mod-security-users — General discussion about mod_security

[mod-security-users] SecRule TX:HIGH_RISK_COUNTRY_CODES does not trigger ?

[Frederic F. <fre...@gm...>]

Hello all,

First post in this list !

I’m playing with what should be a super-simple setup (NGINX+modsecurity+CRS 3.0).
Still, not everything is working as expected.

I’m trying to block requests from some countries (I’m testing from a CH IP).

In my REQUEST-910-IP-REPUTATION.conf sits the rule which I want to use:

#
# -=[ GeoIP Checks ]=-
#
# This rule requires activating the SecGeoLookupDB directive
# in the crs-setup.conf file and specifying
# the list of blocked countries (tx.high_risk_country_codes).
#
# This rule does a GeoIP resolution on the client IP address.
#
SecRule TX:HIGH_RISK_COUNTRY_CODES "!^$" \
"msg:'Client IP is from a HIGH Risk Country Location.',\
 severity:'CRITICAL',\
 id:910100,\
 phase:request,\
 log,\
 block,\
 t:none,\
 tag:'application-multi',\
 tag:'language-multi',\
 tag:'platform-multi',\
 tag:'attack-reputation-ip',\
 chain"
 SecRule TX:REAL_IP "@geoLookup" \
  "chain"
   SecRule GEO:COUNTRY_CODE "@within %{tx.high_risk_country_codes}" \
    "setvar:'tx.msg=%{rule.msg}',\
     setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},\
     setvar:tx.%{rule.id <http://rule.id/>}-AUTOMATION/MALICIOUS-%{matched_var_name}=%{matched_var},\
     setvar:ip.reput_block_flag=1,\
     expirevar:ip.reput_block_flag=%{tx.reput_block_duration},\
     setvar:'ip.reput_block_reason=%{rule.msg}'"


And in my crs-setup.conf I have:

SecAction \
"id:900600,\
 phase:1,\
 log,\
 pass,\
 t:none,\
 setvar:'tx.high_risk_country_codes=CH YU LT EG’"


Now, I can find rule ID 900600 in my audit log but not rule ID 910100, see below. 


---UkhFLq7B---A--
[04/Jan/2018:14:20:10 +0000] 151507561010.797697 37.0.34.57 28266 37.0.34.57 80
---UkhFLq7B---B--
GET / HTTP/1.1
Host: xxxxxx.northeurope.cloudapp.azure.com <http://xxxxxx.northeurope.cloudapp.azure.com/>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:57.0) Gecko/20100101 Firefox/57.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
If-Modified-Since: Tue, 26 Dec 2017 16:01:12 GMT
If-None-Match: "5a427248-264"

---UkhFLq7B---D--

---UkhFLq7B---F--
HTTP/1.1 304
Server: nginx/1.13.8
Date: Thu, 04 Jan 2018 14:20:10 GMT
Last-Modified: Tue, 26 Dec 2017 16:01:12 GMT
Connection: keep-alive
ETag: "5a427248-264"

---UkhFLq7B---H--
ModSecurity: Warning.  [file "/etc/nginx/modsec/crs-setup.conf"] [line "563"] [id "900600"] [rev ""] [msg ""] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "37.0.34.57"] [uri "/"] [unique_id "151507561010.797697"] [ref ""]

---UkhFLq7B---I--

---UkhFLq7B---J--

---UkhFLq7B---Z--



My “paranoia level" is set to 1. I know for sure that CRS rules are enforced, if I change the paranoia level to 4 and launch requests containing special characters other rules do trigger.

Thanks a lot for your help with this.

Best,

Fred

Re: [mod-security-users] Selective "DetectionOnly"

[Christian F. <chr...@ne...>]

On Fri, Dec 22, 2017 at 05:31:46PM +0000, Ed Greenberg wrote:
>    Good explanation. I'll give that a try, and post a success or failure.

That's a plan. Good luck!

