mod-security-users — General discussion about mod_security

[mod-security-users] mod_security2 incomplete output

[Joachim Z. <j.z...@ep...>]

Hi,
i have started to test mod_security2 on openSuSE 42.3 some time ago. I 
ran into a problem with incomplete output of the webpages (on Apache 
with mod_php7). Once i disabled mod_security2, everything is fine again. 
I tested the same on a new Server with newer openSuSE Release (15.1) 
with all updates installed. Now i use php-fpm to serve PHP Content. I 
still encounter the same problem. The error occures not on every Request 
but on ~ 10%. I can reproduce by refreshing the same script. Also, the 
Apache child process crashes with a Segmentation fault. Tested with 
Apache prefork and event MPM.

System:
     - openSuSE 15.1
     - Apache 2.4.33
     - mod_security2 2.9.2

I currently use the default configuration without any activated rules 
and "SecRuleEngine DetectionOnly"

Thank you

Re: [mod-security-users] modsecurity is blocking bing & yahoo in windows plesk

[Joost K. <cho...@gm...>]

Received feedback from Atomicorp:

“Thank you for the report, its looks like Microsoft hasnt setup any DNS records for those ranges and is using new IP ranges for Bingbot.    We've just released an update that will address this change in their DNS practices.”

I’ll check in a few days if this will unblock the requests from Bingbot

Joost





> On 17 Jun 2019, at 23:40, Joost Kouwenberg <cho...@gm...> wrote:
> 
> Thanks Chaim, I’ll disable rule 303801 for now and contact Amicorp support.
> 
> Cheers,
> Joost
> 
> 
> 
>> On 17 Jun 2019, at 23:14, Chaim Sanders <ch...@ch... <mailto:ch...@ch...>> wrote:
>> 
>> Ah, I see -- thank you for the detail. You can certainly disable rule 303801 by adding something like `SecRuleRemoveById 303801` to the end of your rules. I am unable to 'fix' the rules, as these are rules provided by Atomicorp. I'd recommend reaching out to their support to determine why they are blocking these bots or if they have some additional configuration capabilities. To be clear the OWASP CRS does not block these bots.
>> 
>> Thanks,
>> - Chaim
>> 
>> On Mon, Jun 17, 2019 at 3:11 PM Joost Kouwenberg <cho...@gm... <mailto:cho...@gm...>> wrote:
>> Hi Chaim,
>> 
>> Here are some examples of the log file where bingbots are blocked (there are many a day logged...):
>> 
>> 
>> --23480000-H--
>> Message: Warning. Match of "rx (^msnbot-[0-9]+-[0-9]+-[0-9]+-[0-9]+\\.search\\.msn\\.com$)" against "REMOTE_HOST" required. [file "C:\/Program Files (x86)/Plesk/ModSecurity/rules/tortix/modsec/00_asl_y_searchengines.conf"] [line "106"] [id "303801"] [rev "6"] [msg "Atomicorp.com <http://atomicorp.com/> WAF Rules: Fake msnbot/bingbot webcrawler"] [data ""]
>> Message: Warning. RBL lookup of 0.139.66.13.threat2.atomicrbl.com <http://threat2.atomicrbl.com/>. succeeded at REMOTE_ADDR. [file "C:\/Program Files (x86)/Plesk/ModSecurity/rules/tortix/modsec/99_asl_zzzz_threat_intelligence.conf"] [line "64"] [id "355501"] [rev "2"] [msg "Atomicorp.com <http://atomicorp.com/> WAF Rules: Threat Intelligence Match for Spamming Source on Atomicorp Threat Intelligence RBL (TI-2).  See this URL for details http://www.atomicrbl.com/lookup <http://www.atomicrbl.com/lookup>"] [severity "ERROR"] [tag "no_ar"]
>> Message: Warning. RBL lookup of 0.139.66.13.threat5.atomicrbl.com <http://threat5.atomicrbl.com/>. succeeded at REMOTE_ADDR. [file "C:\/Program Files (x86)/Plesk/ModSecurity/rules/tortix/modsec/99_asl_zzzz_threat_intelligence.conf"] [line "73"] [id "355506"] [rev "1"] [msg "Atomicorp.com <http://atomicorp.com/> WAF Rules: Threat Intelligence Match for Known multi event attacker Source on Atomicorp Threat Intelligence RBL.  See this URL for details http://www.atomicrbl.com/lookup <http://www.atomicrbl.com/lookup>"] [severity "ALERT"]
>> Apache-Handler: IIS
>> Stopwatch: 1560756427841805 207022 (- - -)
>> Stopwatch2: 1560756427841805 207022; combined=224046, p1=56045, p2=129961, p3=0, p4=0, p5=19020, sr=1018, sw=1032, l=0, gc=17988
>> Producer: ModSecurity for IIS (STABLE)/2.9.2 (http://www.modsecurity.org/ <http://www.modsecurity.org/>); 201404231529.
>> Server: ModSecurity Standalone
>> Engine-Mode: "DETECTION_ONLY"
>> 
>> --23480000-Z—
>> 
>> 
>> --325f0000-F--
>> HTTP/1.1 500 Internal Server Error
>> 
>> --325f0000-H--
