mod-security-users — General discussion about mod_security

Re: [mod-security-users] Upgrading to v3.0.4

[Eero V. <eer...@ik...>]

Well. There is no such upgrade path? You need to recompile and install
modsecuritu 3.x.
Follow instructions at:
https://github.com/SpiderLabs/ModSecurity/wiki/Compilation-recipes-for-v3.x

You can check out my instructions how to compile modsecurity rpms for
CentOS 7

Eero

On Wed, Jan 15, 2020 at 3:34 AM Monah Baki <mon...@gm...> wrote:

> Hi all,
>
> Any good documents as to how to upgrade from 2.9.3 on Centos7
>
> Thanks
> Monah
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

[mod-security-users] Upgrading to v3.0.4

[Monah B. <mon...@gm...>]

Hi all,

Any good documents as to how to upgrade from 2.9.3 on Centos7

Thanks
Monah

Re: [mod-security-users] SecAuditLog question

[Christian F. <chr...@ne...>]

Thank you for the good news. I'm taking note.

On Tue, Jan 14, 2020 at 03:15:16PM +0100, az...@po... wrote:
> BTW, are we the only one here? :)

Nah, everybody is busy patching their servers with 3.0.4. :)

Cheers,

Christian

> 
> 
> 
> 
> Citát Christian Folini <chr...@ne...>:
> 
> > I do not know. Give it a shot, and please don't forget to report back (if you
> > survive. :)
> > 
> > On Fri, Jan 10, 2020 at 06:35:31AM +0100, az...@po... wrote:
> > > Ok, will it do any harm if i set it to /dev/null?
> > > 
> > > 
> > > 
> > > 
> > > 
> > > Citát Christian Folini <chr...@ne...>:
> > > 
> > > > I do not think it is, Azur. But I see your pain...
> > > >
> > > > On Fri, Jan 10, 2020 at 06:27:17AM +0100, az...@po... wrote:
> > > > > Hi,
> > > > >
> > > > > when using 'Concurrent' logging format, is it possible to
> > > disable concurrent
> > > > > logging index file set by 'SecAuditLog'? I don't need it. Thanks.
> > > > >
> > > > > azur
> > > > >
> > > > >
> > > > >
> > > > >
> > > > > _______________________________________________
> > > > > mod-security-users mailing list
> > > > > mod...@li...
> > > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > > > http://www.modsecurity.org/projects/commercial/rules/
> > > > > http://www.modsecurity.org/projects/commercial/support/
> > > >
> > > >
> > > > _______________________________________________
> > > > mod-security-users mailing list
> > > > mod...@li...
> > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > > http://www.modsecurity.org/projects/commercial/rules/
> > > > http://www.modsecurity.org/projects/commercial/support/
> > > 
> > > 
> > > 
> > > 
> > > 
> > > _______________________________________________
> > > mod-security-users mailing list
> > > mod...@li...
> > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > http://www.modsecurity.org/projects/commercial/rules/
> > > http://www.modsecurity.org/projects/commercial/support/
> > 
> > 
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
> 
> 
> 
> 
> 
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] SecAuditLog question

[<az...@po...>]

Looks it's working fine with /dev/null (tested on about 10 servers for  
several days).

BTW, are we the only one here? :)




Citát Christian Folini <chr...@ne...>:

> I do not know. Give it a shot, and please don't forget to report back (if you
> survive. :)
>
> On Fri, Jan 10, 2020 at 06:35:31AM +0100, az...@po... wrote:
>> Ok, will it do any harm if i set it to /dev/null?
>>
>>
>>
>>
>>
>> Citát Christian Folini <chr...@ne...>:
>>
>> > I do not think it is, Azur. But I see your pain...
>> >
>> > On Fri, Jan 10, 2020 at 06:27:17AM +0100, az...@po... wrote:
>> > > Hi,
>> > >
>> > > when using 'Concurrent' logging format, is it possible to  
>> disable concurrent
>> > > logging index file set by 'SecAuditLog'? I don't need it. Thanks.
>> > >
>> > > azur
>> > >
>> > >
>> > >
>> > >
>> > > _______________________________________________
>> > > mod-security-users mailing list
>> > > mod...@li...
>> > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> > > http://www.modsecurity.org/projects/commercial/rules/
>> > > http://www.modsecurity.org/projects/commercial/support/
>> >
>> >
>> > _______________________________________________
>> > mod-security-users mailing list
>> > mod...@li...
>> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> > http://www.modsecurity.org/projects/commercial/rules/
>> > http://www.modsecurity.org/projects/commercial/support/
>>
>>
>>
>>
>>
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

[mod-security-users] ModSecurity v3.0.4 announcement

[Felipe Z. <fe...@zi...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Hi

It is a pleasure to announce the release of ModSecurity version 3.0.4
(libModSecurity). This version contains a number of improvements in
different areas. These include cleanups, better practices for improved
code readability, resilience and overall performance and security
fixes.

A huge refactoring was placed on the Regex engine, which is now more
performant. The Logging was polished and hex-encoded strings are now
pretty printed. An operator to detect Australian social security
number was added. The audit log is now working with section H and
better dealing with logs, nologs and auditlogs combinations.

POTENTIAL SECURITY ISSUES:

- - Cookie parser problems
 [@theMiddleBlue, @airween, @martinhsv]

The list with the full changes can be found on the project CHANGES file,
available here:
- - https://github.com/SpiderLabs/ModSecurity/releases/tag/v3.0.4/CHANGES

The list of open issues is available on GitHub:
- - https://github.com/SpiderLabs/ModSecurity/labels/3.x

As with every new release, a milestone was created to host all the issues
that will be fixed till we reach the given milestone. With that, we not
only give the community the full transparency of the work that is being
doing on ModSec, but also even more chances to participate. Milestones
give the chance to anyone from the community to deduce when and what will
be released.

Thanks to everybody who helped in this process: reporting issues, making
comments and suggestions, sending patches and so on.