Christian

> 
> 
> 
> --
> 
>    Ed Greenberg  |  Web Developer and LInux System Administrator
>    __________________________________________________________________
> 
>    HAPPY Software, Inc. l  Work HAPPY-er!
>    t. 888-484-2779  l  f. 518-584-5388
>    This message and any of its attachments are intended only for the use
>    of the designated recipient, or the recipient’s designee, and may
>    contain information that is confidential or privileged. If you are not
>    the intended recipient, please immediately notify HAPPY Software, Inc.,
>    delete all copies of the message and any attachments and do not
>    disseminate or make any use of their contents.

> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot

> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/


-- 
https://www.feistyduck.com/training/modsecurity-training-course
https://www.feistyduck.com/books/modsecurity-handbook/
mailto:chr...@ne...
twitter: @ChrFolini

Re: [mod-security-users] Selective "DetectionOnly"

[Ed G. <ED...@ha...>]

On Fri, 2017-12-22 at 18:29 +0100, Christian Folini wrote:

Ed,

On Fri, Dec 22, 2017 at 05:13:02PM +0000, Ed Greenberg wrote:


   Christian, could you post an example of this?



Sorry. I'd rather not do that. There are 2-3 recipes that I keep for my
customers. At least for now. :)

But basically it's my standard whitelist recipe used in the book and
on netnea.com and whereever there is a deny, you do a log + setvar
instead. And then at the end you evaluate the variable - or two separate
variables in your case.

Ahoj,

Christian



Good explanation. I'll give that a try, and post a success or failure.





--

Ed Greenberg  |  Web Developer and LInux System Administrator
________________________________
HAPPY Software, Inc. l  Work HAPPY-er!
t. 888-484-2779  l  f. 518-584-5388

This message and any of its attachments are intended only for the use of the designated recipient, or the recipient’s designee, and may contain information that is confidential or privileged. If you are not the intended recipient, please immediately notify HAPPY Software, Inc., delete all copies of the message and any attachments and do not disseminate or make any use of their contents.

Re: [mod-security-users] Selective "DetectionOnly"

[Christian F. <chr...@ne...>]

Ed,

On Fri, Dec 22, 2017 at 05:13:02PM +0000, Ed Greenberg wrote:
>    Christian, could you post an example of this?

Sorry. I'd rather not do that. There are 2-3 recipes that I keep for my 
customers. At least for now. :)

But basically it's my standard whitelist recipe used in the book and
on netnea.com and whereever there is a deny, you do a log + setvar
instead. And then at the end you evaluate the variable - or two separate
variables in your case.

Ahoj,

Christian



-- 
Anyone who takes himself too seriously always runs the risk of looking
ridiculous; anyone who can consistently laugh at himself does not.
-- Václav Havel

Re: [mod-security-users] Selective "DetectionOnly"

[Ed G. <ED...@ha...>]

On Fri, 2017-12-22 at 18:07 +0100, Christian Folini wrote:

Hey Ed,

The way I write the whitelisting rules I use in production is that I separate
the rules from the action. That way I can switch the action lever (detection /
blocking) with a single config item.

I do not see any conceptual problem to use multiple variables to track
violations. One for the final blocking action and one for the final log-only
action.

Best,

Christian


Christian, could you post an example of this?

Thanks,


--

Ed Greenberg  |  Web Developer and LInux System Administrator
________________________________
HAPPY Software, Inc. l  Work HAPPY-er!
t. 888-484-2779  l  f. 518-584-5388

This message and any of its attachments are intended only for the use of the designated recipient, or the recipient’s designee, and may contain information that is confidential or privileged. If you are not the intended recipient, please immediately notify HAPPY Software, Inc., delete all copies of the message and any attachments and do not disseminate or make any use of their contents.

Re: [mod-security-users] Selective "DetectionOnly"

[Christian F. <chr...@ne...>]

Hey Ed,

The way I write the whitelisting rules I use in production is that I separate
the rules from the action. That way I can switch the action lever (detection /
blocking) with a single config item.

I do not see any conceptual problem to use multiple variables to track
violations. One for the final blocking action and one for the final log-only
action.

