mod-security-users — General discussion about mod_security

Re: [mod-security-users] Parse JSON response and put ip on blacklist for xy minutes

[Ervin H. <ai...@gm...>]

Hi Boris,

On Mon, Apr 15, 2019 at 01:45:37PM +0200, Boris Kočar wrote:
> Hi, thanks all for answer. i found something similer.
> 
> https://www.nginx.com/blog/dynamic-ip-blacklisting-with-nginx-plus-and-fail2ban/
> 
> 
> need to think how to cluster fail2ban or iptables if there is 2 or more
> nginx.

I think you just have to care with fail2ban - and there are so much
good post on internet, eg.:

https://www.blackhillsinfosec.com/configure-distributed-fail2ban/



a.
 

Re: [mod-security-users] Parse JSON response and put ip on blacklist for xy minutes

[Boris K. <bor...@gm...>]

Hi, thanks all for answer. i found something similer.

https://www.nginx.com/blog/dynamic-ip-blacklisting-with-nginx-plus-and-fail2ban/


need to think how to cluster fail2ban or iptables if there is 2 or more
nginx.

Thanks.

On Mon, Apr 15, 2019 at 1:42 PM Ervin Hegedüs <ai...@gm...> wrote:

> Hi Boris,
>
> On Sun, Apr 14, 2019 at 09:36:15PM +0200, Boris Kočar wrote:
> > Hello,
> >
> > I'm digging through internet to find out about how to parse JSON response
> > and create the rule.
> >
> > To be more specific here is a layout:
> > 1. Layer 1 Nginx with Modsecurity
> > 2. Layer 2 Application server
> > 3. Layer 3 ....
> >
> > Scenario:
> > when user try to do some illegal things which is known only to
> application
> > server where is all the business. Let say for example spray password
> > attack.
> >
> > What I like to establish on Modsecurity:
> > Application server will send back json response with code 401 and json
> {IP:
> > a.t.t.a.c.k.e.r i.p}, Modsecurity would catch response, see code (e.g.
> > 401), parse json body and put that IP on black list for xy minutes.
>
> I think you can't do that. If ModSecurity could parse the
> "external" JSON source for rules, then it would still be the
> problem, that you have to restart the Layer 1 components to
> activate the rule after every update.
>
> I think that you're looking for something, which closer eg. to
> fail2ban, or any IDS (Intrusion Detection System).
>
>
> Hope this helps,
>
>
> a.
>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Re: [mod-security-users] Parse JSON response and put ip on blacklist for xy minutes

[Ervin H. <ai...@gm...>]

Hi Boris,

On Sun, Apr 14, 2019 at 09:36:15PM +0200, Boris Kočar wrote:
> Hello,
> 
> I'm digging through internet to find out about how to parse JSON response
> and create the rule.
> 
> To be more specific here is a layout:
> 1. Layer 1 Nginx with Modsecurity
> 2. Layer 2 Application server
> 3. Layer 3 ....
> 
> Scenario:
> when user try to do some illegal things which is known only to application
> server where is all the business. Let say for example spray password
> attack.
> 
> What I like to establish on Modsecurity:
> Application server will send back json response with code 401 and json {IP:
> a.t.t.a.c.k.e.r i.p}, Modsecurity would catch response, see code (e.g.
> 401), parse json body and put that IP on black list for xy minutes.

I think you can't do that. If ModSecurity could parse the
"external" JSON source for rules, then it would still be the
problem, that you have to restart the Layer 1 components to
activate the rule after every update.

I think that you're looking for something, which closer eg. to
fail2ban, or any IDS (Intrusion Detection System).


Hope this helps,


a.

[mod-security-users] (no subject)

[Don C. <don...@gm...>]

Re: [mod-security-users] Parse JSON response and put ip on blacklist for xy minutes

[Manuel S. <spa...@gm...>]

Hi Boris, do you use OWASP CRS? Which version? 
If you don’t use CRS, you will have to write the blacklisting logic and not only the setting the ip to be blacklisted.

Cheers!

Sent from my iPhone

> On 14 Apr 2019, at 15:36, Boris Kočar <bor...@gm...> wrote:
> 
> Hello,
> 
> I'm digging through internet to find out about how to parse JSON response and create the rule.
> 
> To be more specific here is a layout:
> 1. Layer 1 Nginx with Modsecurity
> 2. Layer 2 Application server
> 3. Layer 3 ....
> 
> Scenario:
> when user try to do some illegal things which is known only to application server where is all the business. Let say for example spray password attack. 
> 
> What I like to establish on Modsecurity:
> Application server will send back json response with code 401 and json {IP: a.t.t.a.c.k.e.r i.p}, Modsecurity would catch response, see code (e.g. 401), parse json body and put that IP on black list for xy minutes.
> 
> Thanks in front for your time to reply.
> 
> Boris
> 
> 
> 
> 
> 
> 
>  
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

[mod-security-users] Parse JSON response and put ip on blacklist for xy minutes

[Boris K. <bor...@gm...>]

Hello,

I'm digging through internet to find out about how to parse JSON response
and create the rule.

To be more specific here is a layout:
1. Layer 1 Nginx with Modsecurity
2. Layer 2 Application server
3. Layer 3 ....

Scenario:
when user try to do some illegal things which is known only to application
server where is all the business. Let say for example spray password
attack.

What I like to establish on Modsecurity:
Application server will send back json response with code 401 and json {IP:
a.t.t.a.c.k.e.r i.p}, Modsecurity would catch response, see code (e.g.
401), parse json body and put that IP on black list for xy minutes.