>> Message: Warning. RBL lookup of 1.139.66.13.threat2.atomicrbl.com <http://threat2.atomicrbl.com/>. succeeded at REMOTE_ADDR. [file "C:\/Program Files (x86)/Plesk/ModSecurity/rules/tortix/modsec/99_asl_zzzz_threat_intelligence.conf"] [line "64"] [id "355501"] [rev "2"] [msg "Atomicorp.com <http://atomicorp.com/> WAF Rules: Threat Intelligence Match for Spamming Source on Atomicorp Threat Intelligence RBL (TI-2). See this URL for details http://www.atomicrbl.com/lookup <http://www.atomicrbl.com/lookup>"] [severity "ERROR"] [tag "no_ar"]
>> Apache-Handler: IIS
>> Stopwatch: 1560803751120054 343710 (- - -)
>> Stopwatch2: 1560803751120054 343710; combined=343710, p1=62492, p2=281218, p3=0, p4=0, p5=0, sr=0, sw=0, l=0, gc=0
>> Producer: ModSecurity for IIS (STABLE)/2.9.2 (http://www.modsecurity.org/ <http://www.modsecurity.org/>); 201404231529.
>> Server: ModSecurity Standalone
>> Engine-Mode: "DETECTION_ONLY"
>> 
>> --325f0000-Z--
>> 
>> --bb660000-A—
>> 
>> 
>> --f2260000-H--
>> Message: Warning. Match of "rx (^msnbot-[0-9]+-[0-9]+-[0-9]+-[0-9]+\\.search\\.msn\\.com$)" against "REMOTE_HOST" required. [file "C:\/Program Files (x86)/Plesk/ModSecurity/rules/tortix/modsec/00_asl_y_searchengines.conf"] [line "106"] [id "303801"] [rev "6"] [msg "Atomicorp.com <http://atomicorp.com/> WAF Rules: Fake msnbot/bingbot webcrawler"] [data ""]
>> Apache-Handler: IIS
>> Stopwatch: 1560766857301652 437503 (- - -)
>> Stopwatch2: 1560766857301652 437503; combined=0, p1=0, p2=0, p3=0, p4=0, p5=0, sr=0, sw=0, l=0, gc=0
>> Producer: ModSecurity for IIS (STABLE)/2.9.2 (http://www.modsecurity.org/ <http://www.modsecurity.org/>); 201404231529.
>> Server: ModSecurity Standalone
>> Engine-Mode: "DETECTION_ONLY"
>> 
>> --f2260000-Z—
>> 
>> 
>> Would the exception need to be created in a .conf file on the windows server or is it just a matter of switching off rule ID’s using the Plesk control panel ?
>> 
>> Thank you for your help.
>> 
>> Joost
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>>> On 17 Jun 2019, at 22:52, Chaim Sanders <ch...@ch... <mailto:ch...@ch...>> wrote:
>>> 
>>> Sure, if it is blocking it will have an ID of the rule that is blocking and we can help you write an exception and then take a look at why it is blocking to begin with. Check your error or audit( if enabled) logs.
>>> 
>>> On Mon, Jun 17, 2019 at 11:20 AM Joost Kouwenberg <cho...@gm... <mailto:cho...@gm...>> wrote:
>>> Hi,
>>> 
>>> For some reason Bing & yahoo bots are being blocked by modsecurity in Plesk12 on Windows server using “Advanced ModSecurity Rules by Atomicorp”, Google Bot have access.
>>> 
>>> Any thoughts how we can allow Bing & yahoo bots on the Windows Server using Plesk12?
>>> 
>>> Many thanks.
>>> 
>>> Joost
>>> 
>>> 
>>> _______________________________________________
>>> mod-security-users mailing list
>>> mod...@li... <mailto:mod...@li...>
>>> https://lists.sourceforge.net/lists/listinfo/mod-security-users <https://lists.sourceforge.net/lists/listinfo/mod-security-users>
>>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>>> http://www.modsecurity.org/projects/commercial/rules/ <http://www.modsecurity.org/projects/commercial/rules/>
>>> http://www.modsecurity.org/projects/commercial/support/ <http://www.modsecurity.org/projects/commercial/support/>
>>> 
>>> 
>>> -- 
>>> -- 
>>> Chaim Sanders
>>> http://www.ChaimSanders.com <http://www.chaimsanders.com/>
>>> _______________________________________________
>>> mod-security-users mailing list
>>> mod...@li... <mailto:mod...@li...>
>>> https://lists.sourceforge.net/lists/listinfo/mod-security-users <https://lists.sourceforge.net/lists/listinfo/mod-security-users>
>>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>>> http://www.modsecurity.org/projects/commercial/rules/ <http://www.modsecurity.org/projects/commercial/rules/>
>>> http://www.modsecurity.org/projects/commercial/support/ <http://www.modsecurity.org/projects/commercial/support/>
>> 
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li... <mailto:mod...@li...>
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users <https://lists.sourceforge.net/lists/listinfo/mod-security-users>
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/ <http://www.modsecurity.org/projects/commercial/rules/>
>> http://www.modsecurity.org/projects/commercial/support/ <http://www.modsecurity.org/projects/commercial/support/>
>> 
>> 
>> -- 
>> -- 
>> Chaim Sanders
>> http://www.ChaimSanders.com <http://www.chaimsanders.com/>
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li... <mailto:mod...@li...>
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
> 

