mod-security-users — General discussion about mod_security

Re: [mod-security-users] Website issues (modsecurity.org)

[Felipe Z. <fe...@zi...>]

My pleasure. Hope to see everything working soon.

Br.,
Felipe


On Tue, Aug 6, 2019 at 6:40 PM Christian Folini <chr...@ne...>
wrote:

> Thank you for your advice Felipe. I'll act accordingly.
>
> Cheers,
>
> Christian
>
> On Wed, Jul 31, 2019 at 10:40:14PM -0300, Felipe Zimmerle wrote:
> > Hi Folini,
> >
> > I am afraid I cannot help you on that matter because I was not part of
> > those discussions, I was not in the summit nor CC'ed in any of those
> > emails. I thought you guys had an agreement, my fault.
> >
> > My advice to you is to talk to the peers that you have already started a
> > discussion. So We can better understand the progress/status of those
> items.
> > Please put me in the loop, so I will be able to be more helpful.
> >
> > Br.,
> > Felipe.
> >
> >
> >
> > On Wed, Jul 31, 2019 at 4:56 PM Christian Folini <
> > chr...@ne...> wrote:
> >
> > > Hello Felipe,
> > >
> > > On Wed, Jul 31, 2019 at 01:34:02PM -0300, Felipe Zimmerle wrote:
> > > > In regarding the content of the website. if I am not mistaken, you
> had a
> > > > discussion with Ziv Mador (Responsible for ModSecurity project on
> > > > Trustwave) about that matter and you guys came to an agreement on
> it, am
> > > I
> > > > right?
> > >
> > > It has been years since I last talked to Ziv. I remember us
> disagreeing on
> > > the question of the separate website for the OWASP ModSecurity Core
> Rule
> > > Set
> > > project. I do not remember an agreement though. Please enlighten me,
> if you
> > > do.
> > >
> > > On the other hand, I remember Joe Hopp promising us to take care of
> this
> > > problem last Summer. All in all we have probably written up to a dozen
> of
> > > messages to several people at Trustwave to
> > >
> > > - have modsecurity.org/crs redirect to coreruleset.org
> > > - have the link in the subtitle of
> > >   https://github.com/SpiderLabs/owasp-modsecurity-crs
> > >   point to coreruleset.org instead of modsecurity.org/crs
> > >
> > > but without luck so far and most of the time without getting a
> response.
> > >
> > > It feels like Trustwave wants to punish the OWASP ModSecurity
> > > Core Rule Set project for taking the decision to create its own
> website.
> > > I do not know if this is the case, but I do not really see any reason
> > > why Trustwave would insist to keep people in the dark about the
> > > latest information about our project.
> > >
> > > We are running a blog on coreruleset.org. However, the people landing
> on
> > > modsecurity.org/crs won't see that blog ever. To name but one
> shortcoming.
> > >
> > > Cheers,
> > >
> > > Christian on behalf of the OWASP ModSecurity Core Rule Set project
> > >
> > >
> > > --
> > > I don't believe that we have come to the end of the democratic
> experiment.
> > > -- Bruce Schneier
> > >
> > >
> > > _______________________________________________
> > > mod-security-users mailing list
> > > mod...@li...
> > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > http://www.modsecurity.org/projects/commercial/rules/
> > > http://www.modsecurity.org/projects/commercial/support/
> > >
> >
> >
> > --
> > Br.,
> > Felipe Zimmerle
>
>
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>


-- 
Br.,
Felipe Zimmerle

Re: [mod-security-users] Website issues (modsecurity.org)

[Christian F. <chr...@ne...>]

Thank you for your advice Felipe. I'll act accordingly.

Cheers,

Christian

On Wed, Jul 31, 2019 at 10:40:14PM -0300, Felipe Zimmerle wrote:
> Hi Folini,
> 
> I am afraid I cannot help you on that matter because I was not part of
> those discussions, I was not in the summit nor CC'ed in any of those
> emails. I thought you guys had an agreement, my fault.
> 
> My advice to you is to talk to the peers that you have already started a
> discussion. So We can better understand the progress/status of those items.
> Please put me in the loop, so I will be able to be more helpful.
> 
> Br.,
> Felipe.
> 
> 
> 
> On Wed, Jul 31, 2019 at 4:56 PM Christian Folini <
> chr...@ne...> wrote:
> 
> > Hello Felipe,
> >
> > On Wed, Jul 31, 2019 at 01:34:02PM -0300, Felipe Zimmerle wrote:
> > > In regarding the content of the website. if I am not mistaken, you had a
> > > discussion with Ziv Mador (Responsible for ModSecurity project on
> > > Trustwave) about that matter and you guys came to an agreement on it, am
> > I
> > > right?
> >
> > It has been years since I last talked to Ziv. I remember us disagreeing on
> > the question of the separate website for the OWASP ModSecurity Core Rule
> > Set
> > project. I do not remember an agreement though. Please enlighten me, if you
> > do.
> >
> > On the other hand, I remember Joe Hopp promising us to take care of this
> > problem last Summer. All in all we have probably written up to a dozen of
> > messages to several people at Trustwave to
> >
> > - have modsecurity.org/crs redirect to coreruleset.org
> > - have the link in the subtitle of
> >   https://github.com/SpiderLabs/owasp-modsecurity-crs
> >   point to coreruleset.org instead of modsecurity.org/crs
> >
> > but without luck so far and most of the time without getting a response.
> >
> > It feels like Trustwave wants to punish the OWASP ModSecurity
> > Core Rule Set project for taking the decision to create its own website.
> > I do not know if this is the case, but I do not really see any reason
> > why Trustwave would insist to keep people in the dark about the
> > latest information about our project.
> >
> > We are running a blog on coreruleset.org. However, the people landing on
> > modsecurity.org/crs won't see that blog ever. To name but one shortcoming.
> >
> > Cheers,
> >
> > Christian on behalf of the OWASP ModSecurity Core Rule Set project
> >
> >
> > --
> > I don't believe that we have come to the end of the democratic experiment.
> > -- Bruce Schneier
> >
> >
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
> >
> 
> 
> -- 
> Br.,
> Felipe Zimmerle


> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] Website issues (modsecurity.org)

[Felipe Z. <fe...@zi...>]

Hi Folini,

I am afraid I cannot help you on that matter because I was not part of
those discussions, I was not in the summit nor CC'ed in any of those
emails. I thought you guys had an agreement, my fault.

My advice to you is to talk to the peers that you have already started a
discussion. So We can better understand the progress/status of those items.
Please put me in the loop, so I will be able to be more helpful.

Br.,
Felipe.



On Wed, Jul 31, 2019 at 4:56 PM Christian Folini <
chr...@ne...> wrote:

> Hello Felipe,
>
> On Wed, Jul 31, 2019 at 01:34:02PM -0300, Felipe Zimmerle wrote:
> > In regarding the content of the website. if I am not mistaken, you had a
> > discussion with Ziv Mador (Responsible for ModSecurity project on
> > Trustwave) about that matter and you guys came to an agreement on it, am
> I
> > right?
>
> It has been years since I last talked to Ziv. I remember us disagreeing on
> the question of the separate website for the OWASP ModSecurity Core Rule
> Set
> project. I do not remember an agreement though. Please enlighten me, if you
> do.
>
> On the other hand, I remember Joe Hopp promising us to take care of this
> problem last Summer. All in all we have probably written up to a dozen of
> messages to several people at Trustwave to
>
> - have modsecurity.org/crs redirect to coreruleset.org
> - have the link in the subtitle of
>   https://github.com/SpiderLabs/owasp-modsecurity-crs
>   point to coreruleset.org instead of modsecurity.org/crs
>
> but without luck so far and most of the time without getting a response.
>
> It feels like Trustwave wants to punish the OWASP ModSecurity
> Core Rule Set project for taking the decision to create its own website.
> I do not know if this is the case, but I do not really see any reason
> why Trustwave would insist to keep people in the dark about the
> latest information about our project.
>
> We are running a blog on coreruleset.org. However, the people landing on
> modsecurity.org/crs won't see that blog ever. To name but one shortcoming.
>
> Cheers,
>
> Christian on behalf of the OWASP ModSecurity Core Rule Set project
>
>
> --
> I don't believe that we have come to the end of the democratic experiment.
> -- Bruce Schneier
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>


-- 
Br.,
Felipe Zimmerle

Re: [mod-security-users] Website issues (modsecurity.org)

[Christian F. <chr...@ne...>]

Hello Felipe,

On Wed, Jul 31, 2019 at 01:34:02PM -0300, Felipe Zimmerle wrote:
> In regarding the content of the website. if I am not mistaken, you had a
> discussion with Ziv Mador (Responsible for ModSecurity project on
> Trustwave) about that matter and you guys came to an agreement on it, am I
> right?

It has been years since I last talked to Ziv. I remember us disagreeing on
the question of the separate website for the OWASP ModSecurity Core Rule Set
project. I do not remember an agreement though. Please enlighten me, if you
do.

On the other hand, I remember Joe Hopp promising us to take care of this
problem last Summer. All in all we have probably written up to a dozen of
messages to several people at Trustwave to

- have modsecurity.org/crs redirect to coreruleset.org
- have the link in the subtitle of 
  https://github.com/SpiderLabs/owasp-modsecurity-crs
  point to coreruleset.org instead of modsecurity.org/crs

but without luck so far and most of the time without getting a response.

It feels like Trustwave wants to punish the OWASP ModSecurity
Core Rule Set project for taking the decision to create its own website.
I do not know if this is the case, but I do not really see any reason
why Trustwave would insist to keep people in the dark about the
latest information about our project.

We are running a blog on coreruleset.org. However, the people landing on
modsecurity.org/crs won't see that blog ever. To name but one shortcoming.

Cheers,

Christian on behalf of the OWASP ModSecurity Core Rule Set project


-- 
I don't believe that we have come to the end of the democratic experiment.
-- Bruce Schneier

Re: [mod-security-users] Website issues (modsecurity.org)

[Felipe Z. <fe...@zi...>]

Hi Folini,

Sorry if I was not clear, the ones who are working on it is the IT team on
Trustwave. I don't have access to the CA to issue the certificate nor
update the certificate. That is up to Trustwave's IT department.