Further details on the compilation process for ModSecurity v3, can be
found on the project README:
 - https://github.com/SpiderLabs/ModSecurity/tree/v3/master#compilation

Complementary documentation for the connectors are available here:
 - nginx: https://github.com/SpiderLabs/ModSecurity-nginx/#compilation
 - Apache: https://github.com/SpiderLabs/ModSecurity-apache/#compilation

IMPORTANT: ModSecurity version 2 will be available and maintained parallel
to version 3. There is no ETA to deprecate the version 2.x. New features
and major improvements will be implemented on version 3.x. Security or
major bugs are planned to be back ported. Version 2 and version 3 has a
completely independent development/release cycle.


Br.,
Felipe "Zimmerle" Costa

-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iF0EARECAB0WIQQZDvrMoen6RmqOzZzm37CM6LESdwUCXhxx8QAKCRDm37CM6LES
dy8jAJ4l6Goa0qn+RyxwrFPa8Zjl9t8HagCeJeHULU8EsT2M2S0Ho6ROgOdQstM=
=GeNp
-----END PGP SIGNATURE-----

Re: [mod-security-users] SecAuditLog question

[Christian F. <chr...@ne...>]

I do not know. Give it a shot, and please don't forget to report back (if you
survive. :)

On Fri, Jan 10, 2020 at 06:35:31AM +0100, az...@po... wrote:
> Ok, will it do any harm if i set it to /dev/null?
> 
> 
> 
> 
> 
> Citát Christian Folini <chr...@ne...>:
> 
> > I do not think it is, Azur. But I see your pain...
> > 
> > On Fri, Jan 10, 2020 at 06:27:17AM +0100, az...@po... wrote:
> > > Hi,
> > > 
> > > when using 'Concurrent' logging format, is it possible to disable concurrent
> > > logging index file set by 'SecAuditLog'? I don't need it. Thanks.
> > > 
> > > azur
> > > 
> > > 
> > > 
> > > 
> > > _______________________________________________
> > > mod-security-users mailing list
> > > mod...@li...
> > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > http://www.modsecurity.org/projects/commercial/rules/
> > > http://www.modsecurity.org/projects/commercial/support/
> > 
> > 
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
> 
> 
> 
> 
> 
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] SecAuditLog question

[<az...@po...>]

Ok, will it do any harm if i set it to /dev/null?





Citát Christian Folini <chr...@ne...>:

> I do not think it is, Azur. But I see your pain...
>
> On Fri, Jan 10, 2020 at 06:27:17AM +0100, az...@po... wrote:
>> Hi,
>>
>> when using 'Concurrent' logging format, is it possible to disable concurrent
>> logging index file set by 'SecAuditLog'? I don't need it. Thanks.
>>
>> azur
>>
>>
>>
>>
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] SecAuditLog question

[Christian F. <chr...@ne...>]

I do not think it is, Azur. But I see your pain...

On Fri, Jan 10, 2020 at 06:27:17AM +0100, az...@po... wrote:
> Hi,
> 
> when using 'Concurrent' logging format, is it possible to disable concurrent
> logging index file set by 'SecAuditLog'? I don't need it. Thanks.
> 
> azur
> 
> 
> 
> 
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

[mod-security-users] SecAuditLog question

[<az...@po...>]

Hi,

when using 'Concurrent' logging format, is it possible to disable  
concurrent logging index file set by 'SecAuditLog'? I don't need it.  
Thanks.

azur

Re: [mod-security-users] Match empty string

[Christian F. <chr...@ne...>]

Hey Azur,

You should be able to use the t:length transformation and then match "@eq 0".

Ahoj,

Christian


On Sun, Jan 05, 2020 at 06:46:56PM +0100, az...@po... wrote:
> Hi,
> 
> any hints how to match empty string? POST parameter like 'something='.
> Thanks for info.
> 
> azur
> 
> 
> 
> 
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] Match empty OR missing

[Christian F. <chr...@ne...>]

On Sun, Jan 05, 2020 at 06:49:21PM +0100, az...@po... wrote:
> Hi,
> 
> can someone advice me how to match a POST parameter, which must be 'empty OR
> missing' with one exclusive rule? i.e. it's either completely not there or
> is like 'parameter='. Thanks.

SecRule ARGS_POST:parameter "!@eq 0" "id:1000,phase:2,deny,t:length"

This is a whitelisting rule that is not executed if the arg "parameter" is
not present. If it is present, then it has to be empty.

If there are multiple occurrences of arg "parameter", the rule blocks too.
(-> HTTP Parameter pollution).

Cheers,

Christian


> 
> azur
> 
> 
> 
> 
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

[mod-security-users] Match empty string

[<az...@po...>]

Hi,

any hints how to match empty string? POST parameter like 'something='.  
Thanks for info.

azur

[mod-security-users] Match empty OR missing

[<az...@po...>]

Hi,

can someone advice me how to match a POST parameter, which must be  
'empty OR missing' with one exclusive rule? i.e. it's either  
completely not there or is like 'parameter='. Thanks.

azur

Re: [mod-security-users] This version of ModSecurity was not compiled with GeoIP or MaxMind support

[Dino E. <din...@my...>]

Hi Ervin,

> Could you show us the full command line what you tried to compile, and its output?

