seem to match either the pre-2013 case, or the expected behaviour suggested by that post:
> 
>   *   pause = pause then drop
>   *   pass,pause = pause then allow
> 
> Processing of additional rules does not take place:
> 
> SecRule REQUEST_URI "@rx ^/slow/page" "id:2004,phase:2,log,msg:'***POST PAGE***',noauditlog,pass,pause:500,chain"
> SecRule REQUEST_METHOD "@rx ^POST$"
> # Add delay to rendering login page
> SecRule REQUEST_URI "@rx ^/slow/page" "id:2003,phase:2,log,msg:'***GET PAGE***',noauditlog,pass,pause:200"
> 
> ie. if it matched on rule ID:2004 then rule ID:2003 doesn't get processed.
> 
> Thanks,
> Paul
> 
> ________________________________
> From: SCHAFF Alexandre
> Sent: 07 February 2020 09:37
> To: Paul Beckett <pau...@ou...>
> Subject: Re: modsecurity pause action seems to be causing request to be dropped
> 
> Bonjour,
> 
> Issue in src code when action in SecRule 'pause' interacts with SecDefaultAction sets a disruptive action. Interaction happens when there is no disruptive action in the SecRule.
> 
> Try
> SecRule REQUEST_URI "@rx ^/slow/page" "id:2003,phase:2,pass,nolog,noauditlog,pause:371"
> 
> Alexandre.
> 
> 
> ________________________________
> From: Paul Beckett <pau...@ou...>
> Sent: Friday, February 7, 2020 8:32 AM
> To: mod...@li... <mod...@li...>
> Subject: [mod-security-users] modsecurity pause action seems to be causing request to be dropped
> 
> Yesterday this seemed to be working for me, but today this rule is seems to be causing the request to be dropped
> 
> Rule:
> SecRule REQUEST_URI "@rx ^/slow/page" "id:2003,phase:2,nolog,noauditlog,pause:371"
> 
> If I comment it out page returns, uncommented curl comes straight back with:
> * Empty reply from server
> * Connection #0 to host modsectest.local left intact
> curl: (52) Empty reply from server
> 
> This is being tested against a simple newly built test environment:
> Ubuntu 18.04.3 LTS
> Apache2 and mod-sec installed from repository
> Loading CRS3
> 
> If anyone can see an obvious explanation for this, I'd be very grateful.
> Thanks,
> Paul
> 


> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

[mod-security-users] FW: modsecurity pause action seems to be causing request to be dropped

[Paul B. <pau...@ou...>]

Alexandre Schaff very kindly replied to me directly, and set me on the right path. Things are now sort of working, but I believe the behaviour of pause is not as I'd expect.

My SecDefaultAction is pass.
The ModSecurity Handbook v2, described the pause action as "Pause for a period of time, then execute allow". For this reason I removed the "pass" as it seemed to be being ignored.
Although it sounds like the behaviour of pause in relation to other actions was modified back in 2013 : https://github.com/SpiderLabs/ModSecurity/issues/445 . I'd hope that this had been updated into ubuntu's libapache2-mod-security2 package.

However I think the behaviour I am seeing doesn't seem to match either the pre-2013 case, or the expected behaviour suggested by that post:

  *   pause = pause then drop
  *   pass,pause = pause then allow

Processing of additional rules does not take place:

SecRule REQUEST_URI "@rx ^/slow/page" "id:2004,phase:2,log,msg:'***POST PAGE***',noauditlog,pass,pause:500,chain"
SecRule REQUEST_METHOD "@rx ^POST$"
# Add delay to rendering login page
SecRule REQUEST_URI "@rx ^/slow/page" "id:2003,phase:2,log,msg:'***GET PAGE***',noauditlog,pass,pause:200"

ie. if it matched on rule ID:2004 then rule ID:2003 doesn't get processed.

Thanks,
Paul

________________________________
From: SCHAFF Alexandre
Sent: 07 February 2020 09:37
To: Paul Beckett <pau...@ou...>
Subject: Re: modsecurity pause action seems to be causing request to be dropped

Bonjour,

Issue in src code when action in SecRule 'pause' interacts with SecDefaultAction sets a disruptive action. Interaction happens when there is no disruptive action in the SecRule.

Try
SecRule REQUEST_URI "@rx ^/slow/page" "id:2003,phase:2,pass,nolog,noauditlog,pause:371"

Alexandre.


________________________________
From: Paul Beckett <pau...@ou...>
Sent: Friday, February 7, 2020 8:32 AM
To: mod...@li... <mod...@li...>
Subject: [mod-security-users] modsecurity pause action seems to be causing request to be dropped

Yesterday this seemed to be working for me, but today this rule is seems to be causing the request to be dropped

Rule:
SecRule REQUEST_URI "@rx ^/slow/page" "id:2003,phase:2,nolog,noauditlog,pause:371"

If I comment it out page returns, uncommented curl comes straight back with:
* Empty reply from server
* Connection #0 to host modsectest.local left intact
curl: (52) Empty reply from server

This is being tested against a simple newly built test environment:
Ubuntu 18.04.3 LTS
Apache2 and mod-sec installed from repository
Loading CRS3

If anyone can see an obvious explanation for this, I'd be very grateful.
Thanks,
Paul

[mod-security-users] modsecurity pause action seems to be causing request to be dropped

[Paul B. <pau...@ou...>]

Yesterday this seemed to be working for me, but today this rule is seems to be causing the request to be dropped

Rule:
SecRule REQUEST_URI "@rx ^/slow/page" "id:2003,phase:2,nolog,noauditlog,pause:371"

If I comment it out page returns, uncommented curl comes straight back with:
* Empty reply from server
* Connection #0 to host modsectest.local left intact
curl: (52) Empty reply from server

This is being tested against a simple newly built test environment:
Ubuntu 18.04.3 LTS
Apache2 and mod-sec installed from repository
Loading CRS3

If anyone can see an obvious explanation for this, I'd be very grateful.
Thanks,
Paul

Re: [mod-security-users] Delaying response

[Paul B. <pau...@ou...>]

Answering my own question (finally spotted the answer just after I'd emailed the list - sorry)....
There is a "pause" action, that should do what I want.
Thanks,
Paul
________________________________
From: Paul Beckett <pau...@ou...>
Sent: 06 February 2020 16:35
To: mod...@li... <mod...@li...>
Subject: [mod-security-users] Delaying response

I have a use case where in response to a SecRule match I would like to be able to introduce a delay (eg. 250ms) before sending out the response. I had a vague feeling that I'd previously read of a way to do this with mod-security, but despite searching I can't find it..... and beginning to wonder if that was just a figment of my imagination. Any help / advice on how I could do this would be gratefully received.

Thanks in advance,
Paul

[mod-security-users] Delaying response

[Paul B. <pau...@ou...>]

I have a use case where in response to a SecRule match I would like to be able to introduce a delay (eg. 250ms) before sending out the response. I had a vague feeling that I'd previously read of a way to do this with mod-security, but despite searching I can't find it..... and beginning to wonder if that was just a figment of my imagination. Any help / advice on how I could do this would be gratefully received.

Thanks in advance,
Paul

[mod-security-users] CRS

[Vieri Di P. <vie...@gm...>]

Hi again,

Never mind the first part of my previous post.
I found this web page: https://coreruleset.org/installation/

Vieri

[mod-security-users] CRS

[Vieri Di P. <vie...@gm...>]

Hi,

I'm new to modsecurity so what I say here might not be fully correct.

According to:

https://raw.githubusercontent.com/SpiderLabs/owasp-modsecurity-crs/v3.0/master/INSTALL

"There are currently no known packages of CRS 3.x."

However, I'm using Gentoo Linux with a 3.x package:

https://packages.gentoo.org/packages/www-apache/modsecurity-crs

The Gentoo Linux package manager downloads from:

https://github.com/SpiderLabs/owasp-${PN}/archive/v${PV}.tar.gz

Where
PN=modsecurity-crs
PV=3.1.0 (in my case)

Are there more recent archives?

I'd rather use my package manager instead of making a custom script to
update the CRS from GIT.

Also, the same INSTALL file suggests to test the installation by
making a request to a specific URL.

I tried this:
curl 'http://myapacheserver/?param="><script>alert(1);</script>'

However, it doesn't seem to trigger any rule. The apache server
actually replies normally with a web page, and there are no errors in
the log.
I have mod_security 2.9.3.

What can I try?

Vieri

Re: [mod-security-users] ModSecurity was not compiled with JSON support

[Dino E. <din...@my...>]

  *   Install  libyajl2 package also.


  *   Anyway. I don't think that is installed that path. remove prefix from configure parameter.

Hi Eero,

It’s already installed:

apt install libyajl2
Reading package lists... Done
Building dependency tree
Reading state information... Done
libyajl2 is already the newest version (2.1.0-2build1).
0 upgraded, 0 newly installed, 0 to remove and 2 not upgraded.