Re: [mod-security-users] modsecurity is blocking bing & yahoo in windows plesk

[Joost K. <cho...@gm...>]

Thanks Chaim, I’ll disable rule 303801 for now and contact Amicorp support.

Cheers,
Joost



> On 17 Jun 2019, at 23:14, Chaim Sanders <ch...@ch...> wrote:
> 
> Ah, I see -- thank you for the detail. You can certainly disable rule 303801 by adding something like `SecRuleRemoveById 303801` to the end of your rules. I am unable to 'fix' the rules, as these are rules provided by Atomicorp. I'd recommend reaching out to their support to determine why they are blocking these bots or if they have some additional configuration capabilities. To be clear the OWASP CRS does not block these bots.
> 
> Thanks,
> - Chaim
> 
> On Mon, Jun 17, 2019 at 3:11 PM Joost Kouwenberg <cho...@gm... <mailto:cho...@gm...>> wrote:
> Hi Chaim,
> 
> Here are some examples of the log file where bingbots are blocked (there are many a day logged...):
> 
> 
> --23480000-H--
> Message: Warning. Match of "rx (^msnbot-[0-9]+-[0-9]+-[0-9]+-[0-9]+\\.search\\.msn\\.com$)" against "REMOTE_HOST" required. [file "C:\/Program Files (x86)/Plesk/ModSecurity/rules/tortix/modsec/00_asl_y_searchengines.conf"] [line "106"] [id "303801"] [rev "6"] [msg "Atomicorp.com <http://atomicorp.com/> WAF Rules: Fake msnbot/bingbot webcrawler"] [data ""]
> Message: Warning. RBL lookup of 0.139.66.13.threat2.atomicrbl.com <http://threat2.atomicrbl.com/>. succeeded at REMOTE_ADDR. [file "C:\/Program Files (x86)/Plesk/ModSecurity/rules/tortix/modsec/99_asl_zzzz_threat_intelligence.conf"] [line "64"] [id "355501"] [rev "2"] [msg "Atomicorp.com <http://atomicorp.com/> WAF Rules: Threat Intelligence Match for Spamming Source on Atomicorp Threat Intelligence RBL (TI-2).  See this URL for details http://www.atomicrbl.com/lookup <http://www.atomicrbl.com/lookup>"] [severity "ERROR"] [tag "no_ar"]
> Message: Warning. RBL lookup of 0.139.66.13.threat5.atomicrbl.com <http://threat5.atomicrbl.com/>. succeeded at REMOTE_ADDR. [file "C:\/Program Files (x86)/Plesk/ModSecurity/rules/tortix/modsec/99_asl_zzzz_threat_intelligence.conf"] [line "73"] [id "355506"] [rev "1"] [msg "Atomicorp.com <http://atomicorp.com/> WAF Rules: Threat Intelligence Match for Known multi event attacker Source on Atomicorp Threat Intelligence RBL.  See this URL for details http://www.atomicrbl.com/lookup <http://www.atomicrbl.com/lookup>"] [severity "ALERT"]
> Apache-Handler: IIS
> Stopwatch: 1560756427841805 207022 (- - -)
> Stopwatch2: 1560756427841805 207022; combined=224046, p1=56045, p2=129961, p3=0, p4=0, p5=19020, sr=1018, sw=1032, l=0, gc=17988
> Producer: ModSecurity for IIS (STABLE)/2.9.2 (http://www.modsecurity.org/ <http://www.modsecurity.org/>); 201404231529.
> Server: ModSecurity Standalone
> Engine-Mode: "DETECTION_ONLY"
> 
> --23480000-Z—
> 
> 
> --325f0000-F--
> HTTP/1.1 500 Internal Server Error
> 
> --325f0000-H--
> Message: Warning. RBL lookup of 1.139.66.13.threat2.atomicrbl.com <http://threat2.atomicrbl.com/>. succeeded at REMOTE_ADDR. [file "C:\/Program Files (x86)/Plesk/ModSecurity/rules/tortix/modsec/99_asl_zzzz_threat_intelligence.conf"] [line "64"] [id "355501"] [rev "2"] [msg "Atomicorp.com <http://atomicorp.com/> WAF Rules: Threat Intelligence Match for Spamming Source on Atomicorp Threat Intelligence RBL (TI-2). See this URL for details http://www.atomicrbl.com/lookup <http://www.atomicrbl.com/lookup>"] [severity "ERROR"] [tag "no_ar"]
> Apache-Handler: IIS
> Stopwatch: 1560803751120054 343710 (- - -)
> Stopwatch2: 1560803751120054 343710; combined=343710, p1=62492, p2=281218, p3=0, p4=0, p5=0, sr=0, sw=0, l=0, gc=0
> Producer: ModSecurity for IIS (STABLE)/2.9.2 (http://www.modsecurity.org/ <http://www.modsecurity.org/>); 201404231529.
> Server: ModSecurity Standalone
> Engine-Mode: "DETECTION_ONLY"
> 
> --325f0000-Z--
> 
> --bb660000-A—
> 
> 
> --f2260000-H--
> Message: Warning. Match of "rx (^msnbot-[0-9]+-[0-9]+-[0-9]+-[0-9]+\\.search\\.msn\\.com$)" against "REMOTE_HOST" required. [file "C:\/Program Files (x86)/Plesk/ModSecurity/rules/tortix/modsec/00_asl_y_searchengines.conf"] [line "106"] [id "303801"] [rev "6"] [msg "Atomicorp.com <http://atomicorp.com/> WAF Rules: Fake msnbot/bingbot webcrawler"] [data ""]
> Apache-Handler: IIS
> Stopwatch: 1560766857301652 437503 (- - -)
> Stopwatch2: 1560766857301652 437503; combined=0, p1=0, p2=0, p3=0, p4=0, p5=0, sr=0, sw=0, l=0, gc=0
> Producer: ModSecurity for IIS (STABLE)/2.9.2 (http://www.modsecurity.org/ <http://www.modsecurity.org/>); 201404231529.
> Server: ModSecurity Standalone
> Engine-Mode: "DETECTION_ONLY"
> 
> --f2260000-Z—
> 
> 
> Would the exception need to be created in a .conf file on the windows server or is it just a matter of switching off rule ID’s using the Plesk control panel ?
> 
> Thank you for your help.
> 
> Joost
> 
> 
> 
> 
> 
> 
> 
> 
>> On 17 Jun 2019, at 22:52, Chaim Sanders <ch...@ch... <mailto:ch...@ch...>> wrote:
>> 
>> Sure, if it is blocking it will have an ID of the rule that is blocking and we can help you write an exception and then take a look at why it is blocking to begin with. Check your error or audit( if enabled) logs.
>> 
>> On Mon, Jun 17, 2019 at 11:20 AM Joost Kouwenberg <cho...@gm... <mailto:cho...@gm...>> wrote:
>> Hi,
>> 
>> For some reason Bing & yahoo bots are being blocked by modsecurity in Plesk12 on Windows server using “Advanced ModSecurity Rules by Atomicorp”, Google Bot have access.
>> 
>> Any thoughts how we can allow Bing & yahoo bots on the Windows Server using Plesk12?
>> 
>> Many thanks.
>> 
>> Joost
>> 
>> 
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li... <mailto:mod...@li...>
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users <https://lists.sourceforge.net/lists/listinfo/mod-security-users>
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/ <http://www.modsecurity.org/projects/commercial/rules/>
>> http://www.modsecurity.org/projects/commercial/support/ <http://www.modsecurity.org/projects/commercial/support/>
>> 
>> 
>> -- 
>> -- 
>> Chaim Sanders
>> http://www.ChaimSanders.com <http://www.chaimsanders.com/>
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li... <mailto:mod...@li...>
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users <https://lists.sourceforge.net/lists/listinfo/mod-security-users>
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/ <http://www.modsecurity.org/projects/commercial/rules/>
>> http://www.modsecurity.org/projects/commercial/support/ <http://www.modsecurity.org/projects/commercial/support/>
> 
> _______________________________________________
> mod-security-users mailing list
> mod...@li... <mailto:mod...@li...>
> https://lists.sourceforge.net/lists/listinfo/mod-security-users <https://lists.sourceforge.net/lists/listinfo/mod-security-users>
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/ <http://www.modsecurity.org/projects/commercial/rules/>
> http://www.modsecurity.org/projects/commercial/support/ <http://www.modsecurity.org/projects/commercial/support/>
> 
> 
> -- 
> -- 
> Chaim Sanders
> http://www.ChaimSanders.com <http://www.chaimsanders.com/>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] modsecurity is blocking bing & yahoo in windows plesk

[Chaim S. <ch...@ch...>]

Ah, I see -- thank you for the detail. You can certainly disable rule
303801 by adding something like `SecRuleRemoveById 303801` to the end of
your rules. I am unable to 'fix' the rules, as these are rules provided by
Atomicorp. I'd recommend reaching out to their support to determine why
they are blocking these bots or if they have some additional configuration
capabilities. To be clear the OWASP CRS does not block these bots.

Thanks,
- Chaim

On Mon, Jun 17, 2019 at 3:11 PM Joost Kouwenberg <cho...@gm...>
wrote:

> Hi Chaim,
>
> Here are some examples of the log file where bingbots are blocked (there
> are many a day logged...):
>
>
> --23480000-H--
> Message: Warning. Match of "rx
> (^msnbot-[0-9]+-[0-9]+-[0-9]+-[0-9]+\\.search\\.msn\\.com$)" against
> "REMOTE_HOST" required. [file "C:\/Program Files
> (x86)/Plesk/ModSecurity/rules/tortix/modsec/00_asl_y_searchengines.conf"]
> [line "106"] [id "303801"] [rev "6"] [msg "Atomicorp.com WAF Rules: Fake
> msnbot/bingbot webcrawler"] [data ""]
> Message: Warning. RBL lookup of 0.139.66.13.threat2.atomicrbl.com.
> succeeded at REMOTE_ADDR. [file "C:\/Program Files
> (x86)/Plesk/ModSecurity/rules/tortix/modsec/99_asl_zzzz_threat_intelligence.conf"]
> [line "64"] [id "355501"] [rev "2"] [msg "Atomicorp.com WAF Rules: Threat
> Intelligence Match for Spamming Source on Atomicorp Threat Intelligence RBL
> (TI-2).  See this URL for details http://www.atomicrbl.com/lookup"]
> [severity "ERROR"] [tag "no_ar"]
> Message: Warning. RBL lookup of 0.139.66.13.threat5.atomicrbl.com.
> succeeded at REMOTE_ADDR. [file "C:\/Program Files
> (x86)/Plesk/ModSecurity/rules/tortix/modsec/99_asl_zzzz_threat_intelligence.conf"]
> [line "73"] [id "355506"] [rev "1"] [msg "Atomicorp.com WAF Rules: Threat
> Intelligence Match for Known multi event attacker Source on Atomicorp
> Threat Intelligence RBL.  See this URL for details
> http://www.atomicrbl.com/lookup"] [severity "ALERT"]
> Apache-Handler: IIS
> Stopwatch: 1560756427841805 207022 (- - -)
> Stopwatch2: 1560756427841805 207022; combined=224046, p1=56045, p2=129961,
> p3=0, p4=0, p5=19020, sr=1018, sw=1032, l=0, gc=17988
> Producer: ModSecurity for IIS (STABLE)/2.9.2 (http://www.modsecurity.org/);
> 201404231529.
> Server: ModSecurity Standalone
> Engine-Mode: "DETECTION_ONLY"
>
> --23480000-Z—
>
>
> --325f0000-F--
> HTTP/1.1 500 Internal Server Error
>
> --325f0000-H--
> Message: Warning. RBL lookup of 1.139.66.13.threat2.atomicrbl.com.
> succeeded at REMOTE_ADDR. [file "C:\/Program Files
> (x86)/Plesk/ModSecurity/rules/tortix/modsec/99_asl_zzzz_threat_intelligence.conf"]
> [line "64"] [id "355501"] [rev "2"] [msg "Atomicorp.com WAF Rules: Threat
> Intelligence Match for Spamming Source on Atomicorp Threat Intelligence RBL
> (TI-2). See this URL for details http://www.atomicrbl.com/lookup"]
> [severity "ERROR"] [tag "no_ar"]
> Apache-Handler: IIS
> Stopwatch: 1560803751120054 343710 (- - -)
> Stopwatch2: 1560803751120054 343710; combined=343710, p1=62492, p2=281218,
> p3=0, p4=0, p5=0, sr=0, sw=0, l=0, gc=0
> Producer: ModSecurity for IIS (STABLE)/2.9.2 (http://www.modsecurity.org/);
> 201404231529.
> Server: ModSecurity Standalone
> Engine-Mode: "DETECTION_ONLY"
>
> --325f0000-Z--
>
> --bb660000-A—
>
>
> --f2260000-H--
> Message: Warning. Match of "rx
> (^msnbot-[0-9]+-[0-9]+-[0-9]+-[0-9]+\\.search\\.msn\\.com$)" against
> "REMOTE_HOST" required. [file "C:\/Program Files
> (x86)/Plesk/ModSecurity/rules/tortix/modsec/00_asl_y_searchengines.conf"]
> [line "106"] [id "303801"] [rev "6"] [msg "Atomicorp.com WAF Rules: Fake
> msnbot/bingbot webcrawler"] [data ""]
> Apache-Handler: IIS
> Stopwatch: 1560766857301652 437503 (- - -)
> Stopwatch2: 1560766857301652 437503; combined=0, p1=0, p2=0, p3=0, p4=0,
> p5=0, sr=0, sw=0, l=0, gc=0
> Producer: ModSecurity for IIS (STABLE)/2.9.2 (http://www.modsecurity.org/);
> 201404231529.
> Server: ModSecurity Standalone
> Engine-Mode: "DETECTION_ONLY"
>
> --f2260000-Z—
>
>
> Would the exception need to be created in a .conf file on the windows
> server or is it just a matter of switching off rule ID’s using the Plesk
> control panel ?
>
> Thank you for your help.
>
> Joost
>
>
>
>
>
>
>
>
> On 17 Jun 2019, at 22:52, Chaim Sanders <ch...@ch...> wrote:
>
> Sure, if it is blocking it will have an ID of the rule that is blocking
> and we can help you write an exception and then take a look at why it is
> blocking to begin with. Check your error or audit( if enabled) logs.
>
> On Mon, Jun 17, 2019 at 11:20 AM Joost Kouwenberg <
> cho...@gm...> wrote:
>
>> Hi,
>>
>> For some reason Bing & yahoo bots are being blocked by modsecurity in
>> Plesk12 on Windows server using “Advanced ModSecurity Rules by Atomicorp”,
>> Google Bot have access.
>>
>> Any thoughts how we can allow Bing & yahoo bots on the Windows Server
>> using Plesk12?
>>
>> Many thanks.
>>
>> Joost
>>
>>
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>>
>
>
> --
> --
> Chaim Sanders
> http://www.ChaimSanders.com <http://www.chaimsanders.com/>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>


-- 
-- 
Chaim Sanders
http://www.ChaimSanders.com

Re: [mod-security-users] modsecurity is blocking bing & yahoo in windows plesk

[Joost K. <cho...@gm...>]

Hi Chaim,

Here are some examples of the log file where bingbots are blocked (there are many a day logged...):


--23480000-H--
Message: Warning. Match of "rx (^msnbot-[0-9]+-[0-9]+-[0-9]+-[0-9]+\\.search\\.msn\\.com$)" against "REMOTE_HOST" required. [file "C:\/Program Files (x86)/Plesk/ModSecurity/rules/tortix/modsec/00_asl_y_searchengines.conf"] [line "106"] [id "303801"] [rev "6"] [msg "Atomicorp.com WAF Rules: Fake msnbot/bingbot webcrawler"] [data ""]
Message: Warning. RBL lookup of 0.139.66.13.threat2.atomicrbl.com. succeeded at REMOTE_ADDR. [file "C:\/Program Files (x86)/Plesk/ModSecurity/rules/tortix/modsec/99_asl_zzzz_threat_intelligence.conf"] [line "64"] [id "355501"] [rev "2"] [msg "Atomicorp.com WAF Rules: Threat Intelligence Match for Spamming Source on Atomicorp Threat Intelligence RBL (TI-2).  See this URL for details http://www.atomicrbl.com/lookup"] [severity "ERROR"] [tag "no_ar"]
Message: Warning. RBL lookup of 0.139.66.13.threat5.atomicrbl.com. succeeded at REMOTE_ADDR. [file "C:\/Program Files (x86)/Plesk/ModSecurity/rules/tortix/modsec/99_asl_zzzz_threat_intelligence.conf"] [line "73"] [id "355506"] [rev "1"] [msg "Atomicorp.com WAF Rules: Threat Intelligence Match for Known multi event attacker Source on Atomicorp Threat Intelligence RBL.  See this URL for details http://www.atomicrbl.com/lookup"] [severity "ALERT"]
Apache-Handler: IIS
Stopwatch: 1560756427841805 207022 (- - -)
Stopwatch2: 1560756427841805 207022; combined=224046, p1=56045, p2=129961, p3=0, p4=0, p5=19020, sr=1018, sw=1032, l=0, gc=17988
Producer: ModSecurity for IIS (STABLE)/2.9.2 (http://www.modsecurity.org/); 201404231529.
Server: ModSecurity Standalone
Engine-Mode: "DETECTION_ONLY"

--23480000-Z—


--325f0000-F--
HTTP/1.1 500 Internal Server Error

--325f0000-H--
Message: Warning. RBL lookup of 1.139.66.13.threat2.atomicrbl.com. succeeded at REMOTE_ADDR. [file "C:\/Program Files (x86)/Plesk/ModSecurity/rules/tortix/modsec/99_asl_zzzz_threat_intelligence.conf"] [line "64"] [id "355501"] [rev "2"] [msg "Atomicorp.com WAF Rules: Threat Intelligence Match for Spamming Source on Atomicorp Threat Intelligence RBL (TI-2). See this URL for details http://www.atomicrbl.com/lookup"] [severity "ERROR"] [tag "no_ar"]
Apache-Handler: IIS
Stopwatch: 1560803751120054 343710 (- - -)
Stopwatch2: 1560803751120054 343710; combined=343710, p1=62492, p2=281218, p3=0, p4=0, p5=0, sr=0, sw=0, l=0, gc=0
Producer: ModSecurity for IIS (STABLE)/2.9.2 (http://www.modsecurity.org/); 201404231529.
Server: ModSecurity Standalone
Engine-Mode: "DETECTION_ONLY"