===  Start Configure and Output ===

./configure --with-geoip=yes
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /bin/mkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking for g++... g++
checking whether the C++ compiler works... yes
checking for C++ compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C++ compiler... yes
checking whether g++ accepts -g... yes
checking for style of include used by make... GNU
checking dependency style of g++... gcc3
checking for gcc... gcc
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking whether gcc understands -c and -o together... yes
checking dependency style of gcc... gcc3
checking for ar... ar
checking the archiver (ar) interface... ar
checking whether make sets $(MAKE)... (cached) yes
checking for pkg-config... /usr/bin/pkg-config
checking pkg-config is at least version 0.9.0... yes
configure: Nothing about GeoIP was informed during the configure phase. Trying to detect it on the platform...
configure: YAJL library was not found
configure: GeoIP support was marked as mandatory by the utilization of --with-geoip=yes
configure: Nothing about GeoIP was informed during the configure phase. Trying to detect it on the platform...
configure: using GeoIP v1.6.12
configure: Nothing about MaxMind was informed during the configure phase. Trying to detect it on the platform...
configure: using MaxMind v1.4.2
configure: Nothing about LMDB was informed during the configure phase. Trying to detect it on the platform...
*** LOOKING AT PATH:  /usr/lib
*** LOOKING AT PATH:  /usr/local/lib
*** LOOKING AT PATH:  /usr/local/liblmdb
*** LOOKING AT PATH:  /usr/local/lmdb
*** LOOKING AT PATH:  /usr/local
*** LOOKING AT PATH:  /opt/liblmdb
*** LOOKING AT PATH:  /opt/lmdb
*** LOOKING AT PATH:  /opt
*** LOOKING AT PATH:  /usr
*** LOOKING AT PATH:  /usr/lib64
*** LOOKING AT PATH:  /opt/local
configure: LMDB library was not found
*** LOOKING AT PATH:  /usr/lib
*** LOOKING AT PATH:  /usr/local/lib
*** LOOKING AT PATH:  /usr/local/fuzzy
*** LOOKING AT PATH:  /usr/local/libfuzzy
*** LOOKING AT PATH:  /usr/local
*** LOOKING AT PATH:  /opt
*** LOOKING AT PATH:  /usr
*** LOOKING AT PATH:  /usr/lib64
*** LOOKING AT PATH:  /opt/local
configure: SSDEEP library was not found
*** LOOKING AT PATH:  /usr/lib
*** LOOKING AT PATH:  /usr/local/lib
*** LOOKING AT PATH:  /usr/local/lib64
*** LOOKING AT PATH:  /usr/local/lua
*** LOOKING AT PATH:  /usr/local/liblua
*** LOOKING AT PATH:  /usr/local
*** LOOKING AT PATH:  /opt
*** LOOKING AT PATH:  /usr
*** LOOKING AT PATH:  /usr/lib64
*** LOOKING AT PATH:  /opt/local
configure: LUA library was not found
checking for libcurl config script... /usr/bin/curl-config
configure: curl VERSION: 7.58.0
configure: curl LDADD:
checking if libcurl is at least v... yes, 7.58.0
checking if libcurl is linked with gnutls... no
configure: using curl v7.58.0
checking for libxml2 config script... /usr/bin/xml2-config
configure: xml VERSION: 2.9.4
configure: xml CFLAGS: -I/usr/include/libxml2 -DWITH_LIBXML2
configure: xml LDADD: -lxml2
checking if libxml2 is at least v2.6.29... yes, 2.9.4
configure: using libxml2 v2.9.4
checking for libpcre config script... /usr/bin/pcre-config
configure: pcre VERSION: 8.39
configure: pcre LDADD: -lpcre
configure: pcre PCRE_LD_PATH: /-lpcre
checking for PCRE JIT... yes
configure: using pcre v8.39
checking how to run the C preprocessor... gcc -E
checking for grep that handles long lines and -e... /bin/grep
checking for egrep... /bin/grep -E
checking for ANSI C header files... yes
checking for sys/types.h... yes
checking for sys/stat.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for memory.h... yes
checking for strings.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for unistd.h... yes
checking string usability... no
checking string presence... no
checking for string... no
checking iostream usability... no
checking iostream presence... no
checking for iostream... no
checking sys/utsname.h usability... yes
checking sys/utsname.h presence... yes
checking for sys/utsname.h... yes
checking build system type... x86_64-pc-linux-gnu
checking host system type... x86_64-pc-linux-gnu
checking how to print strings... printf
checking for a sed that does not truncate output... /bin/sed
checking for fgrep... /bin/grep -F
checking for ld used by gcc... /usr/bin/ld
checking if the linker (/usr/bin/ld) is GNU ld... yes
checking for BSD- or MS-compatible name lister (nm)... /usr/bin/nm -B
checking the name lister (/usr/bin/nm -B) interface... BSD nm
checking whether ln -s works... yes
checking the maximum length of command line arguments... 1572864
checking how to convert x86_64-pc-linux-gnu file names to x86_64-pc-linux-gnu format... func_convert_file_noop
checking how to convert x86_64-pc-linux-gnu file names to toolchain format... func_convert_file_noop
checking for /usr/bin/ld option to reload object files... -r
checking for objdump... objdump
checking how to recognize dependent libraries... pass_all
checking for dlltool... no
checking how to associate runtime and link libraries... printf %s\n
checking for archiver @FILE support... @
checking for strip... strip
checking for ranlib... ranlib
checking command to parse /usr/bin/nm -B output from gcc object... ok
checking for sysroot... no
checking for a working dd... /bin/dd
checking how to truncate binary pipes... /bin/dd bs=4096 count=1
checking for mt... mt
checking if mt is a manifest tool... no
checking for dlfcn.h... yes
checking for objdir... .libs
checking if gcc supports -fno-rtti -fno-exceptions... no
checking for gcc option to produce PIC... -fPIC -DPIC
checking if gcc PIC flag -fPIC -DPIC works... yes
checking if gcc static flag -static works... yes
checking if gcc supports -c -o file.o... yes
checking if gcc supports -c -o file.o... (cached) yes
checking whether the gcc linker (/usr/bin/ld -m elf_x86_64) supports shared libraries... yes
checking whether -lc should be explicitly linked in... no
checking dynamic linker characteristics... GNU/Linux ld.so
checking how to hardcode library paths into programs... immediate
checking for shl_load... no
checking for shl_load in -ldld... no
checking for dlopen... no
checking for dlopen in -ldl... yes
checking whether a program can dlopen itself... yes
checking whether a statically linked program can dlopen itself... no
checking whether stripping libraries is possible... yes
checking if libtool supports shared libraries... yes
checking whether to build shared libraries... yes
checking whether to build static libraries... yes
checking how to run the C++ preprocessor... g++ -E
checking for ld used by g++... /usr/bin/ld -m elf_x86_64
checking if the linker (/usr/bin/ld -m elf_x86_64) is GNU ld... yes
checking whether the g++ linker (/usr/bin/ld -m elf_x86_64) supports shared libraries... yes
checking for g++ option to produce PIC... -fPIC -DPIC
checking if g++ PIC flag -fPIC -DPIC works... yes
checking if g++ static flag -static works... yes
checking if g++ supports -c -o file.o... yes
checking if g++ supports -c -o file.o... (cached) yes
checking whether the g++ linker (/usr/bin/ld -m elf_x86_64) supports shared libraries... yes
checking dynamic linker characteristics... (cached) GNU/Linux ld.so
checking how to hardcode library paths into programs... immediate
Checking platform... Identified as Linux
checking for doxygen... no
configure: WARNING: doxygen not found - will not generate any doxygen documentation
checking for perl... /usr/bin/perl
checking for valgrind... no
checking that generated files are newer than configure... done
configure: creating ./config.status
config.status: creating modsecurity.pc
config.status: creating Makefile
config.status: creating doc/Makefile
config.status: creating src/Makefile
config.status: creating others/Makefile
config.status: creating tools/Makefile
config.status: creating tools/rules-check/Makefile
config.status: creating examples/Makefile
config.status: creating examples/simple_example_using_c/Makefile
config.status: creating examples/multiprocess_c/Makefile
config.status: creating examples/reading_logs_with_offset/Makefile
config.status: creating examples/reading_logs_via_rule_message/Makefile
config.status: creating examples/using_bodies_in_chunks/Makefile
config.status: creating src/config.h
config.status: src/config.h is unchanged
config.status: executing depfiles commands
config.status: executing libtool commands