Thanks in front for your time to reply.

Boris

Re: [mod-security-users] Problem with message in EventLog

[XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX]

Hi Christian

Yes we can

In crs-setup.conf i change
SecDefaultAction "phase:1,log,auditlog,pass"
SecDefaultAction "phase:2,log,auditlog,pass"
by
SecDefaultAction "phase:1,log,auditlog,pass,tag:'VirtualHost: %{request_headers.host}'"
SecDefaultAction "phase:2,log,auditlog,pass,tag:'VirtualHost: %{request_headers.host}'"
And i obtain:
[client x.x.x.x] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "C:\/Program Files/ModSecurity IIS/owasp_crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "57"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "VirtualHost: test-xss.gi3f.fr"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "TEST-WEB"] [uri "/verif.php"] [unique_id "18230571293743251474"]

where i get [tag "VirtualHost: test-xss.gi3f.fr"] in the log message

Thanks

Best regards

________________________________
De : Ervin Hegedüs <ai...@gm...>
Envoyé : dimanche 14 avril 2019 12:26
À : mod...@li...
Objet : Re: [mod-security-users] Problem with message in EventLog

Hi Claude,

On Sun, Apr 14, 2019 at 09:01:27AM +0000, XXXXXXXXXXXXXX wrote:
> Hi Christian,
>
> Thank you for your answer.
> Maybe a future evolution ?

in V3 (aka libmodsecurity3) there is possible to log the custom
fields, but it depends the application developer - so in
simplifying at all, also needs to code :).



a.



_______________________________________________
mod-security-users mailing list
mod...@li...
https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.sourceforge.net%2Flists%2Flistinfo%2Fmod-security-users&amp;data=02%7C01%7C%7C813b851d46d64cb0f07308d6c0c3ec26%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636908345038343879&amp;sdata=W%2Ba41%2FKPUjQ8OvqaHiaONRtNpAWa0LCFwrU2zyyNdMg%3D&amp;reserved=0
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
https://nam02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.modsecurity.org%2Fprojects%2Fcommercial%2Frules%2F&amp;data=02%7C01%7C%7C813b851d46d64cb0f07308d6c0c3ec26%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636908345038353884&amp;sdata=qaAIaj1dUC4WRQ53XTA6%2FdR%2BBjigXILJUk3qfi2g6gU%3D&amp;reserved=0
https://nam02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.modsecurity.org%2Fprojects%2Fcommercial%2Fsupport%2F&amp;data=02%7C01%7C%7C813b851d46d64cb0f07308d6c0c3ec26%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636908345038353884&amp;sdata=TyW%2FFegJM3qjr%2B4CR%2FltiZbeA8uT44FfU2RRcuGkS6M%3D&amp;reserved=0

Re: [mod-security-users] Problem with message in EventLog

[Ervin H. <ai...@gm...>]

Hi Claude,

On Sun, Apr 14, 2019 at 09:01:27AM +0000, Claude Cocault wrote:
> Hi Christian,
> 
> Thank you for your answer.
> Maybe a future evolution ?

in V3 (aka libmodsecurity3) there is possible to log the custom
fields, but it depends the application developer - so in
simplifying at all, also needs to code :).



a.
 

Re: [mod-security-users] Problem with message in EventLog

[XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX]

Hi Christian,

Thank you for your answer.
Maybe a future evolution ?

Have a nice day.

Regards

Claude
________________________________
De : Christian Folini <chr...@ne...>
Envoyé : samedi 13 avril 2019 20:41
À : mod...@li...
Objet : Re: [mod-security-users] Problem with message in EventLog

Hi Claude,

You can not customize it. It's hard coded.

Regards,

Christian

On Sat, Apr 13, 2019 at 09:06:37AM +0000, XXXXXXXXXXXXXX wrote:
> Hello,
>
>
>
> I'm using Mod Security 2.9.3 with IIS 10.
>
> It works well but I can’t distinguish the impacted site in the message generated in the EventLog.
>
>
>
> Here an example:
>
> [client x.x.x.x] ModSecurity: Warning. detected XSS using libinjection. [file "C:\/Program Files/ModSecurity IIS/owasp_crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "64"] [id "941100"] [rev "2"] [msg "XSS Attack Detected via libinjection"] [data "Matched Data: <script>alert(\x22Hello! I am an alert box!\x22);</script> found within ARGS:faille: <script>alert(\x22Hello! I am an alert box!\x22);</script>"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "OWASP_CRS/WEB_ATTACK/XSS"] [tag "WASCTC/WASC-8"] [tag "WASCTC/WASC-22"] [tag "OWASP_TOP_10/A3"] [tag "OWASP_AppSensor/IE1"] [tag "CAPEC-242"] [hostname "TEST-WEB"] [uri "/verif.php"] [unique_id "18158513699705323522"]
>
>
>
> The url is https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Ftest-xss.localdomain&amp;data=02%7C01%7C%7Cc14cb721bd214b58324008d6c03fe998%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636907778065680843&amp;sdata=LbqycVer9jtgdmuqiTLaOZOxk18RUZWjH6aFjFdlA0o%3D&amp;reserved=0
>
>
>
> I would rather see [hostname "test-xss.localdomain "] instead of [hostname "TEST-WEB"], where TEST-WEB is the name of the server hosting multiple sites.
>
> I can't find how to customize the EventLog message.
>
>
>
> Thanks
>


> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.sourceforge.net%2Flists%2Flistinfo%2Fmod-security-users&amp;data=02%7C01%7C%7Cc14cb721bd214b58324008d6c03fe998%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636907778065690854&amp;sdata=CJYI%2Fg3r1rup%2BeeddoD6%2F7g2tE1CxgWuWvzDul%2BQjXs%3D&amp;reserved=0
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.modsecurity.org%2Fprojects%2Fcommercial%2Frules%2F&amp;data=02%7C01%7C%7Cc14cb721bd214b58324008d6c03fe998%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636907778065690854&amp;sdata=JOlzefxd2QjcByBZV6kqBWOjTX1ueitX4vLlZ4f7isw%3D&amp;reserved=0
> https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.modsecurity.org%2Fprojects%2Fcommercial%2Fsupport%2F&amp;data=02%7C01%7C%7Cc14cb721bd214b58324008d6c03fe998%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636907778065690854&amp;sdata=qll1hp%2ByIymn6prdQHLXii%2FLRaVb4n%2FuZSuFt%2FoqPG0%3D&amp;reserved=0



_______________________________________________
mod-security-users mailing list
mod...@li...
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.sourceforge.net%2Flists%2Flistinfo%2Fmod-security-users&amp;data=02%7C01%7C%7Cc14cb721bd214b58324008d6c03fe998%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636907778065690854&amp;sdata=CJYI%2Fg3r1rup%2BeeddoD6%2F7g2tE1CxgWuWvzDul%2BQjXs%3D&amp;reserved=0
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.modsecurity.org%2Fprojects%2Fcommercial%2Frules%2F&amp;data=02%7C01%7C%7Cc14cb721bd214b58324008d6c03fe998%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636907778065690854&amp;sdata=JOlzefxd2QjcByBZV6kqBWOjTX1ueitX4vLlZ4f7isw%3D&amp;reserved=0
https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.modsecurity.org%2Fprojects%2Fcommercial%2Fsupport%2F&amp;data=02%7C01%7C%7Cc14cb721bd214b58324008d6c03fe998%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636907778065690854&amp;sdata=qll1hp%2ByIymn6prdQHLXii%2FLRaVb4n%2FuZSuFt%2FoqPG0%3D&amp;reserved=0

Re: [mod-security-users] Problem with message in EventLog

[Christian F. <chr...@ne...>]

Hi Claude,

You can not customize it. It's hard coded.

Regards,

Christian

On Sat, Apr 13, 2019 at 09:06:37AM +0000, Claude Cocault wrote:
> Hello,
> 
> 
> 
> I'm using Mod Security 2.9.3 with IIS 10.
> 
> It works well but I can’t distinguish the impacted site in the message generated in the EventLog.
> 
> 
> 
> Here an example:
> 
> [client x.x.x.x] ModSecurity: Warning. detected XSS using libinjection. [file "C:\/Program Files/ModSecurity IIS/owasp_crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "64"] [id "941100"] [rev "2"] [msg "XSS Attack Detected via libinjection"] [data "Matched Data: <script>alert(\x22Hello! I am an alert box!\x22);</script> found within ARGS:faille: <script>alert(\x22Hello! I am an alert box!\x22);</script>"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "OWASP_CRS/WEB_ATTACK/XSS"] [tag "WASCTC/WASC-8"] [tag "WASCTC/WASC-22"] [tag "OWASP_TOP_10/A3"] [tag "OWASP_AppSensor/IE1"] [tag "CAPEC-242"] [hostname "TEST-WEB"] [uri "/verif.php"] [unique_id "18158513699705323522"]
> 
> 
> 
> The url is http://test-xss.localdomain
> 
> 
> 
> I would rather see [hostname "test-xss.localdomain "] instead of [hostname "TEST-WEB"], where TEST-WEB is the name of the server hosting multiple sites.
> 
> I can't find how to customize the EventLog message.
> 
> 
> 
> Thanks
> 


> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

[mod-security-users] Problem with message in EventLog

[XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX]

Hello,



I'm using Mod Security 2.9.3 with IIS 10.

It works well but I can’t distinguish the impacted site in the message generated in the EventLog.



Here an example:

[client x.x.x.x] ModSecurity: Warning. detected XSS using libinjection. [file "C:\/Program Files/ModSecurity IIS/owasp_crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "64"] [id "941100"] [rev "2"] [msg "XSS Attack Detected via libinjection"] [data "Matched Data: <script>alert(\x22Hello! I am an alert box!\x22);</script> found within ARGS:faille: <script>alert(\x22Hello! I am an alert box!\x22);</script>"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "OWASP_CRS/WEB_ATTACK/XSS"] [tag "WASCTC/WASC-8"] [tag "WASCTC/WASC-22"] [tag "OWASP_TOP_10/A3"] [tag "OWASP_AppSensor/IE1"] [tag "CAPEC-242"] [hostname "TEST-WEB"] [uri "/verif.php"] [unique_id "18158513699705323522"]



The url is http://test-xss.localdomain



I would rather see [hostname "test-xss.localdomain "] instead of [hostname "TEST-WEB"], where TEST-WEB is the name of the server hosting multiple sites.

I can't find how to customize the EventLog message.