In regarding the content of the website. if I am not mistaken, you had a
discussion with Ziv Mador (Responsible for ModSecurity project on
Trustwave) about that matter and you guys came to an agreement on it, am I
right?

Br.,
Felipe.





On Wed, Jul 31, 2019 at 1:21 AM Christian Folini <
chr...@ne...> wrote:

> Hey Felipe,
>
> While you are at it, would you mind redirecting
> http://modsecurity.org/crs/
> to https://coreruleset.org? The page Trustwave is hosting is outdated and
> some
> of the information is too.
>
> We have a long standing "issue" concerning this
> https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/996
> and we'd like to be able to close it.
>
> Best,
>
> Christian, on behalf of the CRS team
>
>
> On Tue, Jul 30, 2019 at 07:41:53PM -0300, Felipe Zimmerle wrote:
> > Hi, Christopher
> >
> > Thank you for the report.
> >
> > Yes, Trustwave is the one in charge of the website. They are already
> aware
> > that that certificate is expired. IT department is taking care of it.
> >
> > Br.,
> > Felipe.
> >
> >
> >
> >
> > On Tue, Jul 30, 2019 at 7:07 PM Felipe Rocha <fel...@gm...>
> wrote:
> >
> > > Trustwave, I think.
> > >
> > > On Tue, Jul 30, 2019 at 6:58 PM Christopher Schultz <
> > > ch...@ch...> wrote:
> > >
> > >> Hi there,
> > >>
> > >> I went to look for something on the site and I found that the TLS
> > >> certificate has expired yesterday.
> > >>
> > >> I tried to check the mailing list archives but literally all of the
> > >> links to the archives are broken as well.
> > >>
> > >> Is anyone maintaining the web site?
> > >>
> > >> Thanks,
> > >> -chris
> > >>
> > >> _______________________________________________
> > >> mod-security-users mailing list
> > >> mod...@li...
> > >> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > >> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > >> http://www.modsecurity.org/projects/commercial/rules/
> > >> http://www.modsecurity.org/projects/commercial/support/
> > >>
> > > _______________________________________________
> > > mod-security-users mailing list
> > > mod...@li...
> > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > http://www.modsecurity.org/projects/commercial/rules/
> > > http://www.modsecurity.org/projects/commercial/support/
> > >
> >
> >
> > --
> > Br.,
> > Felipe Zimmerle
>
>
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>


-- 
Br.,
Felipe Zimmerle

Re: [mod-security-users] Website issues (modsecurity.org)

[Christian F. <chr...@ne...>]

Hey Felipe,

While you are at it, would you mind redirecting http://modsecurity.org/crs/
to https://coreruleset.org? The page Trustwave is hosting is outdated and some
of the information is too.

We have a long standing "issue" concerning this
https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/996
and we'd like to be able to close it.

Best,

Christian, on behalf of the CRS team


On Tue, Jul 30, 2019 at 07:41:53PM -0300, Felipe Zimmerle wrote:
> Hi, Christopher
> 
> Thank you for the report.
> 
> Yes, Trustwave is the one in charge of the website. They are already aware
> that that certificate is expired. IT department is taking care of it.
> 
> Br.,
> Felipe.
> 
> 
> 
> 
> On Tue, Jul 30, 2019 at 7:07 PM Felipe Rocha <fel...@gm...> wrote:
> 
> > Trustwave, I think.
> >
> > On Tue, Jul 30, 2019 at 6:58 PM Christopher Schultz <
> > ch...@ch...> wrote:
> >
> >> Hi there,
> >>
> >> I went to look for something on the site and I found that the TLS
> >> certificate has expired yesterday.
> >>
> >> I tried to check the mailing list archives but literally all of the
> >> links to the archives are broken as well.
> >>
> >> Is anyone maintaining the web site?
> >>
> >> Thanks,
> >> -chris
> >>
> >> _______________________________________________
> >> mod-security-users mailing list
> >> mod...@li...
> >> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> >> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> >> http://www.modsecurity.org/projects/commercial/rules/
> >> http://www.modsecurity.org/projects/commercial/support/
> >>
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
> >
> 
> 
> -- 
> Br.,
> Felipe Zimmerle


> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] Website issues (modsecurity.org)

[Felipe Z. <fe...@zi...>]

Hi, Christopher

Thank you for the report.

Yes, Trustwave is the one in charge of the website. They are already aware
that that certificate is expired. IT department is taking care of it.

Br.,
Felipe.




On Tue, Jul 30, 2019 at 7:07 PM Felipe Rocha <fel...@gm...> wrote:

> Trustwave, I think.
>
> On Tue, Jul 30, 2019 at 6:58 PM Christopher Schultz <
> ch...@ch...> wrote:
>
>> Hi there,
>>
>> I went to look for something on the site and I found that the TLS
>> certificate has expired yesterday.
>>
>> I tried to check the mailing list archives but literally all of the
>> links to the archives are broken as well.
>>
>> Is anyone maintaining the web site?
>>
>> Thanks,
>> -chris
>>
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>


-- 
Br.,
Felipe Zimmerle

Re: [mod-security-users] Website issues (modsecurity.org)

[Felipe R. <fel...@gm...>]

Trustwave, I think.