ModSecurity - v3.0.3-114-g6624a18a for Linux

 Mandatory dependencies
   + libInjection                                  ....v3.9.2-30-gbf234eb
   + SecLang tests                                 ....c8cf2c5

 Optional dependencies
   + GeoIP/MaxMind                                 ....found
      * (MaxMind) v1.4.2
         -lmaxminddb  , -DWITH_MAXMIND -I/usr/include/x86_64-linux-gnu
      * (GeoIP) v1.6.12
         -lGeoIP  , -I/usr/include/
   + LibCURL                                       ....found v7.58.0
      -lcurl,  -DWITH_CURL_SSLVERSION_TLSv1_2 -DWITH_CURL
   + YAJL                                          ....not found
   + LMDB                                          ....not found
   + LibXML2                                       ....found v2.9.4
      -lxml2, -I/usr/include/libxml2 -DWITH_LIBXML2
   + SSDEEP                                        ....not found
   + LUA                                           ....not found

 Other Options
   + Test Utilities                                ....disabled
   + SecDebugLog                                   ....enabled
   + afl fuzzer                                    ....disabled
   + library examples                              ....enabled
   + Building parser                               ....disabled
   + Treating pm operations as critical section    ....disabled

=== End Configure and Output ===

> Also need to see this output:
> $ ldd /path/to/your/shared/object | grep -i "\(geoip\|maxmin\)"

ldd /usr/local/modsecurity/lib/libmodsecurity.so.3.0.3| grep -i "\(geoip\|maxmin\)"

displays nothing, so it's obviously not compiled with geoip or maxmind

Thanks

Dino

-----Original Message-----
From: Ervin Hegedüs <ai...@gm...> 
Sent: Monday, December 30, 2019 12:12 PM
To: Dino Edwards via mod-security-users <mod...@li...>
Cc: Eero Volotinen <eer...@ik...>; Dino Edwards <din...@my...>
Subject: Re: [mod-security-users] This version of ModSecurity was not compiled with GeoIP or MaxMind support

Hi Dino,


On Mon, Dec 30, 2019 at 04:52:49PM +0000, Dino Edwards via mod-security-users wrote:
> Yes, that would be the OWASP ModSecurity Core Rule Set. Using the latest version I pulled from Github, so it would be 3.2.0.  I was not aware that it had to be compiled. I simply ran the following:

CRS is relevant only because it uses @geoLookup operator.

The ModSecurity-nginx connector isn't relevant from point of this issue.

Could you show us the full command line what you tried to compile, and its output?

I mean the full

./configure ... ... all-of-your-option

and the full configure script summary.


Also need to see this output:

$ ldd /path/to/your/shared/object | grep -i "\(geoip\|maxmin\)"

Here is mine:

$ ldd /usr/lib/libmodsecurity.so.3.0.3  | grep -i "\(geoip\|maxmin\)"
	libGeoIP.so.1 => /usr/lib/x86_64-linux-gnu/libGeoIP.so.1 (0x00007fef67c3d000)
	libmaxminddb.so.0 => /usr/lib/x86_64-linux-gnu/libmaxminddb.so.0 (0x00007fef677be000)


Regards,


a.

Re: [mod-security-users] This version of ModSecurity was not compiled with GeoIP or MaxMind support

[Ervin H. <ai...@gm...>]

Hi Dino,


On Mon, Dec 30, 2019 at 04:52:49PM +0000, Dino Edwards via mod-security-users wrote:
> Yes, that would be the OWASP ModSecurity Core Rule Set. Using the latest version I pulled from Github, so it would be 3.2.0.  I was not aware that it had to be compiled. I simply ran the following:

CRS is relevant only because it uses @geoLookup operator.

The ModSecurity-nginx connector isn't relevant from point of this issue.

Could you show us the full command line what you tried to
compile, and its output?

I mean the full

./configure ... ... all-of-your-option

and the full configure script summary.


Also need to see this output:

$ ldd /path/to/your/shared/object | grep -i "\(geoip\|maxmin\)"

Here is mine:

$ ldd /usr/lib/libmodsecurity.so.3.0.3  | grep -i "\(geoip\|maxmin\)"
	libGeoIP.so.1 => /usr/lib/x86_64-linux-gnu/libGeoIP.so.1 (0x00007fef67c3d000)
	libmaxminddb.so.0 => /usr/lib/x86_64-linux-gnu/libmaxminddb.so.0 (0x00007fef677be000)


Regards,


a.