Best,

Christian

On Fri, Dec 22, 2017 at 01:39:59PM +0000, Ed Greenberg wrote:
>    Hi Folks,
> 
>    Once we have our rules in blocking, rather than DetectionOnly  mode,
>    we'd like to start reviewing some of our whitelisted rules.  Is it
>    possible to bring individual rules back but in detection only, or is
>    that an all-or-nothing setting?  Can somebody give an example of how to
>    set this up?
> 
>    Thanks,
> 
>    Ed
> 
> --
> 
>    Ed Greenberg  |  Web Developer and LInux System Administrator
>    __________________________________________________________________
> 
>    HAPPY Software, Inc. l  Work HAPPY-er!
>    t. 888-484-2779  l  f. 518-584-5388
>    This message and any of its attachments are intended only for the use
>    of the designated recipient, or the recipient’s designee, and may
>    contain information that is confidential or privileged. If you are not
>    the intended recipient, please immediately notify HAPPY Software, Inc.,
>    delete all copies of the message and any attachments and do not
>    disseminate or make any use of their contents.

> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot

> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/


-- 
https://www.feistyduck.com/training/modsecurity-training-course
https://www.feistyduck.com/books/modsecurity-handbook/
mailto:chr...@ne...
twitter: @ChrFolini

[mod-security-users] Selective "DetectionOnly"

[Ed G. <ED...@ha...>]

Hi Folks,

Once we have our rules in blocking, rather than DetectionOnly  mode, we'd like to start reviewing some of our whitelisted rules.  Is it possible to bring individual rules back but in detection only, or is that an all-or-nothing setting?  Can somebody give an example of how to set this up?

Thanks,

Ed



--

Ed Greenberg  |  Web Developer and LInux System Administrator
________________________________
HAPPY Software, Inc. l  Work HAPPY-er!
t. 888-484-2779  l  f. 518-584-5388

This message and any of its attachments are intended only for the use of the designated recipient, or the recipient’s designee, and may contain information that is confidential or privileged. If you are not the intended recipient, please immediately notify HAPPY Software, Inc., delete all copies of the message and any attachments and do not disseminate or make any use of their contents.

[mod-security-users] collections_remove_stale: Failed deleting collection (#1635)

[Ed G. <ED...@ha...>]

@zimmerle,

So I read over the bug you referenced (576) but it's still not clear whether (a) this error would cause ModSecurity to block the page and (b) if so, which of the many suggestions I should implement:

1 Delete the ip.dir and ip.pag regularly
2. Turn on global mutex per #1224
3. implement modsec-sdbm-util on a cron job

Can you please advise.



--

Ed Greenberg  |  Web Developer and LInux System Administrator
________________________________
HAPPY Software, Inc. l  Work HAPPY-er!
t. 888-484-2779  l  f. 518-584-5388

This message and any of its attachments are intended only for the use of the designated recipient, or the recipient’s designee, and may contain information that is confidential or privileged. If you are not the intended recipient, please immediately notify HAPPY Software, Inc., delete all copies of the message and any attachments and do not disseminate or make any use of their contents.

[mod-security-users] ModSecurity nginx connector version 1.0.0 announcement

[Felipe C. <FC...@tr...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



It is a pleasure to announce the release of ModSecurity nginx connector,
version 1.0.0. This is the first version for the nginx connector.

This connector is meant to work together with ModSecurity version 3.

The version 1.0.0 can be downloaded straight from GitHub:
https://github.com/SpiderLabs/ModSecurity-nginx/releases/tag/v1.0.0/

The list of open issues is available on GitHub:
https://github.com/SpiderLabs/ModSecurity-nginx/issues?q=is%3Aissue+is%3Aopen

Thanks to everybody who helped in this process: reporting issues, making
comments and suggestions, sending patches and so on. Special thanks to Andrei
Belov and nginx.

Further details on the compilation process can be found on the project README:
 - https://github.com/SpiderLabs/ModSecurity-nginx/#compilation

Complementary documentation on ModSecurity version 3 can be found here:
 - https://github.com/SpiderLabs/ModSecurity/tree/v3/master


Br.,
Felipe "Zimmerle" Costa
Security Researcher, Lead Developer ModSecurity.