On Tue, Jul 30, 2019 at 6:58 PM Christopher Schultz <
ch...@ch...> wrote:

> Hi there,
>
> I went to look for something on the site and I found that the TLS
> certificate has expired yesterday.
>
> I tried to check the mailing list archives but literally all of the
> links to the archives are broken as well.
>
> Is anyone maintaining the web site?
>
> Thanks,
> -chris
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

[mod-security-users] Website issues (modsecurity.org)

[Christopher S. <ch...@ch...>]

Hi there,

I went to look for something on the site and I found that the TLS
certificate has expired yesterday.

I tried to check the mailing list archives but literally all of the
links to the archives are broken as well.

Is anyone maintaining the web site?

Thanks,
-chris

Re: [mod-security-users] mod-security-users Digest, Vol 158, Issue 6

[Reindl H. <h.r...@th...>]

Am 13.07.19 um 01:37 schrieb Penetration:
> Hello
> you can set SecStatusEngine to On./ in .htaccess or httpd.conf (global
> config)
> please send the result of this command
> #httpd -M
> thanks

besides that either you subscribe regulary instead reply to digest mails
which makes everything a mess (starting with the subject and threading)
or just read only:

the oiginal subject was "ModSecurity disabled?" and hecne i responded
"you don't need it and it has *nothing* to do with modsecurity disabled"
days ago

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/introducing-modsecurity-status-reporting/

> On Fri, Jul 12, 2019 at 4:45 PM
> <mod...@li...
> <mailto:mod...@li...>> wrote:
> 
>     Send mod-security-users mailing list submissions to
>             mod...@li...
>     <mailto:mod...@li...>
> 
>     To subscribe or unsubscribe via the World Wide Web, visit
>             https://lists.sourceforge.net/lists/listinfo/mod-security-users
>     or, via email, send a message with subject or body 'help' to
>             mod...@li...
>     <mailto:mod...@li...>
> 
>     You can reach the person managing the list at
>             mod...@li...
>     <mailto:mod...@li...>
> 
>     When replying, please edit your Subject line so it is more specific
>     than "Re: Contents of mod-security-users digest..."
> 
> 
>     Today's Topics:
> 
>        1. ModSecurity disabled ? (Edouard Guign?)
>        2. Re: ModSecurity disabled ? (Reindl Harald)
> 
> 
>     ----------------------------------------------------------------------
> 
>     Message: 1
>     Date: Thu, 11 Jul 2019 14:57:26 -0300
>     From: Edouard Guign? <eg...@pa...
>     <mailto:eg...@pa...>>
>     To: mod...@li...
>     <mailto:mod...@li...>
>     Subject: [mod-security-users] ModSecurity disabled ?
>     Message-ID: <3ae...@pa...
>     <mailto:3ae...@pa...>>
>     Content-Type: text/plain; charset="utf-8"; Format="flowed"
> 
>     Hello,
> 
>     I set mod_sec with apache.
> 
>     When I start apache service, I noticed :
> 
>     /ModSecurity: Status engine is currently disabled, enable it by set
>     SecStatusEngine to On./
> 
>     What does it mean ?
>     Do I have to add? SecStatusEngine directive in httpd.conf ?
>     I am using virtual host conf file, as reverse proxy.
> 
>     Best Regards,
> 
>     EdG
> 
>     -------------- next part --------------
>     An HTML attachment was scrubbed...
> 
>     ------------------------------
> 
>     Message: 2
>     Date: Thu, 11 Jul 2019 20:23:04 +0200
>     From: Reindl Harald <h.r...@th...
>     <mailto:h.r...@th...>>
>     To: mod...@li...
>     <mailto:mod...@li...>
>     Subject: Re: [mod-security-users] ModSecurity disabled ?
>     Message-ID: <740...@th...
>     <mailto:740...@th...>>
>     Content-Type: text/plain; charset=utf-8
> 
> 
> 
>     Am 11.07.19 um 19:57 schrieb Edouard Guign?:
>     > I set mod_sec with apache.
>     >
>     > When I start apache service, I noticed :
>     >
>     > /ModSecurity: Status engine is currently disabled, enable it by set
>     > SecStatusEngine to On./
>     >
>     > What does it mean ?
>     > Do I have to add? SecStatusEngine directive in httpd.conf ?
>     > I am using virtual host conf file, as reverse proxy.
> 
>     you don't need it and it has *nothing* to do with "modsecurity disabled"
> 
>     https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/introducing-modsecurity-status-reporting/

[mod-security-users] [Fwd: Re: mod-security-users Digest, Vol 158, Issue 6]

[<eg...@pa...>]

Hello,

I apologize, but I need more informations about you before answer you
about this.
Who are you ? And what is your relation with mod-security ?
According Reindl Harald "I don't need" to set SecStatusEngine to On