Re: [mod-security-users] This version of ModSecurity was not compiled with GeoIP or MaxMind support

[Dino E. <din...@my...>]

Yes, that would be the OWASP ModSecurity Core Rule Set. Using the latest version I pulled from Github, so it would be 3.2.0.  I was not aware that it had to be compiled. I simply ran the following:

git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git && \
cd owasp-modsecurity-crs/ && \
/bin/cp -R rules/ /usr/local/nginx/conf/ && \
/bin/cp /opt/owasp-modsecurity-crs/crs-setup.conf.example /usr/local/nginx/conf/crs-setup.conf



From: Eero Volotinen <eer...@ik...>
Sent: Monday, December 30, 2019 11:24 AM
To: mod...@li...
Cc: Dino Edwards <din...@my...>
Subject: Re: [mod-security-users] This version of ModSecurity was not compiled with GeoIP or MaxMind support

Hi,

OWASP ruleset? You mean crs ruleset? what version? that repository also compiles packages from source.

Eero

On Mon, Dec 30, 2019 at 6:03 PM Dino Edwards via mod-security-users <mod...@li...<mailto:mod...@li...>> wrote:
I’m using the OWASP ruleset.

I haven’t tried that repository. Just trying to build from source.

From: Eero Volotinen <eer...@ik...<mailto:eer...@ik...>>
Sent: Monday, December 30, 2019 5:52 AM
To: Dino Edwards <din...@my...<mailto:din...@my...>>
Subject: Re: [mod-security-users] This version of ModSecurity was not compiled with GeoIP or MaxMind support

Please at least provide rulesets that your are using.

Have you tested this repository:  https://github.com/phusion/nginx-modsecurity-ubuntu#building-the-package

Eero

On Mon, Dec 30, 2019 at 12:30 PM Dino Edwards via mod-security-users <mod...@li...<mailto:mod...@li...>> wrote:
Hi Eero

Here’s the relevant command lines.

Compile Modsecurity (I have tried with ./configure –enable-standalone-module  AND/OR ./configure –with-geoip=yes AND/OR ./configure –with-maxmind=yes)

sh build.sh && \
/usr/bin/git submodule init && \
/usr/bin/git submodule update && \
./configure && \
make && \
make install

Compile Nginx ( have tried with ./configure --with-http_geoip_module  AND  ./configure --with-http_geoip_module=dynamic)

./configure --user=www-data --group=www-data --with-pcre-jit --with-debug --with-http_ssl_module --with-http_realip_module --add-module=/opt/headers-more-nginx-module-master --add-module=/opt/ModSecurity-nginx --prefix=/usr/local/nginx --conf-path=/usr/local/nginx/conf/nginx.conf && \
make && \
make install

Thanks!


From: Eero Volotinen <eer...@ik...<mailto:eer...@ik...>>
Sent: Sunday, December 29, 2019 7:05 AM
To: mod...@li...<mailto:mod...@li...>
Cc: Dino Edwards <din...@my...<mailto:din...@my...>>
Subject: Re: [mod-security-users] This version of ModSecurity was not compiled with GeoIP or MaxMind support

please provide full commandline for compilation of software.

Eero

On Sun 29. Dec 2019 at 12.28, Dino Edwards via mod-security-users <mod...@li...<mailto:mod...@li...>> wrote:
HI,

I’m having a problem with libmodsecurity (Modsecurity 3.0.3-114) or Nginx or both, I can’t tell which. Everytime I try to start Nginx on Ubuntu 18.04, it throws the following error:

nginx: [emerg] "modsecurity_rules_file" directive Rules error. File: /usr/local/nginx/conf/modsecurity/../rules/REQUEST-910-IP-REPUTATION.conf. Line: 73. Column: 22. This version of ModSecurity was not compiled with GeoIP or MaxMind support.

I originally installed GeoIP which didn’t work and then I installed MaxMind which didn’t work either.

When I compile libmodsecurity it looks like it finds GeoIP/MaxMind:

Optional dependencies
   + GeoIP/MaxMind                                 ....found
      * (MaxMind) v1.4.2
         -lmaxminddb  , -DWITH_MAXMIND -I/usr/include/x86_64-linux-gnu
      * (GeoIP) v1.6.12
         -lGeoIP  , -I/usr/include/

I tried compiling with –with-maxind=yes and with –with-geoip=yes flags still same problem.

I compile nginx with either the –with-http_geoip_module OR –with-http_geoip_module=dynamic flags same error.

I’m not sure where to go from there. The only way I can get Nginx to start without throwing that error is to remove the REQUEST-910-IP-REPUTATION.conf rule.

I would appreciate some help.

Thanks!
_______________________________________________
mod-security-users mailing list
mod...@li...<mailto:mod...@li...>
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/
_______________________________________________
mod-security-users mailing list
mod...@li...<mailto:mod...@li...>
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/
_______________________________________________
mod-security-users mailing list
mod...@li...<mailto:mod...@li...>
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] This version of ModSecurity was not compiled with GeoIP or MaxMind support

[Eero V. <eer...@ik...>]

Hi,

OWASP ruleset? You mean crs ruleset? what version? that repository also
compiles packages from source.

Eero

On Mon, Dec 30, 2019 at 6:03 PM Dino Edwards via mod-security-users <
mod...@li...> wrote:

> I’m using the OWASP ruleset.
>
>
>
> I haven’t tried that repository. Just trying to build from source.
>
>
>
> *From:* Eero Volotinen <eer...@ik...>
> *Sent:* Monday, December 30, 2019 5:52 AM
> *To:* Dino Edwards <din...@my...>
> *Subject:* Re: [mod-security-users] This version of ModSecurity was not
> compiled with GeoIP or MaxMind support
>
>
>
> Please at least provide rulesets that your are using.
>
>
>
> Have you tested this repository:
> https://github.com/phusion/nginx-modsecurity-ubuntu#building-the-package
>
>
>
> Eero
>
>
>
> On Mon, Dec 30, 2019 at 12:30 PM Dino Edwards via mod-security-users <
> mod...@li...> wrote:
>
> Hi Eero
>
>
>
> Here’s the relevant command lines.
>
>
>
> Compile Modsecurity (I have tried with ./configure
> –enable-standalone-module  AND/OR ./configure –with-geoip=yes AND/OR
> ./configure –with-maxmind=yes)
>
>
>
> sh build.sh && \
>
> /usr/bin/git submodule init && \
>
> /usr/bin/git submodule update && \
>
> ./configure && \
>
> make && \
>
> make install
>
>
>
> Compile Nginx ( have tried with ./configure --with-http_geoip_module  AND
>  ./configure --with-http_geoip_module=dynamic)
>
>
>
> ./configure --user=www-data --group=www-data --with-pcre-jit --with-debug
> --with-http_ssl_module --with-http_realip_module
> --add-module=/opt/headers-more-nginx-module-master
> --add-module=/opt/ModSecurity-nginx --prefix=/usr/local/nginx
> --conf-path=/usr/local/nginx/conf/nginx.conf && \
>
> make && \
>
> make install
>
>
>
> Thanks!
>
>
>
>
>
> *From:* Eero Volotinen <eer...@ik...>
> *Sent:* Sunday, December 29, 2019 7:05 AM
> *To:* mod...@li...
> *Cc:* Dino Edwards <din...@my...>
> *Subject:* Re: [mod-security-users] This version of ModSecurity was not
> compiled with GeoIP or MaxMind support
>
>
>
> please provide full commandline for compilation of software.
>
>
>
> Eero
>
>
>
> On Sun 29. Dec 2019 at 12.28, Dino Edwards via mod-security-users <
> mod...@li...> wrote:
>
> HI,
>
>
>
> I’m having a problem with libmodsecurity (Modsecurity 3.0.3-114) or Nginx
> or both, I can’t tell which. Everytime I try to start Nginx on Ubuntu
> 18.04, it throws the following error:
>
>
>
> nginx: [emerg] "modsecurity_rules_file" directive Rules error. File:
> /usr/local/nginx/conf/modsecurity/../rules/REQUEST-910-IP-REPUTATION.conf.
> Line: 73. Column: 22. This version of ModSecurity was not compiled with
> GeoIP or MaxMind support.
>
>
>
> I originally installed GeoIP which didn’t work and then I installed
> MaxMind which didn’t work either.
>
>
>
> When I compile libmodsecurity it looks like it finds GeoIP/MaxMind:
>
>
>
> Optional dependencies
>
>    + GeoIP/MaxMind                                 ....found
>
>       * (MaxMind) v1.4.2
>
>          -lmaxminddb  , -DWITH_MAXMIND -I/usr/include/x86_64-linux-gnu
>
>       * (GeoIP) v1.6.12
>
>          -lGeoIP  , -I/usr/include/
>
>
>
> I tried compiling with –with-maxind=yes and with –with-geoip=yes flags
> still same problem.
>
>
>
> I compile nginx with either the –with-http_geoip_module OR
> –with-http_geoip_module=dynamic flags same error.
>
>
>
> I’m not sure where to go from there. The only way I can get Nginx to start
> without throwing that error is to remove the REQUEST-910-IP-REPUTATION.conf
> rule.
>
>
>
> I would appreciate some help.
>
>
>
> Thanks!
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Re: [mod-security-users] This version of ModSecurity was not compiled with GeoIP or MaxMind support

[Dino E. <din...@my...>]

I’m using the OWASP ruleset.

I haven’t tried that repository. Just trying to build from source.

From: Eero Volotinen <eer...@ik...>
Sent: Monday, December 30, 2019 5:52 AM
To: Dino Edwards <din...@my...>
Subject: Re: [mod-security-users] This version of ModSecurity was not compiled with GeoIP or MaxMind support

Please at least provide rulesets that your are using.

Have you tested this repository:  https://github.com/phusion/nginx-modsecurity-ubuntu#building-the-package

Eero

On Mon, Dec 30, 2019 at 12:30 PM Dino Edwards via mod-security-users <mod...@li...<mailto:mod...@li...>> wrote:
Hi Eero

Here’s the relevant command lines.

Compile Modsecurity (I have tried with ./configure –enable-standalone-module  AND/OR ./configure –with-geoip=yes AND/OR ./configure –with-maxmind=yes)

sh build.sh && \
/usr/bin/git submodule init && \
/usr/bin/git submodule update && \
./configure && \
make && \
make install

Compile Nginx ( have tried with ./configure --with-http_geoip_module  AND  ./configure --with-http_geoip_module=dynamic)

./configure --user=www-data --group=www-data --with-pcre-jit --with-debug --with-http_ssl_module --with-http_realip_module --add-module=/opt/headers-more-nginx-module-master --add-module=/opt/ModSecurity-nginx --prefix=/usr/local/nginx --conf-path=/usr/local/nginx/conf/nginx.conf && \
make && \
make install

Thanks!


From: Eero Volotinen <eer...@ik...<mailto:eer...@ik...>>
Sent: Sunday, December 29, 2019 7:05 AM
To: mod...@li...<mailto:mod...@li...>
Cc: Dino Edwards <din...@my...<mailto:din...@my...>>
Subject: Re: [mod-security-users] This version of ModSecurity was not compiled with GeoIP or MaxMind support

please provide full commandline for compilation of software.

Eero

On Sun 29. Dec 2019 at 12.28, Dino Edwards via mod-security-users <mod...@li...<mailto:mod...@li...>> wrote:
HI,

I’m having a problem with libmodsecurity (Modsecurity 3.0.3-114) or Nginx or both, I can’t tell which. Everytime I try to start Nginx on Ubuntu 18.04, it throws the following error:

nginx: [emerg] "modsecurity_rules_file" directive Rules error. File: /usr/local/nginx/conf/modsecurity/../rules/REQUEST-910-IP-REPUTATION.conf. Line: 73. Column: 22. This version of ModSecurity was not compiled with GeoIP or MaxMind support.

I originally installed GeoIP which didn’t work and then I installed MaxMind which didn’t work either.

When I compile libmodsecurity it looks like it finds GeoIP/MaxMind:

Optional dependencies
   + GeoIP/MaxMind                                 ....found
      * (MaxMind) v1.4.2
         -lmaxminddb  , -DWITH_MAXMIND -I/usr/include/x86_64-linux-gnu
      * (GeoIP) v1.6.12
         -lGeoIP  , -I/usr/include/

I tried compiling with –with-maxind=yes and with –with-geoip=yes flags still same problem.

I compile nginx with either the –with-http_geoip_module OR –with-http_geoip_module=dynamic flags same error.