Trustwave | SMART SECURITY ON DEMAND
www.trustwave.com
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iF0EARECAB0WIQQZDvrMoen6RmqOzZzm37CM6LESdwUCWjqznQAKCRDm37CM6LES
dzrOAJ9vkq75BATo+pH4jmRccOOf83fMpQCeIkF3CApuOzaBx8/5RdIumhqtr8I=
=0Gj3
-----END PGP SIGNATURE-----

Re: [mod-security-users] Conditional SecRuleRemoveById

[Christian F. <chr...@ne...>]

On Tue, Dec 19, 2017 at 01:08:31PM +0000, Ed Greenberg wrote:
>    Actually a  BIG thank you to all, since we are going live (turning off
>    DetectOnly) site by site, over the next few weeks.
> 
>    My boss has totally fallen in love with ModSecurity, now that I showed
>    him how to read the logs and he sees what we're blocking.

That's great news Ed! Congratulations.

How about writing a success story for the coreruleset.org blog?

Cheers!

Christian

> 
> --
> 
>    Ed Greenberg  |  Web Developer and LInux System Administrator
>    __________________________________________________________________
> 
>    HAPPY Software, Inc. l  Work HAPPY-er!
>    t. 888-484-2779  l  f. 518-584-5388
>    This message and any of its attachments are intended only for the use
>    of the designated recipient, or the recipient’s designee, and may
>    contain information that is confidential or privileged. If you are not
>    the intended recipient, please immediately notify HAPPY Software, Inc.,
>    delete all copies of the message and any attachments and do not
>    disseminate or make any use of their contents.

> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot

> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/


-- 
https://www.feistyduck.com/training/modsecurity-training-course
https://www.feistyduck.com/books/modsecurity-handbook/
mailto:chr...@ne...
twitter: @ChrFolini

Re: [mod-security-users] Conditional SecRuleRemoveById

[Ed G. <ED...@ha...>]

Marc's suggestion worked.  <Location> is my friend.

And Christian's tutorials are a treasure trove.

Thanks to both of you.

Actually a  BIG thank you to all, since we are going live (turning off DetectOnly) site by site, over the next few weeks.

My boss has totally fallen in love with ModSecurity, now that I showed him how to read the logs and he sees what we're blocking.



--

Ed Greenberg  |  Web Developer and LInux System Administrator
________________________________
HAPPY Software, Inc. l  Work HAPPY-er!
t. 888-484-2779  l  f. 518-584-5388

This message and any of its attachments are intended only for the use of the designated recipient, or the recipient’s designee, and may contain information that is confidential or privileged. If you are not the intended recipient, please immediately notify HAPPY Software, Inc., delete all copies of the message and any attachments and do not disseminate or make any use of their contents.

Re: [mod-security-users] Conditional SecRuleRemoveById

[Marc S. <mar...@ap...>]

Definitely! We heavily use this in our "default deny" framework: we 
block everything and open things in locations (via macros);
This allows a real "default deny" Approach with proper management.
Ex:
<Location /myapp>
  Use FrameworkDotNetMVC
  Use FrameworkJquery
  Use GoogleApi
  Use GoogleAnalytics
</Location>
In the above example, the macro FrameworkDotNetMVC will contain a lot of 
SecRuleRemoveById corresponding to the .NET framework, MVC.NET, plus 
some specific rules for IIS, etc.

And this works in production for more than 15 years ;-)