Best Regards


---------------------------- Message original ----------------------------
Objet:    Re: [mod-security-users] mod-security-users Digest, Vol 158,
Issue 6
De:       "Penetration" <pen...@se...>
Date:     Ven 12 juillet 2019 20:37
À:       "mod-security-users" <mod...@li...>
--------------------------------------------------------------------------

Hello
you can set SecStatusEngine to On./ in .htaccess or httpd.conf (global
config)
please send the result of this command
#httpd -M
thanks

On Fri, Jul 12, 2019 at 4:45 PM <
mod...@li...> wrote:

> Send mod-security-users mailing list submissions to
>         mod...@li...
>
> To subscribe or unsubscribe via the World Wide Web, visit
>         https://lists.sourceforge.net/lists/listinfo/mod-security-users
> or, via email, send a message with subject or body 'help' to
>         mod...@li...
>
> You can reach the person managing the list at
>         mod...@li...
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of mod-security-users digest..."
>
>
> Today's Topics:
>
>    1. ModSecurity disabled ? (Edouard Guign?)
>    2. Re: ModSecurity disabled ? (Reindl Harald)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Thu, 11 Jul 2019 14:57:26 -0300
> From: Edouard Guign? <eg...@pa...>
> To: mod...@li...
> Subject: [mod-security-users] ModSecurity disabled ?
> Message-ID: <3ae...@pa...>
> Content-Type: text/plain; charset="utf-8"; Format="flowed"
>
> Hello,
>
> I set mod_sec with apache.
>
> When I start apache service, I noticed :
>
> /ModSecurity: Status engine is currently disabled, enable it by set
> SecStatusEngine to On./
>
> What does it mean ?
> Do I have to add? SecStatusEngine directive in httpd.conf ?
> I am using virtual host conf file, as reverse proxy.
>
> Best Regards,
>
> EdG
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
>
> ------------------------------
>
> Message: 2
> Date: Thu, 11 Jul 2019 20:23:04 +0200
> From: Reindl Harald <h.r...@th...>
> To: mod...@li...
> Subject: Re: [mod-security-users] ModSecurity disabled ?
> Message-ID: <740...@th...>
> Content-Type: text/plain; charset=utf-8
>
>
>
> Am 11.07.19 um 19:57 schrieb Edouard Guign?:
> > I set mod_sec with apache.
> >
> > When I start apache service, I noticed :
> >
> > /ModSecurity: Status engine is currently disabled, enable it by set
> > SecStatusEngine to On./
> >
> > What does it mean ?
> > Do I have to add? SecStatusEngine directive in httpd.conf ?
> > I am using virtual host conf file, as reverse proxy.
>
> you don't need it and it has *nothing* to do with "modsecurity disabled"
>
>
> https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/introducing-modsecurity-status-reporting/
>
>
>
> ------------------------------
>
>
>
> ------------------------------
>
> Subject: Digest Footer
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>
>
> ------------------------------
>
> End of mod-security-users Digest, Vol 158, Issue 6
> **************************************************
>
_______________________________________________
mod-security-users mailing list
mod...@li...
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] mod-security-users Digest, Vol 158, Issue 6

[Penetration <pen...@se...>]

Hello
you can set SecStatusEngine to On./ in .htaccess or httpd.conf (global
config)
please send the result of this command
#httpd -M
thanks

On Fri, Jul 12, 2019 at 4:45 PM <
mod...@li...> wrote:

> Send mod-security-users mailing list submissions to
>         mod...@li...
>
> To subscribe or unsubscribe via the World Wide Web, visit
>         https://lists.sourceforge.net/lists/listinfo/mod-security-users
> or, via email, send a message with subject or body 'help' to
>         mod...@li...
>
> You can reach the person managing the list at
>         mod...@li...
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of mod-security-users digest..."
>
>
> Today's Topics:
>
>    1. ModSecurity disabled ? (Edouard Guign?)
>    2. Re: ModSecurity disabled ? (Reindl Harald)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Thu, 11 Jul 2019 14:57:26 -0300
> From: Edouard Guign? <eg...@pa...>
> To: mod...@li...
> Subject: [mod-security-users] ModSecurity disabled ?
> Message-ID: <3ae...@pa...>
> Content-Type: text/plain; charset="utf-8"; Format="flowed"
>
> Hello,
>
> I set mod_sec with apache.
>
> When I start apache service, I noticed :
>
> /ModSecurity: Status engine is currently disabled, enable it by set
> SecStatusEngine to On./
>
> What does it mean ?
> Do I have to add? SecStatusEngine directive in httpd.conf ?
> I am using virtual host conf file, as reverse proxy.
>
> Best Regards,
>
> EdG
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
>
> ------------------------------
>
> Message: 2
> Date: Thu, 11 Jul 2019 20:23:04 +0200
> From: Reindl Harald <h.r...@th...>
> To: mod...@li...
> Subject: Re: [mod-security-users] ModSecurity disabled ?
> Message-ID: <740...@th...>
> Content-Type: text/plain; charset=utf-8
>
>
>
> Am 11.07.19 um 19:57 schrieb Edouard Guign?:
> > I set mod_sec with apache.
> >
> > When I start apache service, I noticed :
> >
> > /ModSecurity: Status engine is currently disabled, enable it by set
> > SecStatusEngine to On./
> >
> > What does it mean ?
> > Do I have to add? SecStatusEngine directive in httpd.conf ?
> > I am using virtual host conf file, as reverse proxy.
>
> you don't need it and it has *nothing* to do with "modsecurity disabled"
>
>
> https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/introducing-modsecurity-status-reporting/
>
>
>
> ------------------------------
>
>
>
> ------------------------------
>
> Subject: Digest Footer
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>
>
> ------------------------------
>
> End of mod-security-users Digest, Vol 158, Issue 6
> **************************************************
>

Re: [mod-security-users] ModSecurity disabled ?