--325f0000-Z--

--bb660000-A—


--f2260000-H--
Message: Warning. Match of "rx (^msnbot-[0-9]+-[0-9]+-[0-9]+-[0-9]+\\.search\\.msn\\.com$)" against "REMOTE_HOST" required. [file "C:\/Program Files (x86)/Plesk/ModSecurity/rules/tortix/modsec/00_asl_y_searchengines.conf"] [line "106"] [id "303801"] [rev "6"] [msg "Atomicorp.com WAF Rules: Fake msnbot/bingbot webcrawler"] [data ""]
Apache-Handler: IIS
Stopwatch: 1560766857301652 437503 (- - -)
Stopwatch2: 1560766857301652 437503; combined=0, p1=0, p2=0, p3=0, p4=0, p5=0, sr=0, sw=0, l=0, gc=0
Producer: ModSecurity for IIS (STABLE)/2.9.2 (http://www.modsecurity.org/); 201404231529.
Server: ModSecurity Standalone
Engine-Mode: "DETECTION_ONLY"

--f2260000-Z—


Would the exception need to be created in a .conf file on the windows server or is it just a matter of switching off rule ID’s using the Plesk control panel ?

Thank you for your help.

Joost








> On 17 Jun 2019, at 22:52, Chaim Sanders <ch...@ch...> wrote:
> 
> Sure, if it is blocking it will have an ID of the rule that is blocking and we can help you write an exception and then take a look at why it is blocking to begin with. Check your error or audit( if enabled) logs.
> 
> On Mon, Jun 17, 2019 at 11:20 AM Joost Kouwenberg <cho...@gm... <mailto:cho...@gm...>> wrote:
> Hi,
> 
> For some reason Bing & yahoo bots are being blocked by modsecurity in Plesk12 on Windows server using “Advanced ModSecurity Rules by Atomicorp”, Google Bot have access.
> 
> Any thoughts how we can allow Bing & yahoo bots on the Windows Server using Plesk12?
> 
> Many thanks.
> 
> Joost
> 
> 
> _______________________________________________
> mod-security-users mailing list
> mod...@li... <mailto:mod...@li...>
> https://lists.sourceforge.net/lists/listinfo/mod-security-users <https://lists.sourceforge.net/lists/listinfo/mod-security-users>
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/ <http://www.modsecurity.org/projects/commercial/rules/>
> http://www.modsecurity.org/projects/commercial/support/ <http://www.modsecurity.org/projects/commercial/support/>
> 
> 
> -- 
> -- 
> Chaim Sanders
> http://www.ChaimSanders.com <http://www.chaimsanders.com/>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] modsecurity is blocking bing & yahoo in windows plesk

[Chaim S. <ch...@ch...>]

Sure, if it is blocking it will have an ID of the rule that is blocking and
we can help you write an exception and then take a look at why it is
blocking to begin with. Check your error or audit( if enabled) logs.

On Mon, Jun 17, 2019 at 11:20 AM Joost Kouwenberg <cho...@gm...>
wrote:

> Hi,
>
> For some reason Bing & yahoo bots are being blocked by modsecurity in
> Plesk12 on Windows server using “Advanced ModSecurity Rules by Atomicorp”,
> Google Bot have access.
>
> Any thoughts how we can allow Bing & yahoo bots on the Windows Server
> using Plesk12?
>
> Many thanks.
>
> Joost
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>


-- 
-- 
Chaim Sanders
http://www.ChaimSanders.com

[mod-security-users] modsecurity is blocking bing & yahoo in windows plesk

[Joost K. <cho...@gm...>]

Hi,

For some reason Bing & yahoo bots are being blocked by modsecurity in Plesk12 on Windows server using “Advanced ModSecurity Rules by Atomicorp”, Google Bot have access.

Any thoughts how we can allow Bing & yahoo bots on the Windows Server using Plesk12?

Many thanks.

Joost

Re: [mod-security-users] Modsec_audit.log contains regular 403-Errors

[Reindl H. <h.r...@th...>]

Am 17.06.19 um 17:10 schrieb Manuel Spartan:
> Hi Peter, this is not a modsecurity issue, check your Apache
> configuration instead and grant the access to the URL

how does access denied qualify anything to appear in the modsec logs
when the 403 was not triggered by modsec itself?

Re: [mod-security-users] Modsec_audit.log contains regular 403-Errors

[logo <lo...@kr...>]

Hi all,

apparently something goes wrong with the reply to... so this is my 
answer to Ervin's and also Manuel's private responses.

No, it is not my apache config for the server-info-URI. I want it 
blocked for external IPs!

Best regards

Peter

Am 2019-06-17 16:24, schrieb logo:
> Hi Ervin,
> 
> that's the point, I've limited that access to server-info to internal
> IPs. External IPs will be blocked - as expected, but I don't need that
> in the audit-log.
> 
> Best regards
> 
> Peter
> 
> 
> Am 2019-06-17 16:05, schrieb Ervin Hegedüs:
>> Hi Peter,
>> 
>> On Mon, Jun 17, 2019 at 03:03:27PM +0200, logo wrote:
>>> I see regular 403 denied messages in the modsec_audit-Log. Is there a 
>>> way to
>>> prevent this?
>>> 
>> 
>> I think this is not the ModSecurity configuration issue,
>> 
>>> --d5087f62-F--
>>> HTTP/1.1 403 Forbidden
>>> Content-Length: 9
>>> Keep-Alive: timeout=5, max=100
>>> Connection: Keep-Alive
>>> Content-Type: text/html; charset=iso-8859-1
>> 
>> this part of audit log (F) means the answer from the webserver is 403
>> 
>>> --d5087f62-E--
>>> 
>>> --d5087f62-H--
>>> Apache-Error: [file "mod_authz_core.c"] [line 884] [level 3] AH01630: 
>>> client
>>> denied by server configuration: /var/www/html/xxx/server-info
>> 
>> and this (H) showed the detail - your apache configuration is not
>> complete.
>> 
>> Enable the server-info in that virtualhost, and the error will
>> gone.
>> 
>> 
>> a.