Removing the prefix:

./configure
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /bin/mkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking for g++... g++
checking whether the C++ compiler works... yes
checking for C++ compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C++ compiler... yes
checking whether g++ accepts -g... yes
checking for style of include used by make... GNU
checking dependency style of g++... gcc3
checking for gcc... gcc
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking whether gcc understands -c and -o together... yes
checking dependency style of gcc... gcc3
checking for ar... ar
checking the archiver (ar) interface... ar
checking whether make sets $(MAKE)... (cached) yes
checking for pkg-config... /usr/bin/pkg-config
checking pkg-config is at least version 0.9.0... yes
configure: Nothing about GeoIP was informed during the configure phase. Trying to detect it on the platform...
configure: using YAJL v2.1.1
configure: Nothing about GeoIP was informed during the configure phase. Trying to detect it on the platform...
configure: using GeoIP v1.6.12
configure: Nothing about MaxMind was informed during the configure phase. Trying to detect it on the platform...
configure: using MaxMind v1.3.1
configure: Nothing about LMDB was informed during the configure phase. Trying to detect it on the platform...
configure: LMDB is disabled by default.
*** LOOKING AT PATH:  /usr/lib
*** LOOKING AT PATH:  /usr/local/lib
*** LOOKING AT PATH:  /usr/local/fuzzy
*** LOOKING AT PATH:  /usr/local/libfuzzy
*** LOOKING AT PATH:  /usr/local
*** LOOKING AT PATH:  /opt
*** LOOKING AT PATH:  /usr
*** LOOKING AT PATH:  /usr/lib64
*** LOOKING AT PATH:  /opt/local
configure: SSDEEP library was not found
*** LOOKING AT PATH:  /usr/lib
*** LOOKING AT PATH:  /usr/local/lib
*** LOOKING AT PATH:  /usr/local/lib64
*** LOOKING AT PATH:  /usr/local/lua
*** LOOKING AT PATH:  /usr/local/liblua
*** LOOKING AT PATH:  /usr/local
*** LOOKING AT PATH:  /opt
*** LOOKING AT PATH:  /usr
*** LOOKING AT PATH:  /usr/lib64
*** LOOKING AT PATH:  /opt/local
configure: LUA library was not found
checking for libcurl config script... /usr/bin/curl-config
configure: curl VERSION: 7.58.0
configure: curl LDADD:
checking if libcurl is at least v... yes, 7.58.0
checking if libcurl is linked with gnutls... no
configure: using curl v7.58.0
checking for libxml2 config script... /usr/bin/xml2-config
configure: xml VERSION: 2.9.4
configure: xml CFLAGS: -I/usr/include/libxml2 -DWITH_LIBXML2
configure: xml LDADD: -lxml2
checking if libxml2 is at least v2.6.29... yes, 2.9.4
configure: using libxml2 v2.9.4
checking for libpcre config script... /usr/bin/pcre-config
configure: pcre VERSION: 8.39
configure: pcre LDADD: -lpcre
configure: pcre PCRE_LD_PATH: /-lpcre
checking for PCRE JIT... yes
configure: using pcre v8.39
checking how to run the C preprocessor... gcc -E
checking for grep that handles long lines and -e... /bin/grep
checking for egrep... /bin/grep -E
checking for ANSI C header files... yes
checking for sys/types.h... yes
checking for sys/stat.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for memory.h... yes
checking for strings.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for unistd.h... yes
checking string usability... no
checking string presence... no
checking for string... no
checking iostream usability... no
checking iostream presence... no
checking for iostream... no
checking sys/utsname.h usability... yes
checking sys/utsname.h presence... yes
checking for sys/utsname.h... yes
checking build system type... x86_64-pc-linux-gnu
checking host system type... x86_64-pc-linux-gnu
checking how to print strings... printf
checking for a sed that does not truncate output... /bin/sed
checking for fgrep... /bin/grep -F
checking for ld used by gcc... /usr/bin/ld
checking if the linker (/usr/bin/ld) is GNU ld... yes
checking for BSD- or MS-compatible name lister (nm)... /usr/bin/nm -B
checking the name lister (/usr/bin/nm -B) interface... BSD nm
checking whether ln -s works... yes
checking the maximum length of command line arguments... 1572864
checking how to convert x86_64-pc-linux-gnu file names to x86_64-pc-linux-gnu format... func_convert_file_noop
checking how to convert x86_64-pc-linux-gnu file names to toolchain format... func_convert_file_noop
checking for /usr/bin/ld option to reload object files... -r
checking for objdump... objdump
checking how to recognize dependent libraries... pass_all
checking for dlltool... no
checking how to associate runtime and link libraries... printf %s\n
checking for archiver @FILE support... @
checking for strip... strip
checking for ranlib... ranlib
checking command to parse /usr/bin/nm -B output from gcc object... ok
checking for sysroot... no
checking for a working dd... /bin/dd
checking how to truncate binary pipes... /bin/dd bs=4096 count=1
checking for mt... mt
checking if mt is a manifest tool... no
checking for dlfcn.h... yes
checking for objdir... .libs
checking if gcc supports -fno-rtti -fno-exceptions... no
checking for gcc option to produce PIC... -fPIC -DPIC
checking if gcc PIC flag -fPIC -DPIC works... yes
checking if gcc static flag -static works... yes
checking if gcc supports -c -o file.o... yes
checking if gcc supports -c -o file.o... (cached) yes
checking whether the gcc linker (/usr/bin/ld -m elf_x86_64) supports shared libraries... yes
checking whether -lc should be explicitly linked in... no
checking dynamic linker characteristics... GNU/Linux ld.so
checking how to hardcode library paths into programs... immediate
checking for shl_load... no
checking for shl_load in -ldld... no
checking for dlopen... no
checking for dlopen in -ldl... yes
checking whether a program can dlopen itself... yes
checking whether a statically linked program can dlopen itself... no
checking whether stripping libraries is possible... yes
checking if libtool supports shared libraries... yes
checking whether to build shared libraries... yes
checking whether to build static libraries... yes
checking how to run the C++ preprocessor... g++ -E
checking for ld used by g++... /usr/bin/ld -m elf_x86_64
checking if the linker (/usr/bin/ld -m elf_x86_64) is GNU ld... yes
checking whether the g++ linker (/usr/bin/ld -m elf_x86_64) supports shared libraries... yes
checking for g++ option to produce PIC... -fPIC -DPIC
checking if g++ PIC flag -fPIC -DPIC works... yes
checking if g++ static flag -static works... yes
checking if g++ supports -c -o file.o... yes
checking if g++ supports -c -o file.o... (cached) yes
checking whether the g++ linker (/usr/bin/ld -m elf_x86_64) supports shared libraries... yes
checking dynamic linker characteristics... (cached) GNU/Linux ld.so
checking how to hardcode library paths into programs... immediate
Checking platform... Identified as Linux
checking for doxygen... no
configure: WARNING: doxygen not found - will not generate any doxygen documentation
checking for perl... /usr/bin/perl
checking for valgrind... no
checking that generated files are newer than configure... done
configure: creating ./config.status
config.status: creating modsecurity.pc
config.status: creating Makefile
config.status: creating doc/Makefile
config.status: creating src/Makefile
config.status: creating others/Makefile
config.status: creating tools/Makefile
config.status: creating tools/rules-check/Makefile
config.status: creating test/Makefile
config.status: creating test/benchmark/Makefile
config.status: creating examples/Makefile
config.status: creating examples/simple_example_using_c/Makefile
config.status: creating examples/multiprocess_c/Makefile
config.status: creating examples/reading_logs_with_offset/Makefile
config.status: creating examples/reading_logs_via_rule_message/Makefile
config.status: creating examples/using_bodies_in_chunks/Makefile
config.status: creating src/config.h
config.status: src/config.h is unchanged
config.status: executing depfiles commands
config.status: executing libtool commands


ModSecurity - v3.0.3-114-g6624a18a for Linux

Mandatory dependencies
   + libInjection                                  ....v3.9.2-30-gbf234eb
   + SecLang tests                                 ....c8cf2c5

Optional dependencies
   + GeoIP/MaxMind                                 ....found
      * (MaxMind) v1.3.1
         -lmaxminddb  , -DWITH_MAXMIND -I/usr/include/x86_64-linux-gnu
      * (GeoIP) v1.6.12
         -lGeoIP  , -I/usr/include/
   + LibCURL                                       ....found v7.58.0
      -lcurl,  -DWITH_CURL_SSLVERSION_TLSv1_2 -DWITH_CURL
   + YAJL                                          ....found v2.1.1
      -lyajl  , -DWITH_YAJL -I/usr/local/include/yajl
   + LMDB                                          ....disabled
   + LibXML2                                       ....found v2.9.4
      -lxml2, -I/usr/include/libxml2 -DWITH_LIBXML2
   + SSDEEP                                        ....not found
   + LUA                                           ....not found

Other Options
   + Test Utilities                                ....enabled
   + SecDebugLog                                   ....enabled
   + afl fuzzer                                    ....disabled
   + library examples                              ....enabled
   + Building parser                               ....disabled
   + Treating pm operations as critical section    ....disabled