[Reindl H. <h.r...@th...>]

Am 11.07.19 um 19:57 schrieb Edouard Guigné:
> I set mod_sec with apache.
> 
> When I start apache service, I noticed :
> 
> /ModSecurity: Status engine is currently disabled, enable it by set
> SecStatusEngine to On./
> 
> What does it mean ?
> Do I have to add  SecStatusEngine directive in httpd.conf ?
> I am using virtual host conf file, as reverse proxy.

you don't need it and it has *nothing* to do with "modsecurity disabled"

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/introducing-modsecurity-status-reporting/

[mod-security-users] ModSecurity disabled ?

[Edouard G. <eg...@pa...>]

Hello,

I set mod_sec with apache.

When I start apache service, I noticed :

/ModSecurity: Status engine is currently disabled, enable it by set 
SecStatusEngine to On./

What does it mean ?
Do I have to add  SecStatusEngine directive in httpd.conf ?
I am using virtual host conf file, as reverse proxy.

Best Regards,

EdG

Re: [mod-security-users] Varnish modsecurity binding

[Reindl H. <h.r...@th...>]

Am 07.07.19 um 18:26 schrieb Ted Talaiti:
> stop your mail please

this is a pretty dumb response to a link how to unsubscribe days ago
instead stop *your* list spamming and unsubsribe like everybody but you
is capable to do

mailto:mod...@li...?subject=unsubscribe

> ------------------------------------------------------------------------
> *From:* Ervin Hegedüs <ai...@gm...>
> *Sent:* Wednesday, July 3, 2019 9:47 AM
> *To:* mod...@li...
> *Subject:* Re: [mod-security-users] Varnish modsecurity binding
>  
> On Wed, Jul 03, 2019 at 08:09:55AM +0000, Ted Talaiti wrote:
>> 
>> stop your mail please
> 
> please review this page:
> 
> https://sourceforge.net/projects/mod-security/lists/mod-security-users/unsubscribe
> 
> enter your e-mail address, and see what happens...

Re: [mod-security-users] Varnish modsecurity binding

[Ted T. <tal...@ho...>]

stop your mail please

________________________________
From: Ervin Hegedüs <ai...@gm...>
Sent: Wednesday, July 3, 2019 9:47 AM
To: mod...@li...
Subject: Re: [mod-security-users] Varnish modsecurity binding

On Wed, Jul 03, 2019 at 08:09:55AM +0000, Ted Talaiti wrote:
>
> stop your mail please

please review this page:

https://sourceforge.net/projects/mod-security/lists/mod-security-users/unsubscribe

enter your e-mail address, and see what happens...



Regards,


a.



_______________________________________________
mod-security-users mailing list
mod...@li...
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] Varnish modsecurity binding

[Felipe Z. <fe...@zi...>]

Hi Xavier,

Thank you for the effort on that. I am sure that is a precious addition to
the libModSecurity family.

I am delighted to see the bindings and how the community is fastly growing
around libModSecurity. It is terrific to see people from the community
engaged in contributing. Currently, we also have bindings for Python that
is also maintained by the community -

https://github.com/actions-security/pymodsecurity

For me, this means a lot; The possibility of extendability (by bindings and
others) was discussed back on the decision to move forward and create
version 3 [
http://blog.zimmerle.org/2016/01/an-overview-of-upcoming-libmodsecurity.html
].

So, thank you ;)

I have added your project to libModSecurity README file -
https://github.com/SpiderLabs/ModSecurity/blob/v3/master/README.md#bindings


Br.,
Felipe

On Mon, Jul 1, 2019 at 2:15 PM Xavier De Cock <xd...@gm...> wrote:

> Hello,
>
> As the use case became apparent in a company i work for, i've implemented
> a small binding for the varnish proxy software. This should be considered a
> proof of concept between alpha and beta quality.
>
> However to be able to stabilise the vmod, tests will prove useful.
>
> As with all project i recommend you yo test it on a staging env if
> possible, review the code.
>
> Doc, test coverage & so on are still ongoing. But i'll be happy to take
> any feedback and help make a contribution that will help other users.
>
> Currently most of it is ok, the body handling still need a more efficient
> way of being done ( via varnish delivery (6.2) or fetch processor(6.1). But
> i'm still searching for a way to access request privates variables.
>
> Thanks a lot for your attention and help.
>
> Regards,
>
> Xavier
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>


-- 
Br.,
Felipe Zimmerle

Re: [mod-security-users] Varnish modsecurity binding

[Ervin H. <ai...@gm...>]

On Wed, Jul 03, 2019 at 08:09:55AM +0000, Ted Talaiti wrote:
> 
> stop your mail please

please review this page:

https://sourceforge.net/projects/mod-security/lists/mod-security-users/unsubscribe

enter your e-mail address, and see what happens...