Thanks

Re: [mod-security-users] How to redirect to a https domain name

[Manuel S. <spa...@gm...>]

+1

Sent from my iPhone

> On 11 Apr 2019, at 18:25, Reindl Harald <h.r...@th...> wrote:
> 
> 
> 
>> Am 12.04.19 um 01:12 schrieb Monah Baki:
>> I have a webserver running on port 80 and 443, and another server
>> running modsecurity, my A record for www is the IP address of the WAF
>> running apache/modsecurity
>> 
>> on my waf httpd.conf:
>> 
>> <VirtualHost *:80>
>> ServerName www.<domainname>.com
>> #DocumentRoot /var/www/htdocs
>> ProxyPreserveHost On
>> ProxyPass / http://<ipaddress of webserver>/
>> ProxyPassReverse / http://<ipaddress of webserver>/
>> 
>> From the web if I enter http://URL, it works, and it also works if I
>> enter the http://IP_address.
>> 
>> However if I change the following in my WAF httpd.conf  to:
>> ProxyPass / https://www.<domainname>.com/
>> ProxyPassReverse / https:// www.<domainname>.com /
>> 
>> It stops working, basically I am trying to redirect http to https
> 
> besides it's not a modsec topic why would you want to do that?
> 
> if you use a proxy anyways install the certificates on the proxy and
> keep your backend connections unencrypted (it's called tls offloading)
> 
> a ton of reasons:
> 
> * seperate enryption load from backend servers
> * minimize overhead between proxy and backend
> 
> <IfModule mod_rewrite.c>
>  RewriteEngine on
>  RewriteCond %{HTTPS} off
>  RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
> </IfModule>
> 
> 
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] How to redirect to a https domain name

[Reindl H. <h.r...@th...>]

Am 12.04.19 um 01:12 schrieb Monah Baki:
> I have a webserver running on port 80 and 443, and another server
> running modsecurity, my A record for www is the IP address of the WAF
> running apache/modsecurity
> 
> on my waf httpd.conf:
> 
> <VirtualHost *:80>
> ServerName www.<domainname>.com
> #DocumentRoot /var/www/htdocs
> ProxyPreserveHost On
> ProxyPass / http://<ipaddress of webserver>/
> ProxyPassReverse / http://<ipaddress of webserver>/
> 
> From the web if I enter http://URL, it works, and it also works if I
> enter the http://IP_address.
> 
> However if I change the following in my WAF httpd.conf  to:
> ProxyPass / https://www.<domainname>.com/
> ProxyPassReverse / https:// www.<domainname>.com /
> 
> It stops working, basically I am trying to redirect http to https

besides it's not a modsec topic why would you want to do that?

if you use a proxy anyways install the certificates on the proxy and
keep your backend connections unencrypted (it's called tls offloading)

a ton of reasons:

* seperate enryption load from backend servers
* minimize overhead between proxy and backend

 <IfModule mod_rewrite.c>
  RewriteEngine on
  RewriteCond %{HTTPS} off
  RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
 </IfModule>

[mod-security-users] How to redirect to a https domain name

[Monah B. <mon...@gm...>]

Hi all,

I have a webserver running on port 80 and 443, and another server running
modsecurity, my A record for www is the IP address of the WAF running
apache/modsecurity

on my waf httpd.conf:

<VirtualHost *:80>
ServerName www.<domainname>.com
#DocumentRoot /var/www/htdocs
ProxyPreserveHost On
ProxyPass / http://<ipaddress of webserver>/
ProxyPassReverse / http://<ipaddress of webserver>/

>From the web if I enter http://URL, it works, and it also works if I enter
the http://IP_address.

However if I change the following in my WAF httpd.conf  to:
ProxyPass / https://www.<domainname>.com/
ProxyPassReverse / https:// www.<domainname>.com /

It stops working, basically I am trying to redirect http to https


Any help will be greatly appreciated.

[mod-security-users] Modsecurity + geoip

[Monah B. <mon...@gm...>]

Hi all,

The GeoLite2-Country.mmdb is it supported or I have to find somewhere the
GeoIP.dat and use it instead?, if latter is there a good site on how to
install Modsecurity with GeoIP install. I installed modsecurity but then
realized I need GeoIP, do I need to reinstall?


Thanks
Monah

Re: [mod-security-users] Modsecurity Reverse proxy

[Monah B. <mon...@gm...>]

Hi Manuel,

It was a simple fix, all I had to do was change to:


ProxyPreserveHost On
ProxyPass / http://54.156.228.101/
ProxyPassReverse / http://54.156.228.101/

Guess it needed the IP rather then the FQDN



Thanks

On Sun, Mar 31, 2019 at 10:02 PM Manuel Spartan <spa...@gm...>
wrote:

> Hi Baki,
>
> You need to provide more info and context, can you provide the apache
> error log related to this and the logs on the other server.
>
> This issue can have multiple causes, depending on what the other server is
> expecting, for example proxypreservehost may cause this issue if you are
> getting to the wrong vhost
> http://httpd.apache.org/docs/2.4/mod/mod_proxy.html#proxypreservehost
>
> Cheers!
> Sent from my iPhone
>
> On 31 Mar 2019, at 20:37, Monah Baki <mon...@gm...> wrote:
>
> Hi all,
>
> I have 2 servers running on AWS, server one has Apache/Modsecurity and
> server two running Apache only which also is our www domain server.
>
> I modified our DNS entry at our registrar to point our www IP address to
> server one, and on server one I added the following:
>
> ProxyPass "/" "http://www.<domain.com>"
> ProxyPassReverse "/" "http://www.<domain.com>"
>
> I get a This site can’t be reached when accessing the website on my
> browser.
>
> Thanks
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Re: [mod-security-users] Modsecurity Reverse proxy