However, it doesn’t compile YAJL support:

ldd /usr/local/modsecurity/lib/libmodsecurity.so.3.0.3
        linux-vdso.so.1 (0x00007ffd189ca000)
        libcurl.so.4 => /usr/lib/x86_64-linux-gnu/libcurl.so.4 (0x00007f73e57d5000)
        libGeoIP.so.1 => /usr/lib/x86_64-linux-gnu/libGeoIP.so.1 (0x00007f73e55a1000)
        librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007f73e5399000)
        libxml2.so.2 => /usr/lib/x86_64-linux-gnu/libxml2.so.2 (0x00007f73e4fd8000)
        libpcre.so.3 => /lib/x86_64-linux-gnu/libpcre.so.3 (0x00007f73e4d66000)
        libmaxminddb.so.0 => /usr/lib/x86_64-linux-gnu/libmaxminddb.so.0 (0x00007f73e4b60000)
        libstdc++.so.6 => /usr/lib/x86_64-linux-gnu/libstdc++.so.6 (0x00007f73e47d7000)
        libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f73e4439000)
        libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f73e4048000)
        /lib64/ld-linux-x86-64.so.2 (0x00007f73e5e88000)
        libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007f73e3e30000)
        libnghttp2.so.14 => /usr/lib/x86_64-linux-gnu/libnghttp2.so.14 (0x00007f73e3c0b000)
        libidn2.so.0 => /usr/lib/x86_64-linux-gnu/libidn2.so.0 (0x00007f73e39ee000)
        librtmp.so.1 => /usr/lib/x86_64-linux-gnu/librtmp.so.1 (0x00007f73e37d2000)
        libpsl.so.5 => /usr/lib/x86_64-linux-gnu/libpsl.so.5 (0x00007f73e35c4000)
        libssl.so.1.1 => /usr/lib/x86_64-linux-gnu/libssl.so.1.1 (0x00007f73e3337000)
       libcrypto.so.1.1 => /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 (0x00007f73e2e6c000)
        libgssapi_krb5.so.2 => /usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2 (0x00007f73e2c21000)
        libldap_r-2.4.so.2 => /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2 (0x00007f73e29cf000)
        liblber-2.4.so.2 => /usr/lib/x86_64-linux-gnu/liblber-2.4.so.2 (0x00007f73e27c1000)
        libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007f73e25a4000)
        libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f73e2385000)
        libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f73e2181000)
        libicuuc.so.60 => /usr/lib/x86_64-linux-gnu/libicuuc.so.60 (0x00007f73e1dca000)
        liblzma.so.5 => /lib/x86_64-linux-gnu/liblzma.so.5 (0x00007f73e1ba4000)
        libunistring.so.2 => /usr/lib/x86_64-linux-gnu/libunistring.so.2 (0x00007f73e1826000)
        libgnutls.so.30 => /usr/lib/x86_64-linux-gnu/libgnutls.so.30 (0x00007f73e14c1000)
        libhogweed.so.4 => /usr/lib/x86_64-linux-gnu/libhogweed.so.4 (0x00007f73e128d000)
        libnettle.so.6 => /usr/lib/x86_64-linux-gnu/libnettle.so.6 (0x00007f73e1057000)
        libgmp.so.10 => /usr/lib/x86_64-linux-gnu/libgmp.so.10 (0x00007f73e0dd6000)
        libkrb5.so.3 => /usr/lib/x86_64-linux-gnu/libkrb5.so.3 (0x00007f73e0b00000)
        libk5crypto.so.3 => /usr/lib/x86_64-linux-gnu/libk5crypto.so.3 (0x00007f73e08ce000)
        libcom_err.so.2 => /lib/x86_64-linux-gnu/libcom_err.so.2 (0x00007f73e06ca000)
        libkrb5support.so.0 => /usr/lib/x86_64-linux-gnu/libkrb5support.so.0 (0x00007f73e04bf000)
        libresolv.so.2 => /lib/x86_64-linux-gnu/libresolv.so.2 (0x00007f73e02a4000)
        libsasl2.so.2 => /usr/lib/x86_64-linux-gnu/libsasl2.so.2 (0x00007f73e0089000)
        libgssapi.so.3 => /usr/lib/x86_64-linux-gnu/libgssapi.so.3 (0x00007f73dfe48000)
        libicudata.so.60 => /usr/lib/x86_64-linux-gnu/libicudata.so.60 (0x00007f73de29f000)
        libp11-kit.so.0 => /usr/lib/x86_64-linux-gnu/libp11-kit.so.0 (0x00007f73ddf70000)
        libtasn1.so.6 => /usr/lib/x86_64-linux-gnu/libtasn1.so.6 (0x00007f73ddd5d000)
        libkeyutils.so.1 => /lib/x86_64-linux-gnu/libkeyutils.so.1 (0x00007f73ddb59000)
        libheimntlm.so.0 => /usr/lib/x86_64-linux-gnu/libheimntlm.so.0 (0x00007f73dd950000)
        libkrb5.so.26 => /usr/lib/x86_64-linux-gnu/libkrb5.so.26 (0x00007f73dd6c3000)
        libasn1.so.8 => /usr/lib/x86_64-linux-gnu/libasn1.so.8 (0x00007f73dd421000)
        libhcrypto.so.4 => /usr/lib/x86_64-linux-gnu/libhcrypto.so.4 (0x00007f73dd1eb000)
        libroken.so.18 => /usr/lib/x86_64-linux-gnu/libroken.so.18 (0x00007f73dcfd5000)
        libffi.so.6 => /usr/lib/x86_64-linux-gnu/libffi.so.6 (0x00007f73dcdcd000)
        libwind.so.0 => /usr/lib/x86_64-linux-gnu/libwind.so.0 (0x00007f73dcba4000)
        libheimbase.so.1 => /usr/lib/x86_64-linux-gnu/libheimbase.so.1 (0x00007f73dc995000)
        libhx509.so.5 => /usr/lib/x86_64-linux-gnu/libhx509.so.5 (0x00007f73dc74b000)
        libsqlite3.so.0 => /usr/lib/x86_64-linux-gnu/libsqlite3.so.0 (0x00007f73dc442000)
        libcrypt.so.1 => /lib/x86_64-linux-gnu/libcrypt.so.1 (0x00007f73dc20a000)

Re: [mod-security-users] ModSecurity was not compiled with JSON support

[Eero V. <eer...@ik...>]

Install  libyajl2 package also.

Anyway. I don't think that is installed that path. remove prefix from
configure parameter.

Eero

On Mon, Jan 20, 2020 at 3:41 PM Dino Edwards via mod-security-users <
mod...@li...> wrote:

> The think that’s strange to me is the fact that it finds YAJL library at
> /usr/local/lib/libyajl.so but the next message says that YAJL was
> explicitly referenced but it was not found:
>
>
>
> configure: YAJL library found at: /usr/local/lib//libyajl.so
> configure: error: YAJL was explicitly referenced but it was not found
>
>
>
> *From:* Eero Volotinen <eer...@ik...>
> *Sent:* Monday, January 20, 2020 7:22 AM
> *To:* mod...@li...
> *Subject:* Re: [mod-security-users] ModSecurity was not compiled with
> JSON support
>
>
>
> I think that package name is  libyajl-dev in ubuntu and location is
> standard, not /usr/local.
>
>
>
> Eero
>
>
>
> On Mon, Jan 20, 2020 at 2:20 PM Felipe Zimmerle <fe...@zi...>
> wrote:
>
> Hi Dino,
>
> libyajl-dev was installed on "/usr/local" or "/usr" ?
>
> You may want to use github instead of the mailing list -- it seems
> that we have more popularity there.
>
> Br.,
> F.
>
>
> On Mon, Jan 20, 2020 at 7:45 AM Dino Edwards via mod-security-users
> <mod...@li...> wrote:
> >
> > Hi,
> >
> >
> >
> > I’m getting the following error in my security audit log:
> >
> >
> >
> > "error":"ModSecurity was not compiled with JSON support.
> >
> >
> >
> > I’m using Ubuntu 18.04 and Modsecurity 3.0.3. I’ve installed the
> libyajl-dev library. When trying to compile Modsecurity I get the following
> output:
> >
> >
> >
> > ./configure --with-yajl="/usr/local/lib"
> >
> > checking for a BSD-compatible install... /usr/bin/install -c
> >
> > checking whether build environment is sane... yes
> >
> > checking for a thread-safe mkdir -p... /bin/mkdir -p
> >
> > checking for gawk... gawk
> >
> > checking whether make sets $(MAKE)... yes
> >
> > checking whether make supports nested variables... yes
> >
> > checking for g++... g++
> >
> > checking whether the C++ compiler works... yes
> >
> > checking for C++ compiler default output file name... a.out
> >
> > checking for suffix of executables...
> >
> > checking whether we are cross compiling... no
> >
> > checking for suffix of object files... o
> >
> > checking whether we are using the GNU C++ compiler... yes
> >
> > checking whether g++ accepts -g... yes
> >
> > checking for style of include used by make... GNU
> >
> > checking dependency style of g++... gcc3
> >
> > checking for gcc... gcc
> >
> > checking whether we are using the GNU C compiler... yes
> >
> > checking whether gcc accepts -g... yes
> >
> > checking for gcc option to accept ISO C89... none needed
> >
> > checking whether gcc understands -c and -o together... yes
> >
> > checking dependency style of gcc... gcc3
> >
> > checking for ar... ar
> >
> > checking the archiver (ar) interface... ar
> >
> > checking whether make sets $(MAKE)... (cached) yes
> >
> > checking for pkg-config... /usr/bin/pkg-config
> >
> > checking pkg-config is at least version 0.9.0... yes
> >
> > configure: YAJL library found at: /usr/local/lib//libyajl.so
> >
> > configure: error: YAJL was explicitly referenced but it was not found
> >
> > root@aegis-waf-ovh:/opt/ModSecurity# ./configure
> --with-yajl="/usr/local/lib /usr/local"
> >
> > checking for a BSD-compatible install... /usr/bin/install -c
> >
> > checking whether build environment is sane... yes
> >
> > checking for a thread-safe mkdir -p... /bin/mkdir -p
> >
> > checking for gawk... gawk
> >
> > checking whether make sets $(MAKE)... yes
> >
> > checking whether make supports nested variables... yes
> >
> > checking for g++... g++
> >
> > checking whether the C++ compiler works... yes
> >
> > checking for C++ compiler default output file name... a.out
> >
> > checking for suffix of executables...
> >
> > checking whether we are cross compiling... no
> >
> > checking for suffix of object files... o
> >
> > checking whether we are using the GNU C++ compiler... yes
> >
> > checking whether g++ accepts -g... yes
> >
> > checking for style of include used by make... GNU
> >
> > checking dependency style of g++... gcc3
> >
> > checking for gcc... gcc
> >
> > checking whether we are using the GNU C compiler... yes
> >
> > checking whether gcc accepts -g... yes
> >
> > checking for gcc option to accept ISO C89... none needed
> >
> > checking whether gcc understands -c and -o together... yes
> >
> > checking dependency style of gcc... gcc3
> >
> > checking for ar... ar
> >
> > checking the archiver (ar) interface... ar
> >
> > checking whether make sets $(MAKE)... (cached) yes
> >
> > checking for pkg-config... /usr/bin/pkg-config
> >
> > checking pkg-config is at least version 0.9.0... yes
> >
> > configure: error: YAJL was explicitly referenced but it was not found
> >
> > root@aegis-waf-ovh:/opt/ModSecurity# ./configure
> --with-yajl="/usr/local/lib"
> >
> > checking for a BSD-compatible install... /usr/bin/install -c
> >
> > checking whether build environment is sane... yes
> >
> > checking for a thread-safe mkdir -p... /bin/mkdir -p
> >
> > checking for gawk... gawk
> >
> > checking whether make sets $(MAKE)... yes
> >
> > checking whether make supports nested variables... yes
> >
> > checking for g++... g++
> >
> > checking whether the C++ compiler works... yes
> >
> > checking for C++ compiler default output file name... a.out
> >
> > checking for suffix of executables...
> >
> > checking whether we are cross compiling... no
> >
> > checking for suffix of object files... o
> >
> > checking whether we are using the GNU C++ compiler... yes
> >
> > checking whether g++ accepts -g... yes
> >
> > checking for style of include used by make... GNU
> >
> > checking dependency style of g++... gcc3
> >
> > checking for gcc... gcc
> >
> > checking whether we are using the GNU C compiler... yes
> >
> > checking whether gcc accepts -g... yes
> >
> > checking for gcc option to accept ISO C89... none needed
> >
> > checking whether gcc understands -c and -o together... yes
> >
> > checking dependency style of gcc... gcc3
> >
> > checking for ar... ar
> >
> > checking the archiver (ar) interface... ar
> >
> > checking whether make sets $(MAKE)... (cached) yes
> >
> > checking for pkg-config... /usr/bin/pkg-config
> >
> > checking pkg-config is at least version 0.9.0... yes
> >
> > configure: YAJL library found at: /usr/local/lib//libyajl.so
> >
> > configure: error: YAJL was explicitly referenced but it was not found
> >
> >
> >
> > I would appreciate some help
> >
> >
> >
> > Thanks!
> >
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
>
>
>
> --
> Br.,
> Felipe Zimmerle
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Re: [mod-security-users] ModSecurity was not compiled with JSON support