I’m not sure where to go from there. The only way I can get Nginx to start without throwing that error is to remove the REQUEST-910-IP-REPUTATION.conf rule.

I would appreciate some help.

Thanks!
_______________________________________________
mod-security-users mailing list
mod...@li...<mailto:mod...@li...>
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/
_______________________________________________
mod-security-users mailing list
mod...@li...<mailto:mod...@li...>
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] This version of ModSecurity was not compiled with GeoIP or MaxMind support

[Dino E. <din...@my...>]

Hi Eero

Here’s the relevant command lines.

Compile Modsecurity (I have tried with ./configure –enable-standalone-module  AND/OR ./configure –with-geoip=yes AND/OR ./configure –with-maxmind=yes)

sh build.sh && \
/usr/bin/git submodule init && \
/usr/bin/git submodule update && \
./configure && \
make && \
make install

Compile Nginx ( have tried with ./configure --with-http_geoip_module  AND  ./configure --with-http_geoip_module=dynamic)

./configure --user=www-data --group=www-data --with-pcre-jit --with-debug --with-http_ssl_module --with-http_realip_module --add-module=/opt/headers-more-nginx-module-master --add-module=/opt/ModSecurity-nginx --prefix=/usr/local/nginx --conf-path=/usr/local/nginx/conf/nginx.conf && \
make && \
make install

Thanks!


From: Eero Volotinen <eer...@ik...>
Sent: Sunday, December 29, 2019 7:05 AM
To: mod...@li...
Cc: Dino Edwards <din...@my...>
Subject: Re: [mod-security-users] This version of ModSecurity was not compiled with GeoIP or MaxMind support

please provide full commandline for compilation of software.

Eero

On Sun 29. Dec 2019 at 12.28, Dino Edwards via mod-security-users <mod...@li...<mailto:mod...@li...>> wrote:
HI,

I’m having a problem with libmodsecurity (Modsecurity 3.0.3-114) or Nginx or both, I can’t tell which. Everytime I try to start Nginx on Ubuntu 18.04, it throws the following error:

nginx: [emerg] "modsecurity_rules_file" directive Rules error. File: /usr/local/nginx/conf/modsecurity/../rules/REQUEST-910-IP-REPUTATION.conf. Line: 73. Column: 22. This version of ModSecurity was not compiled with GeoIP or MaxMind support.

I originally installed GeoIP which didn’t work and then I installed MaxMind which didn’t work either.

When I compile libmodsecurity it looks like it finds GeoIP/MaxMind:

Optional dependencies
   + GeoIP/MaxMind                                 ....found
      * (MaxMind) v1.4.2
         -lmaxminddb  , -DWITH_MAXMIND -I/usr/include/x86_64-linux-gnu
      * (GeoIP) v1.6.12
         -lGeoIP  , -I/usr/include/

I tried compiling with –with-maxind=yes and with –with-geoip=yes flags still same problem.

I compile nginx with either the –with-http_geoip_module OR –with-http_geoip_module=dynamic flags same error.

I’m not sure where to go from there. The only way I can get Nginx to start without throwing that error is to remove the REQUEST-910-IP-REPUTATION.conf rule.

I would appreciate some help.

Thanks!
_______________________________________________
mod-security-users mailing list
mod...@li...<mailto:mod...@li...>
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] This version of ModSecurity was not compiled with GeoIP or MaxMind support

[Eero V. <eer...@ik...>]

please provide full commandline for compilation of software.

Eero

On Sun 29. Dec 2019 at 12.28, Dino Edwards via mod-security-users <
mod...@li...> wrote:

> HI,
>
>
>
> I’m having a problem with libmodsecurity (Modsecurity 3.0.3-114) or Nginx
> or both, I can’t tell which. Everytime I try to start Nginx on Ubuntu
> 18.04, it throws the following error:
>
>
>
> nginx: [emerg] "modsecurity_rules_file" directive Rules error. File:
> /usr/local/nginx/conf/modsecurity/../rules/REQUEST-910-IP-REPUTATION.conf.
> Line: 73. Column: 22. This version of ModSecurity was not compiled with
> GeoIP or MaxMind support.
>
>
>
> I originally installed GeoIP which didn’t work and then I installed
> MaxMind which didn’t work either.
>
>
>
> When I compile libmodsecurity it looks like it finds GeoIP/MaxMind:
>
>
>
> Optional dependencies
>
>    + GeoIP/MaxMind                                 ....found
>
>       * (MaxMind) v1.4.2
>
>          -lmaxminddb  , -DWITH_MAXMIND -I/usr/include/x86_64-linux-gnu
>
>       * (GeoIP) v1.6.12
>
>          -lGeoIP  , -I/usr/include/
>
>
>
> I tried compiling with –with-maxind=yes and with –with-geoip=yes flags
> still same problem.
>
>
>
> I compile nginx with either the –with-http_geoip_module OR
> –with-http_geoip_module=dynamic flags same error.
>
>
>
> I’m not sure where to go from there. The only way I can get Nginx to start
> without throwing that error is to remove the REQUEST-910-IP-REPUTATION.conf
> rule.
>
>
>
> I would appreciate some help.
>
>
>
> Thanks!
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

[mod-security-users] This version of ModSecurity was not compiled with GeoIP or MaxMind support

[Dino E. <din...@my...>]

HI,

I'm having a problem with libmodsecurity (Modsecurity 3.0.3-114) or Nginx or both, I can't tell which. Everytime I try to start Nginx on Ubuntu 18.04, it throws the following error:

nginx: [emerg] "modsecurity_rules_file" directive Rules error. File: /usr/local/nginx/conf/modsecurity/../rules/REQUEST-910-IP-REPUTATION.conf. Line: 73. Column: 22. This version of ModSecurity was not compiled with GeoIP or MaxMind support.

I originally installed GeoIP which didn't work and then I installed MaxMind which didn't work either.

When I compile libmodsecurity it looks like it finds GeoIP/MaxMind:

Optional dependencies
   + GeoIP/MaxMind                                 ....found
      * (MaxMind) v1.4.2
         -lmaxminddb  , -DWITH_MAXMIND -I/usr/include/x86_64-linux-gnu
      * (GeoIP) v1.6.12
         -lGeoIP  , -I/usr/include/

I tried compiling with -with-maxind=yes and with -with-geoip=yes flags still same problem.