[Monah B. <mon...@gm...>]

Hi Manuel,

Both servers do not fire any alerts in error_log

On Sun, Mar 31, 2019 at 10:02 PM Manuel Spartan <spa...@gm...>
wrote:

> Hi Baki,
>
> You need to provide more info and context, can you provide the apache
> error log related to this and the logs on the other server.
>
> This issue can have multiple causes, depending on what the other server is
> expecting, for example proxypreservehost may cause this issue if you are
> getting to the wrong vhost
> http://httpd.apache.org/docs/2.4/mod/mod_proxy.html#proxypreservehost
>
> Cheers!
> Sent from my iPhone
>
> On 31 Mar 2019, at 20:37, Monah Baki <mon...@gm...> wrote:
>
> Hi all,
>
> I have 2 servers running on AWS, server one has Apache/Modsecurity and
> server two running Apache only which also is our www domain server.
>
> I modified our DNS entry at our registrar to point our www IP address to
> server one, and on server one I added the following:
>
> ProxyPass "/" "http://www.<domain.com>"
> ProxyPassReverse "/" "http://www.<domain.com>"
>
> I get a This site can’t be reached when accessing the website on my
> browser.
>
> Thanks
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Re: [mod-security-users] Modsecurity Reverse proxy

[Manuel S. <spa...@gm...>]

Hi Baki,

You need to provide more info and context, can you provide the apache error log related to this and the logs on the other server.

This issue can have multiple causes, depending on what the other server is expecting, for example proxypreservehost may cause this issue if you are getting to the wrong vhost
http://httpd.apache.org/docs/2.4/mod/mod_proxy.html#proxypreservehost

Cheers!
Sent from my iPhone

> On 31 Mar 2019, at 20:37, Monah Baki <mon...@gm...> wrote:
> 
> Hi all,
> 
> I have 2 servers running on AWS, server one has Apache/Modsecurity and server two running Apache only which also is our www domain server.
> 
> I modified our DNS entry at our registrar to point our www IP address to server one, and on server one I added the following:
> 
> ProxyPass "/" "http://www.<domain.com>"
> ProxyPassReverse "/" "http://www.<domain.com>"
> 
> I get a This site can’t be reached when accessing the website on my browser.
> 
> Thanks
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

[mod-security-users] Modsecurity Reverse proxy

[Monah B. <mon...@gm...>]

Hi all,

I have 2 servers running on AWS, server one has Apache/Modsecurity and
server two running Apache only which also is our www domain server.

I modified our DNS entry at our registrar to point our www IP address to
server one, and on server one I added the following:

ProxyPass "/" "http://www.<domain.com>"
ProxyPassReverse "/" "http://www.<domain.com>"

I get a This site can’t be reached when accessing the website on my browser.

Thanks

Re: [mod-security-users] Testing modsecurity

[Felipe R. <fel...@gm...>]

read this article.
https://www.modsecurity.org/CRS/Documentation/anomaly.html

tx.warning_anomaly_score  = 3 *rule that was trigged*

tx.inbound_anomaly_score_threshold=5 *default*

you still less than minimum to fire deny action. Don't need to change
SecDefaultAction, If you change this like you did, every rule that matches
will be deny.


On Thu, Mar 28, 2019 at 1:05 PM Chaim Sanders <ch...@ch...>
wrote:

> Just for your information, the order of rules is relevant, so you were
> loading CRS *before* turning on the engine, so the default applied. I
> assume by uncommenting crs-setup you placed that before the CRS includes
> and therefore the rule engine was on. Not a biggy, can be confusing - but
> we're here to help! Come join us on the CRS mailing lists if you have more
> questions :)
>
>
> https://groups.google.com/a/owasp.org/forum/#!forum/modsecurity-core-rule-set-project
>
>
> On Thu, Mar 28, 2019 at 10:57 AM Monah Baki <mon...@gm...> wrote:
>
>> Got it to block IP by uncommenting in crs-setup.conf
>>
>>
>> SecDefaultAction "phase:1,log,auditlog,deny,status:403"
>> SecDefaultAction "phase:2,log,auditlog,deny,status:403"
>>
>>
>>
>>
>>
>> On Mon, Mar 25, 2019 at 2:42 PM Chaim Sanders <ch...@ch...>
>> wrote:
>>
>>> You probably don't have the rule engine in the blocking state. Generally
>>> this means changing the SecRuleEngine directive to 'On'. For more details
>>> see
>>> https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#SecRuleEngine.
>>> Let me know if that helps.
>>>
>>> On Mon, Mar 25, 2019 at 12:43 PM Monah Baki <mon...@gm...> wrote:
>>>
>>>> Hi all,
>>>>
>>>> Testing modsecurity, if I enter the IP address of the server, I get the
>>>> following:
>>>>
>>>> [Mon Mar 25 12:34:02.300806 2019] [:error] [pid 14540] [client
>>>> 192.168.1.11:57650] [client 192.168.1.11] ModSecurity: Warning.
>>>> Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file
>>>> "/etc/httpd/modsecurity.d/owasp-modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"]
>>>> [line "798"] [id "920350"] [msg "Host header is a numeric IP address"]
>>>> [data "192.168.1.2"] [severity "WARNING"] [ver "OWASP_CRS/3.1.0"] [tag
>>>> "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag
>>>> "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag
>>>> "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname
>>>> "192.168.1.2"] [uri "/favicon.ico"] [unique_id "XJkC@tolWxi51pCyjt7yHwAAAAI"],
>>>> referer: http://192.168.1.2/
>>>>
>>>>
>>>> I created a a test /etc/passwd in my root documentfolder, but I can
>>>> still access the file, I read on a website this would be a simple test, am
>>>> I missing something
>>>>
>>>>
>>>> Thanks
>>>> Monah
>>>> _______________________________________________
>>>> mod-security-users mailing list
>>>> mod...@li...
>>>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>>>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>>>> http://www.modsecurity.org/projects/commercial/rules/
>>>> http://www.modsecurity.org/projects/commercial/support/
>>>>
>>>
>>>
>>> --
>>> --
>>> Chaim Sanders
>>> http://www.ChaimSanders.com
>>> _______________________________________________
>>> mod-security-users mailing list
>>> mod...@li...
>>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>>> http://www.modsecurity.org/projects/commercial/rules/
>>> http://www.modsecurity.org/projects/commercial/support/
>>>
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>>
>
>
> --
> --
> Chaim Sanders
> http://www.ChaimSanders.com
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Re: [mod-security-users] Testing modsecurity