[Dino E. <din...@my...>]

The think that’s strange to me is the fact that it finds YAJL library at /usr/local/lib/libyajl.so but the next message says that YAJL was explicitly referenced but it was not found:

configure: YAJL library found at: /usr/local/lib//libyajl.so
configure: error: YAJL was explicitly referenced but it was not found


From: Eero Volotinen <eer...@ik...>
Sent: Monday, January 20, 2020 7:22 AM
To: mod...@li...
Subject: Re: [mod-security-users] ModSecurity was not compiled with JSON support

I think that package name is  libyajl-dev in ubuntu and location is standard, not /usr/local.

Eero

On Mon, Jan 20, 2020 at 2:20 PM Felipe Zimmerle <fe...@zi...<mailto:fe...@zi...>> wrote:
Hi Dino,

libyajl-dev was installed on "/usr/local" or "/usr" ?

You may want to use github instead of the mailing list -- it seems
that we have more popularity there.

Br.,
F.


On Mon, Jan 20, 2020 at 7:45 AM Dino Edwards via mod-security-users
<mod...@li...<mailto:mod...@li...>> wrote:
>
> Hi,
>
>
>
> I’m getting the following error in my security audit log:
>
>
>
> "error":"ModSecurity was not compiled with JSON support.
>
>
>
> I’m using Ubuntu 18.04 and Modsecurity 3.0.3. I’ve installed the libyajl-dev library. When trying to compile Modsecurity I get the following output:
>
>
>
> ./configure --with-yajl="/usr/local/lib"
>
> checking for a BSD-compatible install... /usr/bin/install -c
>
> checking whether build environment is sane... yes
>
> checking for a thread-safe mkdir -p... /bin/mkdir -p
>
> checking for gawk... gawk
>
> checking whether make sets $(MAKE)... yes
>
> checking whether make supports nested variables... yes
>
> checking for g++... g++
>
> checking whether the C++ compiler works... yes
>
> checking for C++ compiler default output file name... a.out
>
> checking for suffix of executables...
>
> checking whether we are cross compiling... no
>
> checking for suffix of object files... o
>
> checking whether we are using the GNU C++ compiler... yes
>
> checking whether g++ accepts -g... yes
>
> checking for style of include used by make... GNU
>
> checking dependency style of g++... gcc3
>
> checking for gcc... gcc
>
> checking whether we are using the GNU C compiler... yes
>
> checking whether gcc accepts -g... yes
>
> checking for gcc option to accept ISO C89... none needed
>
> checking whether gcc understands -c and -o together... yes
>
> checking dependency style of gcc... gcc3
>
> checking for ar... ar
>
> checking the archiver (ar) interface... ar
>
> checking whether make sets $(MAKE)... (cached) yes
>
> checking for pkg-config... /usr/bin/pkg-config
>
> checking pkg-config is at least version 0.9.0... yes
>
> configure: YAJL library found at: /usr/local/lib//libyajl.so
>
> configure: error: YAJL was explicitly referenced but it was not found
>
> root@aegis-waf-ovh:/opt/ModSecurity# ./configure --with-yajl="/usr/local/lib /usr/local"
>
> checking for a BSD-compatible install... /usr/bin/install -c
>
> checking whether build environment is sane... yes
>
> checking for a thread-safe mkdir -p... /bin/mkdir -p
>
> checking for gawk... gawk
>
> checking whether make sets $(MAKE)... yes
>
> checking whether make supports nested variables... yes
>
> checking for g++... g++
>
> checking whether the C++ compiler works... yes
>
> checking for C++ compiler default output file name... a.out
>
> checking for suffix of executables...
>
> checking whether we are cross compiling... no
>
> checking for suffix of object files... o
>
> checking whether we are using the GNU C++ compiler... yes
>
> checking whether g++ accepts -g... yes
>
> checking for style of include used by make... GNU
>
> checking dependency style of g++... gcc3
>
> checking for gcc... gcc
>
> checking whether we are using the GNU C compiler... yes
>
> checking whether gcc accepts -g... yes
>
> checking for gcc option to accept ISO C89... none needed
>
> checking whether gcc understands -c and -o together... yes
>
> checking dependency style of gcc... gcc3
>
> checking for ar... ar
>
> checking the archiver (ar) interface... ar
>
> checking whether make sets $(MAKE)... (cached) yes
>
> checking for pkg-config... /usr/bin/pkg-config
>
> checking pkg-config is at least version 0.9.0... yes
>
> configure: error: YAJL was explicitly referenced but it was not found
>
> root@aegis-waf-ovh:/opt/ModSecurity# ./configure --with-yajl="/usr/local/lib"
>
> checking for a BSD-compatible install... /usr/bin/install -c
>
> checking whether build environment is sane... yes
>
> checking for a thread-safe mkdir -p... /bin/mkdir -p
>
> checking for gawk... gawk
>
> checking whether make sets $(MAKE)... yes
>
> checking whether make supports nested variables... yes
>
> checking for g++... g++
>
> checking whether the C++ compiler works... yes
>
> checking for C++ compiler default output file name... a.out
>
> checking for suffix of executables...
>
> checking whether we are cross compiling... no
>
> checking for suffix of object files... o
>
> checking whether we are using the GNU C++ compiler... yes
>
> checking whether g++ accepts -g... yes
>
> checking for style of include used by make... GNU
>
> checking dependency style of g++... gcc3
>
> checking for gcc... gcc
>
> checking whether we are using the GNU C compiler... yes
>
> checking whether gcc accepts -g... yes
>
> checking for gcc option to accept ISO C89... none needed
>
> checking whether gcc understands -c and -o together... yes
>
> checking dependency style of gcc... gcc3
>
> checking for ar... ar
>
> checking the archiver (ar) interface... ar
>
> checking whether make sets $(MAKE)... (cached) yes
>
> checking for pkg-config... /usr/bin/pkg-config
>
> checking pkg-config is at least version 0.9.0... yes
>
> configure: YAJL library found at: /usr/local/lib//libyajl.so
>
> configure: error: YAJL was explicitly referenced but it was not found
>
>
>
> I would appreciate some help
>
>
>
> Thanks!
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...<mailto:mod...@li...>
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/



--
Br.,
Felipe Zimmerle


_______________________________________________
mod-security-users mailing list
mod...@li...<mailto:mod...@li...>
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] ModSecurity was not compiled with JSON support

[Dino E. <din...@my...>]

  *   Hi I had the sam issue on Centos.


  *   Fix it with:

  *   yum install yajl-devel


I’m using Ubuntu and I installed with: apt install libyajl-dev

Re: [mod-security-users] ModSecurity was not compiled with JSON support

[Dino E. <din...@my...>]

> You may want to use github instead of the mailing list -- it seems that we have more popularity there.