I compile nginx with either the -with-http_geoip_module OR -with-http_geoip_module=dynamic flags same error.


I'm not sure where to go from there. The only way I can get Nginx to start without throwing that error is to remove the REQUEST-910-IP-REPUTATION.conf rule.

I would appreciate some help.

Thanks!

Re: [mod-security-users] ModSecurity Nginx connector version 1.0.1 announcement

[Christian V. <cv...@it...>]

Thanks! 🙌🙌

Cheers.
Chris.

El lun., 16 de dic. de 2019 17:52, Felipe Zimmerle <fe...@zi...>
escribió:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
> Hi,
>
> It is a pleasure to announce the release of version 1.0.1 for the
> ModSecurity
> Nginx connector. This release contains bugfix and new features.
>
> Most important changes:
>  - Support to generate the request unique_id on nignx (Issue #126)
>  - Several memory leaks fix (Issues #80, #100, #87)
>  - Fix logging level (Issue #112, #88)
>  - Fix processing of response body when gzip compression is enabled
>    (Issue #107)
>
> Full list of changes:
> https://github.com/SpiderLabs/ModSecurity-nginx/blob/master/CHANGES
>
> The version 1.0.1 can be downloaded straight from GitHub:
> https://github.com/SpiderLabs/ModSecurity-nginx/releases/tag/v1.0.1/
>
> The list of open issues is available on GitHub:
>
> https://github.com/SpiderLabs/ModSecurity-nginx/issues?q=is%3Aissue+is%3Aopen
>
> Thanks to everybody who helped in this process: reporting issues, making
> comments and suggestions, sending patches, and so on. Special thanks to
> Andrei
> Belov and Nginx.
>
> Further details on the compilation process can be found on the project
> README:
>  - https://github.com/SpiderLabs/ModSecurity-nginx/#compilation
>
> Complementary documentation on ModSecurity version 3 can be found here:
>  - https://github.com/SpiderLabs/ModSecurity/tree/v3/master
>
>
> Br.,
> Felipe "Zimmerle" Costa
> Security Researcher, Lead Developer ModSecurity
> -----BEGIN PGP SIGNATURE-----
> Comment: GPGTools - https://gpgtools.org
>
> iF0EARECAB0WIQQZDvrMoen6RmqOzZzm37CM6LESdwUCXffmMAAKCRDm37CM6LES
> dyDGAJ47wzvhMJFppClW9p4cgyU0a6pRWQCeKkIIAftRP7gQPX8zEEGsDPHSgXc=
> =zyck
> -----END PGP SIGNATURE-----
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

[mod-security-users] ModSecurity Nginx connector version 1.0.1 announcement

[Felipe Z. <fe...@zi...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Hi,

It is a pleasure to announce the release of version 1.0.1 for the ModSecurity
Nginx connector. This release contains bugfix and new features.

Most important changes:
 - Support to generate the request unique_id on nignx (Issue #126)
 - Several memory leaks fix (Issues #80, #100, #87)
 - Fix logging level (Issue #112, #88)
 - Fix processing of response body when gzip compression is enabled
   (Issue #107)

Full list of changes:
https://github.com/SpiderLabs/ModSecurity-nginx/blob/master/CHANGES

The version 1.0.1 can be downloaded straight from GitHub:
https://github.com/SpiderLabs/ModSecurity-nginx/releases/tag/v1.0.1/

The list of open issues is available on GitHub:
https://github.com/SpiderLabs/ModSecurity-nginx/issues?q=is%3Aissue+is%3Aopen

Thanks to everybody who helped in this process: reporting issues, making
comments and suggestions, sending patches, and so on. Special thanks to Andrei
Belov and Nginx.

Further details on the compilation process can be found on the project README:
 - https://github.com/SpiderLabs/ModSecurity-nginx/#compilation

Complementary documentation on ModSecurity version 3 can be found here:
 - https://github.com/SpiderLabs/ModSecurity/tree/v3/master


Br.,
Felipe "Zimmerle" Costa
Security Researcher, Lead Developer ModSecurity
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iF0EARECAB0WIQQZDvrMoen6RmqOzZzm37CM6LESdwUCXffmMAAKCRDm37CM6LES
dyDGAJ47wzvhMJFppClW9p4cgyU0a6pRWQCeKkIIAftRP7gQPX8zEEGsDPHSgXc=
=zyck
-----END PGP SIGNATURE-----

Re: [mod-security-users] Make rule log instead of block at runtime

[Dominik S. <Dom...@sy...>]

Hi Manuel,


thank you for your answer. I understand SecRuleUpdateActionById is a startup time directive and will change the action for all requests. I really want to do this only for specific requests at runtime, but cannot find a corresponding option for the ctl action. Is there a different way to achieve what I'm looking for?


Many thanks,
Dominik

Re: [mod-security-users] Make rule log instead of block at runtime

[Manuel S. <spa...@gm...>]

Hi Dominik you can use SecRuleUpdateActionById to modify rule action on preexistent rules without removing them.

Regards,
Manuel

Sent from my iPhone

> On Nov 20, 2019, at 5:20 AM, Dominik Strecker <Dom...@sy...> wrote:
> 
> Hi there,
> 
> I can whitelist a rule (e. g., from the CRS) for a specific URL like so:
> 
> SecRule REQUEST_URI "@beginsWith /fileupload/" "id:1920120,phase:1,nolog,pass,ctl:ruleRemoveById=920120"
> 
> Is there a way to not remove the rule entirely, but just make it log instead of block? The only way I found was to copy and doctor the entire rule, which is hard to maintain.
> 
> The use case is: Users sometimes upload files with weird names. I want to allow this, but still see it in the logs.
> 
> Many thanks,
> Dominik
> -- 
> Unsere Grundsätze zur Datenverarbeitung finden Sie unter: https://www.syracom.de/footernavi/grundsaetze-der-datenverarbeitung-bei-der-syracom-ag.html
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/