[Chaim S. <ch...@ch...>]

Just for your information, the order of rules is relevant, so you were
loading CRS *before* turning on the engine, so the default applied. I
assume by uncommenting crs-setup you placed that before the CRS includes
and therefore the rule engine was on. Not a biggy, can be confusing - but
we're here to help! Come join us on the CRS mailing lists if you have more
questions :)

https://groups.google.com/a/owasp.org/forum/#!forum/modsecurity-core-rule-set-project


On Thu, Mar 28, 2019 at 10:57 AM Monah Baki <mon...@gm...> wrote:

> Got it to block IP by uncommenting in crs-setup.conf
>
>
> SecDefaultAction "phase:1,log,auditlog,deny,status:403"
> SecDefaultAction "phase:2,log,auditlog,deny,status:403"
>
>
>
>
>
> On Mon, Mar 25, 2019 at 2:42 PM Chaim Sanders <ch...@ch...>
> wrote:
>
>> You probably don't have the rule engine in the blocking state. Generally
>> this means changing the SecRuleEngine directive to 'On'. For more details
>> see
>> https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#SecRuleEngine.
>> Let me know if that helps.
>>
>> On Mon, Mar 25, 2019 at 12:43 PM Monah Baki <mon...@gm...> wrote:
>>
>>> Hi all,
>>>
>>> Testing modsecurity, if I enter the IP address of the server, I get the
>>> following:
>>>
>>> [Mon Mar 25 12:34:02.300806 2019] [:error] [pid 14540] [client
>>> 192.168.1.11:57650] [client 192.168.1.11] ModSecurity: Warning. Pattern
>>> match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file
>>> "/etc/httpd/modsecurity.d/owasp-modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"]
>>> [line "798"] [id "920350"] [msg "Host header is a numeric IP address"]
>>> [data "192.168.1.2"] [severity "WARNING"] [ver "OWASP_CRS/3.1.0"] [tag
>>> "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag
>>> "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag
>>> "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname
>>> "192.168.1.2"] [uri "/favicon.ico"] [unique_id "XJkC@tolWxi51pCyjt7yHwAAAAI"],
>>> referer: http://192.168.1.2/
>>>
>>>
>>> I created a a test /etc/passwd in my root documentfolder, but I can
>>> still access the file, I read on a website this would be a simple test, am
>>> I missing something
>>>
>>>
>>> Thanks
>>> Monah
>>> _______________________________________________
>>> mod-security-users mailing list
>>> mod...@li...
>>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>>> http://www.modsecurity.org/projects/commercial/rules/
>>> http://www.modsecurity.org/projects/commercial/support/
>>>
>>
>>
>> --
>> --
>> Chaim Sanders
>> http://www.ChaimSanders.com
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>


-- 
-- 
Chaim Sanders
http://www.ChaimSanders.com

Re: [mod-security-users] Testing modsecurity

[Monah B. <mon...@gm...>]

Got it to block IP by uncommenting in crs-setup.conf


SecDefaultAction "phase:1,log,auditlog,deny,status:403"
SecDefaultAction "phase:2,log,auditlog,deny,status:403"





On Mon, Mar 25, 2019 at 2:42 PM Chaim Sanders <ch...@ch...>
wrote:

> You probably don't have the rule engine in the blocking state. Generally
> this means changing the SecRuleEngine directive to 'On'. For more details
> see
> https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#SecRuleEngine.
> Let me know if that helps.
>
> On Mon, Mar 25, 2019 at 12:43 PM Monah Baki <mon...@gm...> wrote:
>
>> Hi all,
>>
>> Testing modsecurity, if I enter the IP address of the server, I get the
>> following:
>>
>> [Mon Mar 25 12:34:02.300806 2019] [:error] [pid 14540] [client
>> 192.168.1.11:57650] [client 192.168.1.11] ModSecurity: Warning. Pattern
>> match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file
>> "/etc/httpd/modsecurity.d/owasp-modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"]
>> [line "798"] [id "920350"] [msg "Host header is a numeric IP address"]
>> [data "192.168.1.2"] [severity "WARNING"] [ver "OWASP_CRS/3.1.0"] [tag
>> "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag
>> "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag
>> "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname
>> "192.168.1.2"] [uri "/favicon.ico"] [unique_id "XJkC@tolWxi51pCyjt7yHwAAAAI"],
>> referer: http://192.168.1.2/
>>
>>
>> I created a a test /etc/passwd in my root documentfolder, but I can still
>> access the file, I read on a website this would be a simple test, am I
>> missing something
>>
>>
>> Thanks
>> Monah
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>>
>
>
> --
> --
> Chaim Sanders
> http://www.ChaimSanders.com
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Re: [mod-security-users] Testing modsecurity