On 19-12-17 09:01, Christian Folini wrote:
> Marks,
>
> Seriously, this works? Awesome.
>
> I never do Locations but maybe that's a mistake.
>
> Thanks for correcting me.
>
> Christian
>
> On Tue, Dec 19, 2017 at 08:19:14AM +0100, Marc Stern wrote:
>> The following works:
>> <Location /assistancecheck/sendddocument.php>
>>             SecRuleRemoveById 210220
>>             SecRuleRemoveById 210240
>> </Location>
>>
>> This is because a separate context is built for each location at config time
>>
>> On 19-12-17 08:12, Christian Folini wrote:
>>> Hey Ed,
>>>
>>> Sorry, this won't work.
>>>
>>> Reason being SecRuleRemoveById is a startup / config time directive. It
>>> removes the rule from the list of rules at the startup of the server.
>>> The directive is not evaluated during the handling of the requests.
>>>
>>> What you want is to apply the exclusion conditionally at runtime. That's what
>>> the ctl:ruleRemoveById action (and friends) are here for.
>>>
>>> The details are described in a certain detail in my tutorial at
>>> https://www.netnea.com/cms/apache-tutorial-7_including-modsecurity-core-rules/
>>> in step 7 and 8. Plus a handy cheatsheet near the end of the guide.
>>>
>>> Hope this helps.
>>>
>>> Christian
>>>
>>>
>>> On Mon, Dec 18, 2017 at 06:06:02PM +0000, Ed Greenberg wrote:
>>>>      I'm trying to remove a rule for only one page.
>>>>
>>>>      Does this look correct?
>>>>
>>>>      <Directory "/var/www/html/assistancecheck">
>>>>
>>>>          <Files "sendddocument.php">
>>>>
>>>>              SecRuleRemoveById 210220
>>>>
>>>>              SecRuleRemoveById 210240
>>>>
>>>>          </Files>
>>>>
>>>>      </Directory>
>>>>
>>>>      When I make it unconditional, it works.
>>>>
>>>>      Thanks
>>>>
>>>> --
>>>>
>>>>      Ed Greenberg  |  Web Developer and LInux System Administrator
>>>>      __________________________________________________________________
>>>>
>>>>      HAPPY Software, Inc. l  Work HAPPY-er!
>>>>      t. 888-484-2779  l  f. 518-584-5388
>>>>      This message and any of its attachments are intended only for the use
>>>>      of the designated recipient, or the recipient’s designee, and may
>>>>      contain information that is confidential or privileged. If you are not
>>>>      the intended recipient, please immediately notify HAPPY Software, Inc.,
>>>>      delete all copies of the message and any attachments and do not
>>>>      disseminate or make any use of their contents.
>>>> ------------------------------------------------------------------------------
>>>> Check out the vibrant tech community on one of the world's most
>>>> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>>>> _______________________________________________
>>>> mod-security-users mailing list
>>>> mod...@li...
>>>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>>>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>>>> http://www.modsecurity.org/projects/commercial/rules/
>>>> http://www.modsecurity.org/projects/commercial/support/
>>
>> ------------------------------------------------------------------------------
>> Check out the vibrant tech community on one of the world's most
>> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] Conditional SecRuleRemoveById

[Christian F. <chr...@ne...>]

Marks,

Seriously, this works? Awesome. 

I never do Locations but maybe that's a mistake. 

Thanks for correcting me.