Regards,


a.
 

Re: [mod-security-users] Varnish modsecurity binding

[Ted T. <tal...@ho...>]

stop your mail please

________________________________
From: Xavier De Cock <xd...@gm...>
Sent: Monday, July 1, 2019 5:34 PM
To: mod...@li...
Subject: Re: [mod-security-users] Varnish modsecurity binding

And that's what i forgot :)

https://github.com/xdecock/vmod-modsecurity

The doc is readabke in the src/*.vcc

Le lun. 1 juil. 2019 à 19:22, Christian Folini <chr...@ne...<mailto:chr...@ne...>> a écrit :
Hello Xavier,

This sounds interesting. Do you have a link perhaps?

Ahoj,

Christian

On Mon, Jul 01, 2019 at 07:15:18PM +0200, Xavier De Cock wrote:
> Hello,
>
> As the use case became apparent in a company i work for, i've implemented a
> small binding for the varnish proxy software. This should be considered a
> proof of concept between alpha and beta quality.
>
> However to be able to stabilise the vmod, tests will prove useful.
>
> As with all project i recommend you yo test it on a staging env if
> possible, review the code.
>
> Doc, test coverage & so on are still ongoing. But i'll be happy to take any
> feedback and help make a contribution that will help other users.
>
> Currently most of it is ok, the body handling still need a more efficient
> way of being done ( via varnish delivery (6.2) or fetch processor(6.1). But
> i'm still searching for a way to access request privates variables.
>
> Thanks a lot for your attention and help.
>
> Regards,
>
> Xavier


> _______________________________________________
> mod-security-users mailing list
> mod...@li...<mailto:mod...@li...>
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/



_______________________________________________
mod-security-users mailing list
mod...@li...<mailto:mod...@li...>
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] Varnish modsecurity binding

[Xavier De C. <xd...@gm...>]

And that's what i forgot :)

https://github.com/xdecock/vmod-modsecurity

The doc is readabke in the src/*.vcc

Le lun. 1 juil. 2019 à 19:22, Christian Folini <chr...@ne...>
a écrit :

> Hello Xavier,
>
> This sounds interesting. Do you have a link perhaps?
>
> Ahoj,
>
> Christian
>
> On Mon, Jul 01, 2019 at 07:15:18PM +0200, Xavier De Cock wrote:
> > Hello,
> >
> > As the use case became apparent in a company i work for, i've
> implemented a
> > small binding for the varnish proxy software. This should be considered a
> > proof of concept between alpha and beta quality.
> >
> > However to be able to stabilise the vmod, tests will prove useful.
> >
> > As with all project i recommend you yo test it on a staging env if
> > possible, review the code.
> >
> > Doc, test coverage & so on are still ongoing. But i'll be happy to take
> any
> > feedback and help make a contribution that will help other users.
> >
> > Currently most of it is ok, the body handling still need a more efficient
> > way of being done ( via varnish delivery (6.2) or fetch processor(6.1).
> But
> > i'm still searching for a way to access request privates variables.
> >
> > Thanks a lot for your attention and help.
> >
> > Regards,
> >
> > Xavier
>
>
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Re: [mod-security-users] Varnish modsecurity binding

[Christian F. <chr...@ne...>]

Hello Xavier,

This sounds interesting. Do you have a link perhaps?

Ahoj,

Christian

On Mon, Jul 01, 2019 at 07:15:18PM +0200, Xavier De Cock wrote:
> Hello,
> 
> As the use case became apparent in a company i work for, i've implemented a
> small binding for the varnish proxy software. This should be considered a
> proof of concept between alpha and beta quality.
> 
> However to be able to stabilise the vmod, tests will prove useful.
> 
> As with all project i recommend you yo test it on a staging env if
> possible, review the code.
> 
> Doc, test coverage & so on are still ongoing. But i'll be happy to take any
> feedback and help make a contribution that will help other users.
> 
> Currently most of it is ok, the body handling still need a more efficient
> way of being done ( via varnish delivery (6.2) or fetch processor(6.1). But
> i'm still searching for a way to access request privates variables.
> 
> Thanks a lot for your attention and help.
> 
> Regards,
> 
> Xavier


> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

[mod-security-users] Varnish modsecurity binding

[Xavier De C. <xd...@gm...>]

Hello,

As the use case became apparent in a company i work for, i've implemented a
small binding for the varnish proxy software. This should be considered a
proof of concept between alpha and beta quality.

However to be able to stabilise the vmod, tests will prove useful.

As with all project i recommend you yo test it on a staging env if
possible, review the code.

Doc, test coverage & so on are still ongoing. But i'll be happy to take any
feedback and help make a contribution that will help other users.

Currently most of it is ok, the body handling still need a more efficient
way of being done ( via varnish delivery (6.2) or fetch processor(6.1). But
i'm still searching for a way to access request privates variables.