I will go ahead and post on github as per your suggestion. Thanks a lot

Re: [mod-security-users] ModSecurity was not compiled with JSON support

[Eero V. <eer...@ik...>]

I think that package name is  libyajl-dev in ubuntu and location is
standard, not /usr/local.

Eero

On Mon, Jan 20, 2020 at 2:20 PM Felipe Zimmerle <fe...@zi...> wrote:

> Hi Dino,
>
> libyajl-dev was installed on "/usr/local" or "/usr" ?
>
> You may want to use github instead of the mailing list -- it seems
> that we have more popularity there.
>
> Br.,
> F.
>
>
> On Mon, Jan 20, 2020 at 7:45 AM Dino Edwards via mod-security-users
> <mod...@li...> wrote:
> >
> > Hi,
> >
> >
> >
> > I’m getting the following error in my security audit log:
> >
> >
> >
> > "error":"ModSecurity was not compiled with JSON support.
> >
> >
> >
> > I’m using Ubuntu 18.04 and Modsecurity 3.0.3. I’ve installed the
> libyajl-dev library. When trying to compile Modsecurity I get the following
> output:
> >
> >
> >
> > ./configure --with-yajl="/usr/local/lib"
> >
> > checking for a BSD-compatible install... /usr/bin/install -c
> >
> > checking whether build environment is sane... yes
> >
> > checking for a thread-safe mkdir -p... /bin/mkdir -p
> >
> > checking for gawk... gawk
> >
> > checking whether make sets $(MAKE)... yes
> >
> > checking whether make supports nested variables... yes
> >
> > checking for g++... g++
> >
> > checking whether the C++ compiler works... yes
> >
> > checking for C++ compiler default output file name... a.out
> >
> > checking for suffix of executables...
> >
> > checking whether we are cross compiling... no
> >
> > checking for suffix of object files... o
> >
> > checking whether we are using the GNU C++ compiler... yes
> >
> > checking whether g++ accepts -g... yes
> >
> > checking for style of include used by make... GNU
> >
> > checking dependency style of g++... gcc3
> >
> > checking for gcc... gcc
> >
> > checking whether we are using the GNU C compiler... yes
> >
> > checking whether gcc accepts -g... yes
> >
> > checking for gcc option to accept ISO C89... none needed
> >
> > checking whether gcc understands -c and -o together... yes
> >
> > checking dependency style of gcc... gcc3
> >
> > checking for ar... ar
> >
> > checking the archiver (ar) interface... ar
> >
> > checking whether make sets $(MAKE)... (cached) yes
> >
> > checking for pkg-config... /usr/bin/pkg-config
> >
> > checking pkg-config is at least version 0.9.0... yes
> >
> > configure: YAJL library found at: /usr/local/lib//libyajl.so
> >
> > configure: error: YAJL was explicitly referenced but it was not found
> >
> > root@aegis-waf-ovh:/opt/ModSecurity# ./configure
> --with-yajl="/usr/local/lib /usr/local"
> >
> > checking for a BSD-compatible install... /usr/bin/install -c
> >
> > checking whether build environment is sane... yes
> >
> > checking for a thread-safe mkdir -p... /bin/mkdir -p
> >
> > checking for gawk... gawk
> >
> > checking whether make sets $(MAKE)... yes
> >
> > checking whether make supports nested variables... yes
> >
> > checking for g++... g++
> >
> > checking whether the C++ compiler works... yes
> >
> > checking for C++ compiler default output file name... a.out
> >
> > checking for suffix of executables...
> >
> > checking whether we are cross compiling... no
> >
> > checking for suffix of object files... o
> >
> > checking whether we are using the GNU C++ compiler... yes
> >
> > checking whether g++ accepts -g... yes
> >
> > checking for style of include used by make... GNU
> >
> > checking dependency style of g++... gcc3
> >
> > checking for gcc... gcc
> >
> > checking whether we are using the GNU C compiler... yes
> >
> > checking whether gcc accepts -g... yes
> >
> > checking for gcc option to accept ISO C89... none needed
> >
> > checking whether gcc understands -c and -o together... yes
> >
> > checking dependency style of gcc... gcc3
> >
> > checking for ar... ar
> >
> > checking the archiver (ar) interface... ar
> >
> > checking whether make sets $(MAKE)... (cached) yes
> >
> > checking for pkg-config... /usr/bin/pkg-config
> >
> > checking pkg-config is at least version 0.9.0... yes
> >
> > configure: error: YAJL was explicitly referenced but it was not found
> >
> > root@aegis-waf-ovh:/opt/ModSecurity# ./configure
> --with-yajl="/usr/local/lib"
> >
> > checking for a BSD-compatible install... /usr/bin/install -c
> >
> > checking whether build environment is sane... yes
> >
> > checking for a thread-safe mkdir -p... /bin/mkdir -p
> >
> > checking for gawk... gawk
> >
> > checking whether make sets $(MAKE)... yes
> >
> > checking whether make supports nested variables... yes
> >
> > checking for g++... g++
> >
> > checking whether the C++ compiler works... yes
> >
> > checking for C++ compiler default output file name... a.out
> >
> > checking for suffix of executables...
> >
> > checking whether we are cross compiling... no
> >
> > checking for suffix of object files... o
> >
> > checking whether we are using the GNU C++ compiler... yes
> >
> > checking whether g++ accepts -g... yes
> >
> > checking for style of include used by make... GNU
> >
> > checking dependency style of g++... gcc3
> >
> > checking for gcc... gcc
> >
> > checking whether we are using the GNU C compiler... yes
> >
> > checking whether gcc accepts -g... yes
> >
> > checking for gcc option to accept ISO C89... none needed
> >
> > checking whether gcc understands -c and -o together... yes
> >
> > checking dependency style of gcc... gcc3
> >
> > checking for ar... ar
> >
> > checking the archiver (ar) interface... ar
> >
> > checking whether make sets $(MAKE)... (cached) yes
> >
> > checking for pkg-config... /usr/bin/pkg-config
> >
> > checking pkg-config is at least version 0.9.0... yes
> >
> > configure: YAJL library found at: /usr/local/lib//libyajl.so
> >
> > configure: error: YAJL was explicitly referenced but it was not found
> >
> >
> >
> > I would appreciate some help
> >
> >
> >
> > Thanks!
> >
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
>
>
>
> --
> Br.,
> Felipe Zimmerle
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Re: [mod-security-users] ModSecurity was not compiled with JSON support

[Felipe Z. <fe...@zi...>]

Hi Dino,

libyajl-dev was installed on "/usr/local" or "/usr" ?

You may want to use github instead of the mailing list -- it seems
that we have more popularity there.

Br.,
F.


On Mon, Jan 20, 2020 at 7:45 AM Dino Edwards via mod-security-users
<mod...@li...> wrote:
>
> Hi,
>
>
>
> I’m getting the following error in my security audit log:
>
>
>
> "error":"ModSecurity was not compiled with JSON support.
>
>
>
> I’m using Ubuntu 18.04 and Modsecurity 3.0.3. I’ve installed the libyajl-dev library. When trying to compile Modsecurity I get the following output:
>
>
>
> ./configure --with-yajl="/usr/local/lib"
>
> checking for a BSD-compatible install... /usr/bin/install -c
>
> checking whether build environment is sane... yes
>
> checking for a thread-safe mkdir -p... /bin/mkdir -p
>
> checking for gawk... gawk
>
> checking whether make sets $(MAKE)... yes
>
> checking whether make supports nested variables... yes
>
> checking for g++... g++
>
> checking whether the C++ compiler works... yes
>
> checking for C++ compiler default output file name... a.out
>
> checking for suffix of executables...
>
> checking whether we are cross compiling... no
>
> checking for suffix of object files... o
>
> checking whether we are using the GNU C++ compiler... yes
>
> checking whether g++ accepts -g... yes
>
> checking for style of include used by make... GNU
>
> checking dependency style of g++... gcc3
>
> checking for gcc... gcc
>
> checking whether we are using the GNU C compiler... yes
>
> checking whether gcc accepts -g... yes
>
> checking for gcc option to accept ISO C89... none needed
>
> checking whether gcc understands -c and -o together... yes
>
> checking dependency style of gcc... gcc3
>
> checking for ar... ar
>
> checking the archiver (ar) interface... ar
>
> checking whether make sets $(MAKE)... (cached) yes
>
> checking for pkg-config... /usr/bin/pkg-config
>
> checking pkg-config is at least version 0.9.0... yes
>
> configure: YAJL library found at: /usr/local/lib//libyajl.so
>
> configure: error: YAJL was explicitly referenced but it was not found
>
> root@aegis-waf-ovh:/opt/ModSecurity# ./configure --with-yajl="/usr/local/lib /usr/local"
>
> checking for a BSD-compatible install... /usr/bin/install -c
>
> checking whether build environment is sane... yes
>
> checking for a thread-safe mkdir -p... /bin/mkdir -p
>
> checking for gawk... gawk
>
> checking whether make sets $(MAKE)... yes
>
> checking whether make supports nested variables... yes
>
> checking for g++... g++
>
> checking whether the C++ compiler works... yes
>
> checking for C++ compiler default output file name... a.out
>
> checking for suffix of executables...
>
> checking whether we are cross compiling... no
>
> checking for suffix of object files... o
>
> checking whether we are using the GNU C++ compiler... yes
>
> checking whether g++ accepts -g... yes
>
> checking for style of include used by make... GNU
>
> checking dependency style of g++... gcc3
>
> checking for gcc... gcc
>
> checking whether we are using the GNU C compiler... yes
>
> checking whether gcc accepts -g... yes
>
> checking for gcc option to accept ISO C89... none needed
>
> checking whether gcc understands -c and -o together... yes
>
> checking dependency style of gcc... gcc3
>
> checking for ar... ar
>
> checking the archiver (ar) interface... ar
>
> checking whether make sets $(MAKE)... (cached) yes
>
> checking for pkg-config... /usr/bin/pkg-config
>
> checking pkg-config is at least version 0.9.0... yes
>
> configure: error: YAJL was explicitly referenced but it was not found
>
> root@aegis-waf-ovh:/opt/ModSecurity# ./configure --with-yajl="/usr/local/lib"
>
> checking for a BSD-compatible install... /usr/bin/install -c
>
> checking whether build environment is sane... yes
>
> checking for a thread-safe mkdir -p... /bin/mkdir -p
>
> checking for gawk... gawk
>
> checking whether make sets $(MAKE)... yes
>
> checking whether make supports nested variables... yes
>
> checking for g++... g++
>
> checking whether the C++ compiler works... yes
>
> checking for C++ compiler default output file name... a.out
>
> checking for suffix of executables...
>
> checking whether we are cross compiling... no
>
> checking for suffix of object files... o
>
> checking whether we are using the GNU C++ compiler... yes
>
> checking whether g++ accepts -g... yes
>
> checking for style of include used by make... GNU
>
> checking dependency style of g++... gcc3
>
> checking for gcc... gcc
>
> checking whether we are using the GNU C compiler... yes
>
> checking whether gcc accepts -g... yes
>
> checking for gcc option to accept ISO C89... none needed
>
> checking whether gcc understands -c and -o together... yes
>
> checking dependency style of gcc... gcc3
>
> checking for ar... ar
>
> checking the archiver (ar) interface... ar
>
> checking whether make sets $(MAKE)... (cached) yes
>
> checking for pkg-config... /usr/bin/pkg-config
>
> checking pkg-config is at least version 0.9.0... yes
>
> configure: YAJL library found at: /usr/local/lib//libyajl.so
>
> configure: error: YAJL was explicitly referenced but it was not found
>
>
>
> I would appreciate some help
>
>
>
> Thanks!
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/