Re: [mod-security-users] Modsec_audit.log contains regular 403-Errors

[Manuel S. <spa...@gm...>]

Hi Peter, this is not a modsecurity issue, check your Apache configuration
instead and grant the access to the URL

*Apache-Error*: [file "mod_authz_core.c"] [line 884] [level 3] AH01630:
*client denied by server configuration*: /var/www/html/xxx/server-info

El lun., 17 jun. 2019 a las 9:25, logo (<lo...@kr...>) escribió:

> Hi,
>
> my first time in this mailing list.
>
> I see regular 403 denied messages in the modsec_audit-Log. Is there a
> way to prevent this?
>
> --d5087f62-A--
> [17/Jun/2019:11:01:29 +0200] XQdW6W@ny6FqDbnEOUblnQAAAAQ 172.19.0.1
> 40528 172.19.0.2 443
> --d5087f62-B--
> GET /server-info HTTP/1.1
> Host: <xxx>
> Connection: keep-alive
> Upgrade-Insecure-Requests: 1
> User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
> (KHTML, like Gecko) Chrome/75.0.3770.90 Safari/537.36
> Accept:
>
> text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
> Accept-Encoding: gzip, deflate, br
> Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
>
> --d5087f62-F--
> HTTP/1.1 403 Forbidden
> Content-Length: 9
> Keep-Alive: timeout=5, max=100
> Connection: Keep-Alive
> Content-Type: text/html; charset=iso-8859-1
>
> --d5087f62-E--
>
> --d5087f62-H--
> Apache-Error: [file "mod_authz_core.c"] [line 884] [level 3] AH01630:
> client denied by server configuration: /var/www/html/xxx/server-info
> Stopwatch: 1560762089814529 28970 (- - -)
> Stopwatch2: 1560762089814529 28970; combined=1221, p1=700, p2=0, p3=137,
> p4=180, p5=204, sr=199, sw=0, l=0, gc=0
> Response-Body-Transformed: Dechunked
> Producer: ModSecurity for Apache/2.9.3 (http://www.modsecurity.org/);
> OWASP_CRS/3.1.0.
> Server: Apache
> Engine-Mode: "ENABLED"
>
> --d5087f62-Z--
>
> Apparently there is no ruleid that I could exclude.
>
> Thanks
>
> Peter
>
>
>
>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Re: [mod-security-users] Modsec_audit.log contains regular 403-Errors

[Ervin H. <ai...@gm...>]

Hi Peter,

On Mon, Jun 17, 2019 at 03:03:27PM +0200, logo wrote:
> I see regular 403 denied messages in the modsec_audit-Log. Is there a way to
> prevent this?
> 

I think this is not the ModSecurity configuration issue,

> --d5087f62-F--
> HTTP/1.1 403 Forbidden
> Content-Length: 9
> Keep-Alive: timeout=5, max=100
> Connection: Keep-Alive
> Content-Type: text/html; charset=iso-8859-1

this part of audit log (F) means the answer from the webserver is 403
 
> --d5087f62-E--
> 
> --d5087f62-H--
> Apache-Error: [file "mod_authz_core.c"] [line 884] [level 3] AH01630: client
> denied by server configuration: /var/www/html/xxx/server-info

and this (H) showed the detail - your apache configuration is not
complete.

Enable the server-info in that virtualhost, and the error will
gone.


a.

[mod-security-users] Modsec_audit.log contains regular 403-Errors

[logo <lo...@kr...>]

Hi,

my first time in this mailing list.

I see regular 403 denied messages in the modsec_audit-Log. Is there a 
way to prevent this?

--d5087f62-A--
[17/Jun/2019:11:01:29 +0200] XQdW6W@ny6FqDbnEOUblnQAAAAQ 172.19.0.1 
40528 172.19.0.2 443
--d5087f62-B--
GET /server-info HTTP/1.1
Host: <xxx>
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 
(KHTML, like Gecko) Chrome/75.0.3770.90 Safari/537.36
Accept: 
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7

--d5087f62-F--
HTTP/1.1 403 Forbidden
Content-Length: 9
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

--d5087f62-E--

--d5087f62-H--
Apache-Error: [file "mod_authz_core.c"] [line 884] [level 3] AH01630: 
client denied by server configuration: /var/www/html/xxx/server-info
Stopwatch: 1560762089814529 28970 (- - -)
Stopwatch2: 1560762089814529 28970; combined=1221, p1=700, p2=0, p3=137, 
p4=180, p5=204, sr=199, sw=0, l=0, gc=0
Response-Body-Transformed: Dechunked
Producer: ModSecurity for Apache/2.9.3 (http://www.modsecurity.org/); 
OWASP_CRS/3.1.0.
Server: Apache
Engine-Mode: "ENABLED"

--d5087f62-Z--

Apparently there is no ruleid that I could exclude.

Thanks

Peter

[mod-security-users] Unsubscribe

[Mike L. <mi...@ne...>]

Unsubscribe

 

Re: [mod-security-users] ambiguous statements in CRS-SetUP.conf

[Chaim S. <cha...@gm...>]

Hey Ted, great questions!
We set the variables to their default values in
https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-901-INITIALIZATION.conf.
As this is in the rules folder it should be included only after crs-setup.
To ensure that the default values do not override the user defined
versions, all the variables set in 901 check to see if the variable has
already been set, only setting these if they were not previously set in
crs-setup.
As a result, there should be no issue with replication of these variables.
Per your second question, here this rule is setting a variable. Later in
the rules we'll enable different sets of rules based on this value. As a
result, you only need to override the default (level 1) paranoia level in
the crs-setup by uncommenting and changing the paranoia level to the
desired setting.

Happy hunting!
- Chaim


On Sun, May 26, 2019, 4:06 PM Ted Talaiti <tal...@ho...> wrote:

> Hey Chaim
>
> 1) What if I just uncomment them and change nothing?
> Will the redundancy cause problem? Which one works during the exacuations?
>
> 2) Increasing paranoia add extra rule. But in following example it only
> effects to "id:900000" but not others.
> Are the two statements contrary?
> Could you please tell the exact place where I can set paranoi level that
> effects to all CRS or part of it?
> SecAction \
>   "id:900000,\
>    phase:1,\
>    nolog,\
>    pass,\
>    t:none,\
>    setvar:tx.paranoia_level=1"
>
> Sincerely
> Thanks in advance.
>
>
> ------------------------------
> *From:* Chaim Sanders <cha...@gm...>
> *Sent:* Saturday, May 25, 2019 1:01 AM
> *To:* mod...@li...
> *Subject:* Re: [mod-security-users] ambiguous statements in CRS-SetUP.conf
>
> Hey Ted, if you leave that commented, the default applies. The confusing
> portion may be that the example enables the same effect as the default.
> However, you can extend or restrict the details farther by uncomment and
> modifying that rule. Let us know if you have any other questions.
> Thanks,
> - Chaim
>
> On Fri, May 24, 2019, 10:23 AM Ted Talaiti <tal...@ho...> wrote:
>
> Dear friends
>
> HOW/WHY Uncomment this rule can change the default?
> Because it says by default it supports 4type of HTTP anyway.
>
> On the other hand, if do not uncomment the rule, then it does not the
> support the 4type of HTTP?
>
>
>
> I am confused of what happens if I uncomment the rule or leave it as
> commented?
>
> Sincerely
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Re: [mod-security-users] ambiguous statements in CRS-SetUP.conf

[Ted T. <tal...@ho...>]

Hey Chaim

1) What if I just uncomment them and change nothing?
Will the redundancy cause problem? Which one works during the exacuations?

2) Increasing paranoia add extra rule. But in following example it only effects to "id:900000" but not others.
Are the two statements contrary?
Could you please tell the exact place where I can set paranoi level that effects to all CRS or part of it?
SecAction \
  "id:900000,\
   phase:1,\
   nolog,\
   pass,\
   t:none,\
   setvar:tx.paranoia_level=1"

Sincerely
Thanks in advance.