Thanks a lot for your attention and help.

Regards,

Xavier

Re: [mod-security-users] OWASP ModSecurity Core Rule Set 3.1.1 released

[Ted T. <tal...@ho...>]

Hi
Please Unsubscribe me from the list
thanks


________________________________
From: Christian Folini <chr...@ne...>
Sent: Thursday, June 27, 2019 9:22 PM
To: mod...@li...; mod...@ow...
Subject: [mod-security-users] OWASP ModSecurity Core Rule Set 3.1.1 released

The OWASP ModSecurity Core Rule Set team is pleased to announce the CRS
release v3.1.1.

This is a minor release fixing a Regular Expression Denial of Service weakness
(CVE-2019-11387) as well as some minor bugs and false positives.

The CVE is only affecting users of the libModSecurity 3 release line and only
under special circumstances. However, we advise all users to upgrade to this
latest stable CRS release.

We have been notified of 5 ReDoS problems in our rules in April. Upon closer
inspection, only 1 of them proved real (the others were found in the naked
regular expression, not taking payload transformation and protection
mechanisms of the engine into consideration). Once this was established, we
had to fix the regex without changing the detection capabilities of the
affected rules. And this is what took us so long.

But here we are. This is replacement for 3.1.0 with almost identical behavior
(minus the ReDoS and a few other fixes). As always with point releases, there
are no new rules and an update should thus be smooth and should not bring any
new false positives.

CRS 3.1 requires an Apache/IIS/NGINX web server with ModSecurity 2.8.0 or
higher. CRS 3.1 will run on libModSecurity 3.0 on NGINX.

Our GitHub repository is the preferred way to download and update CRS:

$> wget
https://github.com/SpiderLabs/owasp-modsecurity-crs/archive/v3.1.1.tar.gz

For detailed installation instructions, see the INSTALL document.
https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.1/dev/INSTALL

Sincerely.

Chaim Sanders, Walter Hop and Christian Folini on behalf of the OWASP
ModSecurity Core Rule Set development team

--
https://coreruleset.org - Follow us on twitter via @CoreRuleSet


_______________________________________________
mod-security-users mailing list
mod...@li...
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

[mod-security-users] OWASP ModSecurity Core Rule Set 3.1.1 released

[Christian F. <chr...@ne...>]

The OWASP ModSecurity Core Rule Set team is pleased to announce the CRS
release v3.1.1.

This is a minor release fixing a Regular Expression Denial of Service weakness
(CVE-2019-11387) as well as some minor bugs and false positives.

The CVE is only affecting users of the libModSecurity 3 release line and only
under special circumstances. However, we advise all users to upgrade to this
latest stable CRS release.

We have been notified of 5 ReDoS problems in our rules in April. Upon closer
inspection, only 1 of them proved real (the others were found in the naked
regular expression, not taking payload transformation and protection
mechanisms of the engine into consideration). Once this was established, we
had to fix the regex without changing the detection capabilities of the
affected rules. And this is what took us so long.

But here we are. This is replacement for 3.1.0 with almost identical behavior
(minus the ReDoS and a few other fixes). As always with point releases, there
are no new rules and an update should thus be smooth and should not bring any
new false positives.

CRS 3.1 requires an Apache/IIS/NGINX web server with ModSecurity 2.8.0 or
higher. CRS 3.1 will run on libModSecurity 3.0 on NGINX.

Our GitHub repository is the preferred way to download and update CRS:

$> wget
https://github.com/SpiderLabs/owasp-modsecurity-crs/archive/v3.1.1.tar.gz

For detailed installation instructions, see the INSTALL document.
https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.1/dev/INSTALL

Sincerely.

Chaim Sanders, Walter Hop and Christian Folini on behalf of the OWASP
ModSecurity Core Rule Set development team

-- 
https://coreruleset.org - Follow us on twitter via @CoreRuleSet

Re: [mod-security-users] mod_security2 incomplete output

[Chaim S. <ch...@ch...>]

Please feel free to open a ticket on ModSecurity's github page.

On Wed, Jun 19, 2019 at 3:48 AM Joachim Zauner <j.z...@ep...> wrote:

> Hi,
> i have started to test mod_security2 on openSuSE 42.3 some time ago. I
> ran into a problem with incomplete output of the webpages (on Apache
> with mod_php7). Once i disabled mod_security2, everything is fine again.
> I tested the same on a new Server with newer openSuSE Release (15.1)
> with all updates installed. Now i use php-fpm to serve PHP Content. I
> still encounter the same problem. The error occures not on every Request
> but on ~ 10%. I can reproduce by refreshing the same script. Also, the
> Apache child process crashes with a Segmentation fault. Tested with
> Apache prefork and event MPM.
>
> System:
>      - openSuSE 15.1
>      - Apache 2.4.33
>      - mod_security2 2.9.2
>
> I currently use the default configuration without any activated rules
> and "SecRuleEngine DetectionOnly"
>
> Thank you
>
>
>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>


-- 
-- 
Chaim Sanders
http://www.ChaimSanders.com