-- 
Br.,
Felipe Zimmerle

Re: [mod-security-users] ModSecurity was not compiled with JSON support

[Boris K. <bor...@gm...>]

Hi I had the sam issue on Centos.

Fix it with:
yum install yajl-devel



On Mon, Jan 20, 2020 at 11:47 AM Dino Edwards via mod-security-users <
mod...@li...> wrote:

> Hi,
>
>
>
> I’m getting the following error in my security audit log:
>
>
>
> "error":"ModSecurity was not compiled with JSON support.
>
>
>
> I’m using Ubuntu 18.04 and Modsecurity 3.0.3. I’ve installed the
> libyajl-dev library. When trying to compile Modsecurity I get the following
> output:
>
>
>
> ./configure --with-yajl="/usr/local/lib"
>
> checking for a BSD-compatible install... /usr/bin/install -c
>
> checking whether build environment is sane... yes
>
> checking for a thread-safe mkdir -p... /bin/mkdir -p
>
> checking for gawk... gawk
>
> checking whether make sets $(MAKE)... yes
>
> checking whether make supports nested variables... yes
>
> checking for g++... g++
>
> checking whether the C++ compiler works... yes
>
> checking for C++ compiler default output file name... a.out
>
> checking for suffix of executables...
>
> checking whether we are cross compiling... no
>
> checking for suffix of object files... o
>
> checking whether we are using the GNU C++ compiler... yes
>
> checking whether g++ accepts -g... yes
>
> checking for style of include used by make... GNU
>
> checking dependency style of g++... gcc3
>
> checking for gcc... gcc
>
> checking whether we are using the GNU C compiler... yes
>
> checking whether gcc accepts -g... yes
>
> checking for gcc option to accept ISO C89... none needed
>
> checking whether gcc understands -c and -o together... yes
>
> checking dependency style of gcc... gcc3
>
> checking for ar... ar
>
> checking the archiver (ar) interface... ar
>
> checking whether make sets $(MAKE)... (cached) yes
>
> checking for pkg-config... /usr/bin/pkg-config
>
> checking pkg-config is at least version 0.9.0... yes
>
> configure: YAJL library found at: /usr/local/lib//libyajl.so
>
> configure: error: YAJL was explicitly referenced but it was not found
>
> root@aegis-waf-ovh:/opt/ModSecurity# ./configure
> --with-yajl="/usr/local/lib /usr/local"
>
> checking for a BSD-compatible install... /usr/bin/install -c
>
> checking whether build environment is sane... yes
>
> checking for a thread-safe mkdir -p... /bin/mkdir -p
>
> checking for gawk... gawk
>
> checking whether make sets $(MAKE)... yes
>
> checking whether make supports nested variables... yes
>
> checking for g++... g++
>
> checking whether the C++ compiler works... yes
>
> checking for C++ compiler default output file name... a.out
>
> checking for suffix of executables...
>
> checking whether we are cross compiling... no
>
> checking for suffix of object files... o
>
> checking whether we are using the GNU C++ compiler... yes
>
> checking whether g++ accepts -g... yes
>
> checking for style of include used by make... GNU
>
> checking dependency style of g++... gcc3
>
> checking for gcc... gcc
>
> checking whether we are using the GNU C compiler... yes
>
> checking whether gcc accepts -g... yes
>
> checking for gcc option to accept ISO C89... none needed
>
> checking whether gcc understands -c and -o together... yes
>
> checking dependency style of gcc... gcc3
>
> checking for ar... ar
>
> checking the archiver (ar) interface... ar
>
> checking whether make sets $(MAKE)... (cached) yes
>
> checking for pkg-config... /usr/bin/pkg-config
>
> checking pkg-config is at least version 0.9.0... yes
>
> configure: error: YAJL was explicitly referenced but it was not found
>
> root@aegis-waf-ovh:/opt/ModSecurity# ./configure
> --with-yajl="/usr/local/lib"
>
> checking for a BSD-compatible install... /usr/bin/install -c
>
> checking whether build environment is sane... yes
>
> checking for a thread-safe mkdir -p... /bin/mkdir -p
>
> checking for gawk... gawk
>
> checking whether make sets $(MAKE)... yes
>
> checking whether make supports nested variables... yes
>
> checking for g++... g++
>
> checking whether the C++ compiler works... yes
>
> checking for C++ compiler default output file name... a.out
>
> checking for suffix of executables...
>
> checking whether we are cross compiling... no
>
> checking for suffix of object files... o
>
> checking whether we are using the GNU C++ compiler... yes
>
> checking whether g++ accepts -g... yes
>
> checking for style of include used by make... GNU
>
> checking dependency style of g++... gcc3
>
> checking for gcc... gcc
>
> checking whether we are using the GNU C compiler... yes
>
> checking whether gcc accepts -g... yes
>
> checking for gcc option to accept ISO C89... none needed
>
> checking whether gcc understands -c and -o together... yes
>
> checking dependency style of gcc... gcc3
>
> checking for ar... ar
>
> checking the archiver (ar) interface... ar
>
> checking whether make sets $(MAKE)... (cached) yes
>
> checking for pkg-config... /usr/bin/pkg-config
>
> checking pkg-config is at least version 0.9.0... yes
>
> configure: YAJL library found at: /usr/local/lib//libyajl.so
>
> configure: error: YAJL was explicitly referenced but it was not found
>
>
>
> I would appreciate some help
>
>
>
> Thanks!
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

[mod-security-users] ModSecurity was not compiled with JSON support

[Dino E. <din...@my...>]

Hi,

I'm getting the following error in my security audit log:

"error":"ModSecurity was not compiled with JSON support.

I'm using Ubuntu 18.04 and Modsecurity 3.0.3. I've installed the libyajl-dev library. When trying to compile Modsecurity I get the following output:

./configure --with-yajl="/usr/local/lib"
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /bin/mkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking for g++... g++
checking whether the C++ compiler works... yes
checking for C++ compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C++ compiler... yes
checking whether g++ accepts -g... yes
checking for style of include used by make... GNU
checking dependency style of g++... gcc3
checking for gcc... gcc
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking whether gcc understands -c and -o together... yes
checking dependency style of gcc... gcc3
checking for ar... ar
checking the archiver (ar) interface... ar
checking whether make sets $(MAKE)... (cached) yes
checking for pkg-config... /usr/bin/pkg-config
checking pkg-config is at least version 0.9.0... yes
configure: YAJL library found at: /usr/local/lib//libyajl.so
configure: error: YAJL was explicitly referenced but it was not found
root@aegis-waf-ovh:/opt/ModSecurity# ./configure --with-yajl="/usr/local/lib /usr/local"
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /bin/mkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking for g++... g++
checking whether the C++ compiler works... yes
checking for C++ compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C++ compiler... yes
checking whether g++ accepts -g... yes
checking for style of include used by make... GNU
checking dependency style of g++... gcc3
checking for gcc... gcc
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking whether gcc understands -c and -o together... yes
checking dependency style of gcc... gcc3
checking for ar... ar
checking the archiver (ar) interface... ar
checking whether make sets $(MAKE)... (cached) yes
checking for pkg-config... /usr/bin/pkg-config
checking pkg-config is at least version 0.9.0... yes
configure: error: YAJL was explicitly referenced but it was not found
root@aegis-waf-ovh:/opt/ModSecurity# ./configure --with-yajl="/usr/local/lib"
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /bin/mkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking for g++... g++
checking whether the C++ compiler works... yes
checking for C++ compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C++ compiler... yes
checking whether g++ accepts -g... yes
checking for style of include used by make... GNU
checking dependency style of g++... gcc3
checking for gcc... gcc
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking whether gcc understands -c and -o together... yes
checking dependency style of gcc... gcc3
checking for ar... ar
checking the archiver (ar) interface... ar
checking whether make sets $(MAKE)... (cached) yes
checking for pkg-config... /usr/bin/pkg-config
checking pkg-config is at least version 0.9.0... yes
configure: YAJL library found at: /usr/local/lib//libyajl.so
configure: error: YAJL was explicitly referenced but it was not found

I would appreciate some help

Thanks!