________________________________
From: Chaim Sanders <cha...@gm...>
Sent: Saturday, May 25, 2019 1:01 AM
To: mod...@li...
Subject: Re: [mod-security-users] ambiguous statements in CRS-SetUP.conf

Hey Ted, if you leave that commented, the default applies. The confusing portion may be that the example enables the same effect as the default. However, you can extend or restrict the details farther by uncomment and modifying that rule. Let us know if you have any other questions.
Thanks,
- Chaim

On Fri, May 24, 2019, 10:23 AM Ted Talaiti <tal...@ho...<mailto:tal...@ho...>> wrote:
Dear friends

HOW/WHY Uncomment this rule can change the default?
Because it says by default it supports 4type of HTTP anyway.

On the other hand, if do not uncomment the rule, then it does not the support the 4type of HTTP?

[cid:cd9346a7-98d9-4d0d-9b06-d953163653f7]

I am confused of what happens if I uncomment the rule or leave it as commented?

Sincerely

_______________________________________________
mod-security-users mailing list
mod...@li...<mailto:mod...@li...>
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] ambiguous statements in CRS-SetUP.conf

[Chaim S. <cha...@gm...>]

Hey Ted, if you leave that commented, the default applies. The confusing
portion may be that the example enables the same effect as the default.
However, you can extend or restrict the details farther by uncomment and
modifying that rule. Let us know if you have any other questions.
Thanks,
- Chaim

On Fri, May 24, 2019, 10:23 AM Ted Talaiti <tal...@ho...> wrote:

> Dear friends
>
> HOW/WHY Uncomment this rule can change the default?
> Because it says by default it supports 4type of HTTP anyway.
>
> On the other hand, if do not uncomment the rule, then it does not the
> support the 4type of HTTP?
>
>
>
> I am confused of what happens if I uncomment the rule or leave it as
> commented?
>
> Sincerely
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

[mod-security-users] ambiguous statements in CRS-SetUP.conf

[Ted T. <tal...@ho...>]

Dear friends

HOW/WHY Uncomment this rule can change the default?
Because it says by default it supports 4type of HTTP anyway.

On the other hand, if do not uncomment the rule, then it does not the support the 4type of HTTP?

[cid:cd9346a7-98d9-4d0d-9b06-d953163653f7]

I am confused of what happens if I uncomment the rule or leave it as commented?

Sincerely

Re: [mod-security-users] tx.allowed_request_content_type against TX:0 (REQUEST-920-PROTOCOL-ENFORCEMENT.conf)

[Brent C. <bre...@gm...>]

Good day Christian

A long day !!!

Thanks so much !!!

Regards
Brent


On 2019/05/14 10:35, Christian Folini wrote:
> Hey Brent,
> 
> You are putting this _after_ CRS. Yet your rule wants to remove a CRS rule.
> So you are removing a rule that has already been executed.
> 
> May I suggest to use my ModSec Tuning Cheatsheet?
> https://www.netnea.com/cms/rule-exclusion-cheatsheet-download/
> 
> It addresses problems like this.
> 
> Best,
> 
> Christian
> 
> 
> On Tue, May 14, 2019 at 10:09:47AM +0200, Brent Clark wrote:
>> Good day Guys
>>
>> Sorry for the format (I store as JSON to send to kibana ), I got this error
>> message.
>>
>> https://pastebin.com/zsvXX63n
>>
>> I thought I could allow by doing the following in
>> EXCLUSION-RULES-AFTER-CRS.conf
>>
>> SecRule REQUEST_HEADERS:Content-Type "text/html"
>> "id:1005,phase:2,pass,nolog,pass,ctl:ruleRemoveById=920420"
>>
>> I cant see what I am doing wrong. Could someone please assist write a rule
>> and if possible, explain where I went wrong.
>>
>> Many thanks, regards
>> Brent Clark
>>
>>
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
> 
> 
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
> 

Re: [mod-security-users] tx.allowed_request_content_type against TX:0 (REQUEST-920-PROTOCOL-ENFORCEMENT.conf)

[Christian F. <chr...@ne...>]

Hey Brent,

You are putting this _after_ CRS. Yet your rule wants to remove a CRS rule.
So you are removing a rule that has already been executed.

May I suggest to use my ModSec Tuning Cheatsheet?
https://www.netnea.com/cms/rule-exclusion-cheatsheet-download/

It addresses problems like this.

Best,

Christian


On Tue, May 14, 2019 at 10:09:47AM +0200, Brent Clark wrote:
> Good day Guys
> 
> Sorry for the format (I store as JSON to send to kibana ), I got this error
> message.
> 
> https://pastebin.com/zsvXX63n
> 
> I thought I could allow by doing the following in
> EXCLUSION-RULES-AFTER-CRS.conf
> 
> SecRule REQUEST_HEADERS:Content-Type "text/html"
> "id:1005,phase:2,pass,nolog,pass,ctl:ruleRemoveById=920420"
> 
> I cant see what I am doing wrong. Could someone please assist write a rule
> and if possible, explain where I went wrong.
> 
> Many thanks, regards
> Brent Clark
> 
> 
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

[mod-security-users] tx.allowed_request_content_type against TX:0 (REQUEST-920-PROTOCOL-ENFORCEMENT.conf)

[Brent C. <bre...@gm...>]

Good day Guys

Sorry for the format (I store as JSON to send to kibana ), I got this 
error message.

https://pastebin.com/zsvXX63n

I thought I could allow by doing the following in 
EXCLUSION-RULES-AFTER-CRS.conf

SecRule REQUEST_HEADERS:Content-Type "text/html" 
"id:1005,phase:2,pass,nolog,pass,ctl:ruleRemoveById=920420"

I cant see what I am doing wrong. Could someone please assist write a 
rule and if possible, explain where I went wrong.

Many thanks, regards
Brent Clark

Re: [mod-security-users] ModSecurity: Exec: Execution failed while reading output: /bin/runAV (The timeout specified has expired)

[Brent C. <bre...@gm...>]

Thanks Christian

Regards
Brent

On 2019/05/14 09:20, Christian Folini wrote:
> Hi Brent,
> 
> Your runAV is taking too long and ModSecurity is calling it a day.
> 
> If this is Apache, try raising the webserver Timeout. It also applies here
> AFAICS.
> 
> Good luck,
> 
> Christian
> 
> On Tue, May 14, 2019 at 08:59:46AM +0200, Brent Clark wrote:
>> Good day Guys
>>
>> Im getting the following error message.
>>
>> ModSecurity: Exec: Execution failed while reading output: /bin/runAV (The
>> timeout specified has expired)
>>
>> Has anyone experienced the same issue, and does anyone have an idea of in
>> what direction I can look.
>>
>> I was thinking if could be an apache / php timeout.
>>
>> Kind Regards
>> Brent Clark
>>
>>
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
> 
> 
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
> 

Re: [mod-security-users] ModSecurity: Exec: Execution failed while reading output: /bin/runAV (The timeout specified has expired)

[Christian F. <chr...@ne...>]

Hi Brent,

Your runAV is taking too long and ModSecurity is calling it a day.