[Monah B. <mon...@gm...>]

I am still able to access the site via IP address
even though my config file are as follows:

My modsecurity.conf file

<IfModule mod_security2.c>
    # ModSecurity Core Rules Set configuration
        IncludeOptional modsecurity.d/owasp-modsecurity-crs/*.conf
        IncludeOptional modsecurity.d/owasp-modsecurity-crs/rules/*.conf

    # Default recommended configuration
    SecRuleEngine On
    SecRequestBodyAccess On
    SecStatusEngine On
    SecRequestBodyLimit 13107200




One of the rules that it's firing on

SecRule REQUEST_HEADERS:Host "@rx ^[\d.:]+$" \
    "id:920350,\
    phase:2,\
    block,\
    t:none,\
    msg:'Host header is a numeric IP address',\
    logdata:'%{MATCHED_VAR}',\
    tag:'application-multi',\
    tag:'language-multi',\
    tag:'platform-multi',\
    tag:'attack-protocol',\
    tag:'OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST',\
    tag:'WASCTC/WASC-21',\
    tag:'OWASP_TOP_10/A7',\
    tag:'PCI/6.5.10',\
    ver:'OWASP_CRS/3.1.0',\
    severity:'WARNING',\
    setvar:'tx.msg=%{rule.msg}',\
    setvar:'tx.anomaly_score_pl1=+%{tx.warning_anomaly_score}',\
    setvar:'tx.%{rule.id
}-OWASP_CRS/POLICY/IP_HOST-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}'"


Thanks
Monah

On Mon, Mar 25, 2019 at 2:42 PM Chaim Sanders <ch...@ch...>
wrote:

> You probably don't have the rule engine in the blocking state. Generally
> this means changing the SecRuleEngine directive to 'On'. For more details
> see
> https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#SecRuleEngine.
> Let me know if that helps.
>
> On Mon, Mar 25, 2019 at 12:43 PM Monah Baki <mon...@gm...> wrote:
>
>> Hi all,
>>
>> Testing modsecurity, if I enter the IP address of the server, I get the
>> following:
>>
>> [Mon Mar 25 12:34:02.300806 2019] [:error] [pid 14540] [client
>> 192.168.1.11:57650] [client 192.168.1.11] ModSecurity: Warning. Pattern
>> match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file
>> "/etc/httpd/modsecurity.d/owasp-modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"]
>> [line "798"] [id "920350"] [msg "Host header is a numeric IP address"]
>> [data "192.168.1.2"] [severity "WARNING"] [ver "OWASP_CRS/3.1.0"] [tag
>> "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag
>> "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag
>> "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname
>> "192.168.1.2"] [uri "/favicon.ico"] [unique_id "XJkC@tolWxi51pCyjt7yHwAAAAI"],
>> referer: http://192.168.1.2/
>>
>>
>> I created a a test /etc/passwd in my root documentfolder, but I can still
>> access the file, I read on a website this would be a simple test, am I
>> missing something
>>
>>
>> Thanks
>> Monah
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>>
>
>
> --
> --
> Chaim Sanders
> http://www.ChaimSanders.com
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Re: [mod-security-users] JSON support was not enabled

[Felipe R. <fel...@gm...>]

nginx_refactoring branch is almost five years old. You're probably want
v2.9.3  or master branch which is libmodsecurity (v3).

On Wed, Mar 27, 2019 at 1:32 AM junaid.khan <jun...@na...> wrote:

> CentOS Linux release 7.6.1810 (Core)
>
> NAME="CentOS Linux"
>
> VERSION="7 (Core)"
>
> ID="centos"
>
> ID_LIKE="rhel fedora"
>
> VERSION_ID="7"
>
> PRETTY_NAME="CentOS Linux 7 (Core)"
>
> ANSI_COLOR="0;31"
>
> CPE_NAME="cpe:/o:centos:centos:7"
>
> HOME_URL="https://www.centos.org/"
>
> BUG_REPORT_URL=https://bugs.centos.org/
>
>
>
> *Install Nginx Modsecurity:*
>
>
>
> I install nginx through below mention link
>
>
> https://www.thermo.io/how-to/security/installing-modsec-for-nginx-on-centos7
>
>
>
> also used mention link to enable Jason support in modsecurity but still
> facing issue
>
>
>
>
> https://stackoverflow.com/questions/35202761/json-support-was-not-enabled-modsecurity
>
>
>
> *From:* Eero Volotinen [mailto:eer...@ik...]
> *Sent:* Tuesday, March 26, 2019 7:19 PM
> *To:* mod...@li...
> *Subject:* Re: [mod-security-users] JSON support was not enabled
>
>
>
> Please specify your Linux OS version, distribution name and what package
> repository is used to install nginx modsecurity module?
>
>
>
> Eero
>
>
>
> On Tue, Mar 26, 2019 at 6:39 AM junaid.khan <jun...@na...>
> wrote:
>
> Dear Support
>
>
>
> I need to enable JSON support on mod_sec nginx kindly guide how I enable
> it.
>
>
>
>
>
> 2019/03/19 17:28:22 [error] 5750#0: [client 10.1.1.24] ModSecurity:
> Warning. Match of "within %{tx.allowed_http_versions}" against
> "REQUEST_PROTOCOL" required. [file
> "/usr/local/nginx/conf/owasp-modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"]
> [line "1084"] [id "920430"] [msg "HTTP protocol version is not allowed by
> policy"] [data "HTTP/1.1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.1.0"]
> [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"]
> [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/PROTOCOL_NOT_ALLOWED"] [tag
> "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A6"] [tag "PCI/6.5.10"] [hostname ""]
> [uri "/nayapay-middleware-0.0.1/app-data/get-nayapay-id"] [unique_id
> "AcAcAcAcAcAYlcAcAbAcAcA2"]
>
> 2019/03/19 17:28:22 [error] 5750#0: [client 10.1.1.24] ModSecurity: JSON
> support was not enabled [hostname ""] [uri
> "/nayapay-middleware-0.0.1/app-data/get-nayapay-id"] [unique_id
> "AcAcAcAcAcAYlcAcAbAcAcA2"]
>
> 2019/03/19 17:28:22 [error] 5750#0: [client 10.1.1.24] ModSecurity: Access
> denied with code 400 (phase 2). Match of "eq 0" against "REQBODY_ERROR"
> required. [file "/usr/local/nginx/conf/modsecurity.conf"] [line "60"] [id
> "200002"] [msg "Failed to parse request body."] [data ""] [severity
> "CRITICAL"] [hostname ""] [uri
> "/nayapay-middleware-0.0.1/app-data/get-nayapay-id"] [unique_id
> "AcAcAcAcAcAYlcAcAbAcAcA2"]
>
> ^C
>
>
>
> Regards,
>
> *Junaid Khan*  |  *System Administrator*
>
> +92 03018281775   | +92 21 38400633 [Ext: 5531]
>
> jun...@na...   |   www.nayapay.com
>
> [image: cid:image001.png@01D43481.09450210]
>
>
>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>


-- 
*Nenhum Sonho é grande demais.*

Re: [mod-security-users] JSON support was not enabled

[junaid.khan <jun...@na...>]

CentOS Linux release 7.6.1810 (Core) 

NAME="CentOS Linux"

VERSION="7 (Core)"

ID="centos"

ID_LIKE="rhel fedora"

VERSION_ID="7"

PRETTY_NAME="CentOS Linux 7 (Core)"

ANSI_COLOR="0;31"

CPE_NAME="cpe:/o:centos:centos:7"

HOME_URL="https://www.centos.org/"

BUG_REPORT_URL=https://bugs.centos.org/

 

Install Nginx Modsecurity:

 

I install nginx through below mention link

https://www.thermo.io/how-to/security/installing-modsec-for-nginx-on-centos7

 

also used mention link to enable Jason support in modsecurity but still facing issue

 

https://stackoverflow.com/questions/35202761/json-support-was-not-enabled-modsecurity

 

From: Eero Volotinen [mailto:eer...@ik...] 
Sent: Tuesday, March 26, 2019 7:19 PM
To: mod...@li...
Subject: Re: [mod-security-users] JSON support was not enabled

 

Please specify your Linux OS version, distribution name and what package repository is used to install nginx modsecurity module?

 

Eero

 

On Tue, Mar 26, 2019 at 6:39 AM junaid.khan <jun...@na... <mailto:jun...@na...> > wrote:

Dear Support

 

I need to enable JSON support on mod_sec nginx kindly guide how I enable it.

 

 

2019/03/19 17:28:22 [error] 5750#0: [client 10.1.1.24] ModSecurity: Warning. Match of "within %{tx.allowed_http_versions}" against "REQUEST_PROTOCOL" required. [file "/usr/local/nginx/conf/owasp-modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1084"] [id "920430"] [msg "HTTP protocol version is not allowed by policy"] [data "HTTP/1.1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.1.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/PROTOCOL_NOT_ALLOWED"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A6"] [tag "PCI/6.5.10"] [hostname ""] [uri "/nayapay-middleware-0.0.1/app-data/get-nayapay-id"] [unique_id "AcAcAcAcAcAYlcAcAbAcAcA2"]

2019/03/19 17:28:22 [error] 5750#0: [client 10.1.1.24] ModSecurity: JSON support was not enabled [hostname ""] [uri "/nayapay-middleware-0.0.1/app-data/get-nayapay-id"] [unique_id "AcAcAcAcAcAYlcAcAbAcAcA2"]

2019/03/19 17:28:22 [error] 5750#0: [client 10.1.1.24] ModSecurity: Access denied with code 400 (phase 2). Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/nginx/conf/modsecurity.conf"] [line "60"] [id "200002"] [msg "Failed to parse request body."] [data ""] [severity "CRITICAL"] [hostname ""] [uri "/nayapay-middleware-0.0.1/app-data/get-nayapay-id"] [unique_id "AcAcAcAcAcAYlcAcAbAcAcA2"]

^C

 

Regards,

Junaid Khan  |  System Administrator

+92 03018281775   | +92 21 38400633 [Ext: 5531]

jun...@na... <mailto:jun...@na...>    |    <http://www.nayapay.com/> www.nayapay.com



 

 

_______________________________________________
mod-security-users mailing list
mod...@li... <mailto:mod...@li...> 
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/