Re: [mod-security-users] Need help in understanding Regex for CMD injection rule

[homesh j. <ho...@gm...>]

Hi Christian,

Thanks for your reply.
I wanted to understand the regex.
can you please help me with that?
I wanted to know which part of the regex is making ";" mandatory *at the
end*. as I tested by putting ";" at the beginning then also rule is not
getting triggered.
http://www.example.com/;ls <http://www.example.com/ls>

Thanks,
Homesh

On Fri, Jan 17, 2020 at 12:31 PM Christian Folini <
chr...@ne...> wrote:

> Hello Homesh,
>
> The regex looks like Atomicorp rule 340029. Making the semicolon mandatory
> was a decision by the person writing the rule. Maybe done in order to avoid
> some false positives. Have you tried asking Atomicorp / gotRoot support?
>
> Best,
>
> Christian
>
> On Fri, Jan 17, 2020 at 12:12:11PM +0530, homesh joshi wrote:
> > Hi All,
> >
> > I am referring to below Rule
> >
> > SecRule
> >
> REQUEST_URI|ARGS|!ARGS:fileContent|!ARGS:/_edit_/|!ARGS:/details/|!ARGS:/block_value/|!ARGS:/News/|!ARGS:/products_/|!ARGS:/article/|!ARGS:/template/|!ARGS:editor1|!ARGS:prefix|!ARGS:suffix|!ARGS:/info/|!ARGS:payment_extrainfo|!ARGS:file|!ARGS:thecode|!ARGS:/chat/|!ARGS:snippet|!ARGS:/phpcode/|!ARGS:intro|!ARGS:/title/|!ARGS:/data_parent/|!ARGS:code|!ARGS:lajmi|!ARGS:/content/|!ARGS:/desc/|!ARGS:/hilit/|!ARGS:/hilight/|!ARGS:/highlight/|!ARGS:/body/|!ARGS:/post/|!ARGS:/txt|!ARGS:/content/|!ARGS:/keyword/|!ARGS:/summary/|!ARGS:/note/|!ARGS:/solution/|!ARGS:/msg/|!ARGS:/highlight/|!ARGS:/text/|!ARGS:/subject/|!ARGS:/message/|!ARGS:/post/|!ARGS:/resolution/|!ARGS:/problem/
> > "(?:;|/|\|
> >
> )(?:\b(?:cat|ls|perl|uname|pwd|cp|tclsh8?|cpp|f(?:etch|tp)|python|chown|rm|ping|rsync|rdiff-backup|scp|wget|curl|links|g\+\+|ch(?:grp|own)|passwd|r?(?:b|d)ash|t?c?sh|telnet|clang|nc)\b
> > |\b(?:sleep|benchmark)\b \(? ?[0-9]|powershell -w|\bkill(?:
> > (?:[0-9]|-)|all\ ))" \
> >
> >
> "log,auditlog,phase:2,deny,log,status:403,capture,id:5001,t:none,t:utf8toUnicode,t:urlDecodeUni,t:replaceNulls,t:cmdLine,rev:32,severity:2,msg:'Others',tag:'Attack
> > Blocked - command in REQUEST_URI or Argument',logdata:'%{TX.0}'"
> >
> > Rule is getting trigger for following URL
> >
> > http://www.example.com/ls;
> >
> > And rule is not getting triggered for following URL
> >
> > http://www.example.com/ls
> >
> > looking at following regex  from rule on regex101.com I don' t
> understand
> > why at the end ";" is required to trigger the rule.
> > (?:;|/|\|
> >
> )(?:\b(?:cat|ls|perl|uname|pwd|cp|tclsh8?|cpp|f(?:etch|tp)|python|chown|rm|ping|rsync|rdiff-backup|scp|wget|curl|links|g\+\+|ch(?:grp|own)|passwd|r?(?:b|d)ash|t?c?sh|telnet|clang|nc)\b
> > |\b(?:sleep|benchmark)\b \(? ?[0-9]|powershell -w|\bkill(?:
> > (?:[0-9]|-)|all\ ))" \
> >
> > Thanks,
> > Homesh
>
>
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Re: [mod-security-users] Need help in understanding Regex for CMD injection rule

[Christian F. <chr...@ne...>]

Hello Homesh,

The regex looks like Atomicorp rule 340029. Making the semicolon mandatory
was a decision by the person writing the rule. Maybe done in order to avoid
some false positives. Have you tried asking Atomicorp / gotRoot support?

Best,

Christian

On Fri, Jan 17, 2020 at 12:12:11PM +0530, homesh joshi wrote:
> Hi All,
> 
> I am referring to below Rule
> 
> SecRule
> REQUEST_URI|ARGS|!ARGS:fileContent|!ARGS:/_edit_/|!ARGS:/details/|!ARGS:/block_value/|!ARGS:/News/|!ARGS:/products_/|!ARGS:/article/|!ARGS:/template/|!ARGS:editor1|!ARGS:prefix|!ARGS:suffix|!ARGS:/info/|!ARGS:payment_extrainfo|!ARGS:file|!ARGS:thecode|!ARGS:/chat/|!ARGS:snippet|!ARGS:/phpcode/|!ARGS:intro|!ARGS:/title/|!ARGS:/data_parent/|!ARGS:code|!ARGS:lajmi|!ARGS:/content/|!ARGS:/desc/|!ARGS:/hilit/|!ARGS:/hilight/|!ARGS:/highlight/|!ARGS:/body/|!ARGS:/post/|!ARGS:/txt|!ARGS:/content/|!ARGS:/keyword/|!ARGS:/summary/|!ARGS:/note/|!ARGS:/solution/|!ARGS:/msg/|!ARGS:/highlight/|!ARGS:/text/|!ARGS:/subject/|!ARGS:/message/|!ARGS:/post/|!ARGS:/resolution/|!ARGS:/problem/
> "(?:;|/|\|
> )(?:\b(?:cat|ls|perl|uname|pwd|cp|tclsh8?|cpp|f(?:etch|tp)|python|chown|rm|ping|rsync|rdiff-backup|scp|wget|curl|links|g\+\+|ch(?:grp|own)|passwd|r?(?:b|d)ash|t?c?sh|telnet|clang|nc)\b
> |\b(?:sleep|benchmark)\b \(? ?[0-9]|powershell -w|\bkill(?:
> (?:[0-9]|-)|all\ ))" \
> 
> "log,auditlog,phase:2,deny,log,status:403,capture,id:5001,t:none,t:utf8toUnicode,t:urlDecodeUni,t:replaceNulls,t:cmdLine,rev:32,severity:2,msg:'Others',tag:'Attack
> Blocked - command in REQUEST_URI or Argument',logdata:'%{TX.0}'"
> 
> Rule is getting trigger for following URL
> 
> http://www.example.com/ls;
> 
> And rule is not getting triggered for following URL
> 
> http://www.example.com/ls
> 
> looking at following regex  from rule on regex101.com I don' t understand
> why at the end ";" is required to trigger the rule.
> (?:;|/|\|
> )(?:\b(?:cat|ls|perl|uname|pwd|cp|tclsh8?|cpp|f(?:etch|tp)|python|chown|rm|ping|rsync|rdiff-backup|scp|wget|curl|links|g\+\+|ch(?:grp|own)|passwd|r?(?:b|d)ash|t?c?sh|telnet|clang|nc)\b
> |\b(?:sleep|benchmark)\b \(? ?[0-9]|powershell -w|\bkill(?:
> (?:[0-9]|-)|all\ ))" \
> 
> Thanks,
> Homesh


> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

[mod-security-users] Need help in understanding Regex for CMD injection rule

[homesh j. <ho...@gm...>]

Hi All,

I am referring to below Rule

SecRule
REQUEST_URI|ARGS|!ARGS:fileContent|!ARGS:/_edit_/|!ARGS:/details/|!ARGS:/block_value/|!ARGS:/News/|!ARGS:/products_/|!ARGS:/article/|!ARGS:/template/|!ARGS:editor1|!ARGS:prefix|!ARGS:suffix|!ARGS:/info/|!ARGS:payment_extrainfo|!ARGS:file|!ARGS:thecode|!ARGS:/chat/|!ARGS:snippet|!ARGS:/phpcode/|!ARGS:intro|!ARGS:/title/|!ARGS:/data_parent/|!ARGS:code|!ARGS:lajmi|!ARGS:/content/|!ARGS:/desc/|!ARGS:/hilit/|!ARGS:/hilight/|!ARGS:/highlight/|!ARGS:/body/|!ARGS:/post/|!ARGS:/txt|!ARGS:/content/|!ARGS:/keyword/|!ARGS:/summary/|!ARGS:/note/|!ARGS:/solution/|!ARGS:/msg/|!ARGS:/highlight/|!ARGS:/text/|!ARGS:/subject/|!ARGS:/message/|!ARGS:/post/|!ARGS:/resolution/|!ARGS:/problem/
"(?:;|/|\|
)(?:\b(?:cat|ls|perl|uname|pwd|cp|tclsh8?|cpp|f(?:etch|tp)|python|chown|rm|ping|rsync|rdiff-backup|scp|wget|curl|links|g\+\+|ch(?:grp|own)|passwd|r?(?:b|d)ash|t?c?sh|telnet|clang|nc)\b
|\b(?:sleep|benchmark)\b \(? ?[0-9]|powershell -w|\bkill(?:
(?:[0-9]|-)|all\ ))" \