If this is Apache, try raising the webserver Timeout. It also applies here
AFAICS.

Good luck,

Christian

On Tue, May 14, 2019 at 08:59:46AM +0200, Brent Clark wrote:
> Good day Guys
> 
> Im getting the following error message.
> 
> ModSecurity: Exec: Execution failed while reading output: /bin/runAV (The
> timeout specified has expired)
> 
> Has anyone experienced the same issue, and does anyone have an idea of in
> what direction I can look.
> 
> I was thinking if could be an apache / php timeout.
> 
> Kind Regards
> Brent Clark
> 
> 
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

[mod-security-users] ModSecurity: Exec: Execution failed while reading output: /bin/runAV (The timeout specified has expired)

[Brent C. <bre...@gm...>]

Good day Guys

Im getting the following error message.

ModSecurity: Exec: Execution failed while reading output: /bin/runAV 
(The timeout specified has expired)

Has anyone experienced the same issue, and does anyone have an idea of 
in what direction I can look.

I was thinking if could be an apache / php timeout.

Kind Regards
Brent Clark

[mod-security-users] Help (Neither audit.log nor debug.log)

[Ted T. <tal...@ho...>]

Dear

 Modsecurity does not record any log information (only showing logs from last year).
1) Is it because of "nolog" as below?
 [root@server modsecurity.d]# cat modsecurity.conf

[image.png]
[image.png]
2)  by the way, following two config files contain information as follows.
 [root@server modsecurity.d]#cat  httpd.conf
IncludeOptional conf.d/*.conf

 [root@server modsecurity.d]#cat /etc/httpd/conf.d/mod_security.conf
<IfModule security2_module>
       Include modsecurity.d/modsecurity.conf
       Include modsecurity.d/owasp-modsecurity-crs/crs-setup.conf
       Include modsecurity.d/owasp-modsecurity-crs/rules/*.conf
</IfModule>

3) This server just has old audit information from last year.
[image.png]

*************************************
Environment
CentOS  7.5.1804 (Core)
ModSecurity for Apache/2.9.2 (http://www.modsecurity.org/); OWASP_CRS/3.0.2.<http://3.0.0.2/>
 Apache/2.4.29 (CentOS)
************************************
Please Help.

Sincerely

Re: [mod-security-users] Help (Mistake with Mod_security blocking list)

[Christian F. <chr...@ne...>]

Hello Ted,

No, I think blocking a request with a http status code of 403 and a html
response body describing / explaining the status code is in line with the
meaning of blocking. You you have in mind is probably more like dropping
the request, which is supported by ModSecurity, but not covered in my
tutorials.

Best,

Christian

On Fri, May 03, 2019 at 09:53:49AM +0000, Ted Talaiti wrote:
> Hi Christian
> 
> No sir, my question is based on only your tutorial.
> The point is that having html response does not mean it is blocked, rather it means opposite.
> Since in <title> you can write anything, which (403 Forbidden) is different from what you wrote as "We want to respond to such a request with HTTP status 403."
> 
> 
> <title>403 Forbidden</title>
> 
> In short, we see no blocking (HTTP status 403) in <Step 7: Trying out the blockade>.
> https://www.netnea.com/cms/apache-tutorial-6_embedding-modsecurity/
> Embedding ModSecurity – Welcome to netnea<https://www.netnea.com/cms/apache-tutorial-6_embedding-modsecurity/>
> What are we doing? We are compiling the ModSecurity module, embedding it in the Apache web server, creating a base configuration and dealing with false positives for the first time.. Why are we doing this?
> www.netnea.com
> 
> 
> 
> Embedding ModSecurity – Welcome to netnea<https://www.netnea.com/cms/apache-tutorial-6_embedding-modsecurity/>
> What are we doing? We are compiling the ModSecurity module, embedding it in the Apache web server, creating a base configuration and dealing with false positives for the first time.. Why are we doing this?
> www.netnea.com
> 
> 
> 
> 
> 
> ________________________________
> From: Christian Folini <chr...@ne...>
> Sent: Friday, May 3, 2019 8:52 AM
> To: mod...@li...
> Subject: Re: [mod-security-users] Help (Mistake with Mod_security blocking list)
> 
> Hi Ted,
> 
> You may want to share your configuration with us so we can understand, why it
> is not blocking.
> 
> You did add the rule to block this, did not you?
> 
> Cheers,
> 
> Christian
> 
> On Fri, May 03, 2019 at 08:44:56AM +0000, Ted Talaiti wrote:
> > Hello
> >
> >  In following tutorial,  you wrote "access to a specific URI on the server is blocked. We want to respond to such a request with HTTP status 403."
> > when you try out with blockade,
> >
> >  $> curl http://localhost/phpmyadmin
> >
> > It didn't block (since no such HTTP status 403), rather the access is allowed to the URI.
> >
> > https://www.netnea.com/cms/apache-tutorial-6_embedding-modsecurity<https://www.netnea.com/cms/apache-tutorial-6_embedding-modsecurity/>
> >
> > Embedding ModSecurity – Welcome to netnea<https://www.netnea.com/cms/apache-tutorial-6_embedding-modsecurity/>
> > What are we doing? We are compiling the ModSecurity module, embedding it in the Apache web server, creating a base configuration and dealing with false positives for the first time.. Why are we doing this?
> > www.netnea.com<http://www.netnea.com>
> >
> > Please correct me if I am wrong.
> > Regards
> >
> >
> >
> > ________________________________
> > From: Ted Talaiti <tal...@ho...>
> > Sent: Thursday, April 25, 2019 3:20 PM
> > To: mod...@li...
> > Subject: Re: [mod-security-users] Help (migrate Mod_security with CRS)
> >
> > Hi thanks for your reply.
> > But there is no information of exporting /importing modsecurity /CRS from server /linux to another.
> > Please shed some light.
> > Thanks a lot.
> > ________________________________
> > From: Christian Folini <chr...@ne...>
> > Sent: Thursday, April 25, 2019 12:56:25 PM
> > To: mod...@li...
> > Subject: Re: [mod-security-users] Help (migrate Mod_security with CRS)
> >
> > Hi Ted,
> >
> > I suggest you take a peek at the detailed tutorials at
> > https://netnea.com/apache-tutorials
> >
> > They are meant to cover your use case.
> >
> > Best,
> >
> > Christian
> >
> >
> > On Thu, Apr 25, 2019 at 12:38:18PM +0000, Ted Talaiti wrote:
> > > Hello
> > >
> > >   I need to implement Mod_security with CRS in apache server of linux in aws from scratch, and then test it.
> > > Is there any detailed descriptions of steps of Mod_security installation and configurations (in apache) available, please ?
> > >
> > > Can we move a well configured Mod_security with CRS from a server in aws to another server in different cloud?
> > >
> > > Thanks a lot for your attention.
> > > Sincerely
> > >
> >
> >
> > > _______________________________________________
> > > mod-security-users mailing list
> > > mod...@li...
> > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > http://www.modsecurity.org/projects/commercial/rules/
> > > http://www.modsecurity.org/projects/commercial/support/
> >
> >
> >
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
> 
> 
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
> 
> 
> 
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/


> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/