"log,auditlog,phase:2,deny,log,status:403,capture,id:5001,t:none,t:utf8toUnicode,t:urlDecodeUni,t:replaceNulls,t:cmdLine,rev:32,severity:2,msg:'Others',tag:'Attack
Blocked - command in REQUEST_URI or Argument',logdata:'%{TX.0}'"

Rule is getting trigger for following URL

http://www.example.com/ls;

And rule is not getting triggered for following URL

http://www.example.com/ls

looking at following regex  from rule on regex101.com I don' t understand
why at the end ";" is required to trigger the rule.
(?:;|/|\|
)(?:\b(?:cat|ls|perl|uname|pwd|cp|tclsh8?|cpp|f(?:etch|tp)|python|chown|rm|ping|rsync|rdiff-backup|scp|wget|curl|links|g\+\+|ch(?:grp|own)|passwd|r?(?:b|d)ash|t?c?sh|telnet|clang|nc)\b
|\b(?:sleep|benchmark)\b \(? ?[0-9]|powershell -w|\bkill(?:
(?:[0-9]|-)|all\ ))" \

Thanks,
Homesh

Re: [mod-security-users] Upgrading to v3.0.4

[Christian F. <chr...@ne...>]

None. Just stay where you are and observe the development.

On Wed, Jan 15, 2020 at 06:54:15AM -0500, Monah Baki wrote:
> Hi Christian
> 
> What platform/changes you recommend?
> 
> Monah
> 
> On Wed, Jan 15, 2020 at 6:37 AM Christian Folini <
> chr...@ne...> wrote:
> 
> > Hey Monah,
> >
> > The developers of ModSecurity consider libModSecurity 3.0.x as stable and
> > production ready for use with NGINX. The connector module that links the
> > engine with Apache is not deemed stable though. And I can confirm that.
> >
> > The OWASP ModSecurity Core Rule Set project considers ModSecurity 2.9.x on
> > Apache as the reference platform and continues to do so until several
> > problems with ModSec3 have been sorted out. One of them is that ModSec3
> > is not passing the CRS test suite. It's fairly close with ModSec3 + NGINX,
> > but
> > there are quite a few open issues with ModSec3 + Apache.
> >
> > So for the time being, it's best to stay with ModSecurity 2.9 in your
> > situation.
> >
> > I would also advise against a platform change for an existing Apache/ModSec
> > setup.
> >
> > Hope this helps.
> >
> > Cheers,
> >
> > Christian
> >
> >
> > On Wed, Jan 15, 2020 at 06:28:11AM -0500, Monah Baki wrote:
> > > Hi Christian,
> > >
> > > Apache :)
> > >
> > > On Wed, Jan 15, 2020 at 12:06 AM Christian Folini <
> > > chr...@ne...> wrote:
> > >
> > > > Hey Monah,
> > > >
> > > > What platform are you working on?
> > > >
> > > > ModSec3 on Apache is not production ready.
> > > >
> > > > Cheers,
> > > >
> > > > Christian
> > > >
> > > > On Tue, Jan 14, 2020 at 08:31:07PM -0500, Monah Baki wrote:
> > > > > Hi all,
> > > > >
> > > > > Any good documents as to how to upgrade from 2.9.3 on Centos7
> > > > >
> > > > > Thanks
> > > > > Monah
> > > >
> > > >
> > > > > _______________________________________________
> > > > > mod-security-users mailing list
> > > > > mod...@li...
> > > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > > > http://www.modsecurity.org/projects/commercial/rules/
> > > > > http://www.modsecurity.org/projects/commercial/support/
> > > >
> > > >
> > > >
> > > > _______________________________________________
> > > > mod-security-users mailing list
> > > > mod...@li...
> > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > > http://www.modsecurity.org/projects/commercial/rules/
> > > > http://www.modsecurity.org/projects/commercial/support/
> > > >
> >
> >
> > > _______________________________________________
> > > mod-security-users mailing list
> > > mod...@li...
> > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > http://www.modsecurity.org/projects/commercial/rules/
> > > http://www.modsecurity.org/projects/commercial/support/
> >
> >
> >
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
> >


> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] Upgrading to v3.0.4

[Monah B. <mon...@gm...>]

Hi Christian

What platform/changes you recommend?

Monah

On Wed, Jan 15, 2020 at 6:37 AM Christian Folini <
chr...@ne...> wrote:

> Hey Monah,
>
> The developers of ModSecurity consider libModSecurity 3.0.x as stable and
> production ready for use with NGINX. The connector module that links the
> engine with Apache is not deemed stable though. And I can confirm that.
>
> The OWASP ModSecurity Core Rule Set project considers ModSecurity 2.9.x on
> Apache as the reference platform and continues to do so until several
> problems with ModSec3 have been sorted out. One of them is that ModSec3
> is not passing the CRS test suite. It's fairly close with ModSec3 + NGINX,
> but
> there are quite a few open issues with ModSec3 + Apache.
>
> So for the time being, it's best to stay with ModSecurity 2.9 in your
> situation.
>
> I would also advise against a platform change for an existing Apache/ModSec
> setup.
>
> Hope this helps.
>
> Cheers,
>
> Christian
>
>
> On Wed, Jan 15, 2020 at 06:28:11AM -0500, Monah Baki wrote:
> > Hi Christian,
> >
> > Apache :)
> >
> > On Wed, Jan 15, 2020 at 12:06 AM Christian Folini <
> > chr...@ne...> wrote:
> >
> > > Hey Monah,
> > >
> > > What platform are you working on?
> > >
> > > ModSec3 on Apache is not production ready.
> > >
> > > Cheers,
> > >
> > > Christian
> > >
> > > On Tue, Jan 14, 2020 at 08:31:07PM -0500, Monah Baki wrote:
> > > > Hi all,
> > > >
> > > > Any good documents as to how to upgrade from 2.9.3 on Centos7
> > > >
> > > > Thanks
> > > > Monah
> > >
> > >
> > > > _______________________________________________
> > > > mod-security-users mailing list
> > > > mod...@li...
> > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > > http://www.modsecurity.org/projects/commercial/rules/
> > > > http://www.modsecurity.org/projects/commercial/support/
> > >
> > >
> > >
> > > _______________________________________________
> > > mod-security-users mailing list
> > > mod...@li...
> > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > http://www.modsecurity.org/projects/commercial/rules/
> > > http://www.modsecurity.org/projects/commercial/support/
> > >
>
>
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Re: [mod-security-users] Upgrading to v3.0.4

[Christian F. <chr...@ne...>]

Hey Monah,

The developers of ModSecurity consider libModSecurity 3.0.x as stable and
production ready for use with NGINX. The connector module that links the
engine with Apache is not deemed stable though. And I can confirm that.

The OWASP ModSecurity Core Rule Set project considers ModSecurity 2.9.x on
Apache as the reference platform and continues to do so until several
problems with ModSec3 have been sorted out. One of them is that ModSec3
is not passing the CRS test suite. It's fairly close with ModSec3 + NGINX, but
there are quite a few open issues with ModSec3 + Apache.

So for the time being, it's best to stay with ModSecurity 2.9 in your
situation.

I would also advise against a platform change for an existing Apache/ModSec
setup.

Hope this helps.

Cheers,

Christian


On Wed, Jan 15, 2020 at 06:28:11AM -0500, Monah Baki wrote:
> Hi Christian,
> 
> Apache :)
> 
> On Wed, Jan 15, 2020 at 12:06 AM Christian Folini <
> chr...@ne...> wrote:
> 
> > Hey Monah,
> >
> > What platform are you working on?
> >
> > ModSec3 on Apache is not production ready.
> >
> > Cheers,
> >
> > Christian
> >
> > On Tue, Jan 14, 2020 at 08:31:07PM -0500, Monah Baki wrote:
> > > Hi all,
> > >
> > > Any good documents as to how to upgrade from 2.9.3 on Centos7
> > >
> > > Thanks
> > > Monah
> >
> >
> > > _______________________________________________
> > > mod-security-users mailing list
> > > mod...@li...
> > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > http://www.modsecurity.org/projects/commercial/rules/
> > > http://www.modsecurity.org/projects/commercial/support/
> >
> >
> >
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
> >


> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] Upgrading to v3.0.4

[Monah B. <mon...@gm...>]

Hi Christian,

Apache :)

On Wed, Jan 15, 2020 at 12:06 AM Christian Folini <
chr...@ne...> wrote:

> Hey Monah,
>
> What platform are you working on?
>
> ModSec3 on Apache is not production ready.
>
> Cheers,
>
> Christian
>
> On Tue, Jan 14, 2020 at 08:31:07PM -0500, Monah Baki wrote:
> > Hi all,
> >
> > Any good documents as to how to upgrade from 2.9.3 on Centos7
> >
> > Thanks
> > Monah
>
>
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Re: [mod-security-users] Upgrading to v3.0.4

[Christian F. <chr...@ne...>]

Hey Monah,

What platform are you working on?

ModSec3 on Apache is not production ready.

Cheers,

Christian

On Tue, Jan 14, 2020 at 08:31:07PM -0500, Monah Baki wrote:
> Hi all,
> 
> Any good documents as to how to upgrade from 2.9.3 on Centos7
> 
> Thanks
> Monah


> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/