Christian

On Tue, Dec 19, 2017 at 08:19:14AM +0100, Marc Stern wrote:
> The following works:
> <Location /assistancecheck/sendddocument.php>
>            SecRuleRemoveById 210220
>            SecRuleRemoveById 210240
> </Location>
> 
> This is because a separate context is built for each location at config time
> 
> On 19-12-17 08:12, Christian Folini wrote:
> > Hey Ed,
> > 
> > Sorry, this won't work.
> > 
> > Reason being SecRuleRemoveById is a startup / config time directive. It
> > removes the rule from the list of rules at the startup of the server.
> > The directive is not evaluated during the handling of the requests.
> > 
> > What you want is to apply the exclusion conditionally at runtime. That's what
> > the ctl:ruleRemoveById action (and friends) are here for.
> > 
> > The details are described in a certain detail in my tutorial at
> > https://www.netnea.com/cms/apache-tutorial-7_including-modsecurity-core-rules/
> > in step 7 and 8. Plus a handy cheatsheet near the end of the guide.
> > 
> > Hope this helps.
> > 
> > Christian
> > 
> > 
> > On Mon, Dec 18, 2017 at 06:06:02PM +0000, Ed Greenberg wrote:
> > >     I'm trying to remove a rule for only one page.
> > > 
> > >     Does this look correct?
> > > 
> > >     <Directory "/var/www/html/assistancecheck">
> > > 
> > >         <Files "sendddocument.php">
> > > 
> > >             SecRuleRemoveById 210220
> > > 
> > >             SecRuleRemoveById 210240
> > > 
> > >         </Files>
> > > 
> > >     </Directory>
> > > 
> > >     When I make it unconditional, it works.
> > > 
> > >     Thanks
> > > 
> > > --
> > > 
> > >     Ed Greenberg  |  Web Developer and LInux System Administrator
> > >     __________________________________________________________________
> > > 
> > >     HAPPY Software, Inc. l  Work HAPPY-er!
> > >     t. 888-484-2779  l  f. 518-584-5388
> > >     This message and any of its attachments are intended only for the use
> > >     of the designated recipient, or the recipient’s designee, and may
> > >     contain information that is confidential or privileged. If you are not
> > >     the intended recipient, please immediately notify HAPPY Software, Inc.,
> > >     delete all copies of the message and any attachments and do not
> > >     disseminate or make any use of their contents.
> > > ------------------------------------------------------------------------------
> > > Check out the vibrant tech community on one of the world's most
> > > engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> > > _______________________________________________
> > > mod-security-users mailing list
> > > mod...@li...
> > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > http://www.modsecurity.org/projects/commercial/rules/
> > > http://www.modsecurity.org/projects/commercial/support/
> > 
> 
> 
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

-- 
https://www.feistyduck.com/training/modsecurity-training-course
https://www.feistyduck.com/books/modsecurity-handbook/
mailto:chr...@ne...
twitter: @ChrFolini

Re: [mod-security-users] Conditional SecRuleRemoveById

[Marc S. <mar...@ap...>]

The following works:
<Location /assistancecheck/sendddocument.php>
            SecRuleRemoveById 210220
            SecRuleRemoveById 210240
</Location>

This is because a separate context is built for each location at config time

On 19-12-17 08:12, Christian Folini wrote:
> Hey Ed,
>
> Sorry, this won't work.
>
> Reason being SecRuleRemoveById is a startup / config time directive. It
> removes the rule from the list of rules at the startup of the server.
> The directive is not evaluated during the handling of the requests.
>
> What you want is to apply the exclusion conditionally at runtime. That's what
> the ctl:ruleRemoveById action (and friends) are here for.
>
> The details are described in a certain detail in my tutorial at
> https://www.netnea.com/cms/apache-tutorial-7_including-modsecurity-core-rules/
> in step 7 and 8. Plus a handy cheatsheet near the end of the guide.
>
> Hope this helps.
>
> Christian
>
>
> On Mon, Dec 18, 2017 at 06:06:02PM +0000, Ed Greenberg wrote:
>>     I'm trying to remove a rule for only one page.
>>
>>     Does this look correct?
>>
>>     <Directory "/var/www/html/assistancecheck">
>>
>>         <Files "sendddocument.php">
>>
>>             SecRuleRemoveById 210220
>>
>>             SecRuleRemoveById 210240
>>
>>         </Files>
>>
>>     </Directory>
>>
>>     When I make it unconditional, it works.
>>
>>     Thanks
>>
>> --
>>
>>     Ed Greenberg  |  Web Developer and LInux System Administrator
>>     __________________________________________________________________
>>
>>     HAPPY Software, Inc. l  Work HAPPY-er!
>>     t. 888-484-2779  l  f. 518-584-5388
>>     This message and any of its attachments are intended only for the use
>>     of the designated recipient, or the recipient’s designee, and may
>>     contain information that is confidential or privileged. If you are not
>>     the intended recipient, please immediately notify HAPPY Software, Inc.,
>>     delete all copies of the message and any attachments and do not
>>     disseminate or make any use of their contents.
>> ------------------------------------------------------------------------------
>> Check out the vibrant tech community on one of the world's most
>> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>

Re: [mod-security-users] Conditional SecRuleRemoveById

[Christian F. <chr...@ne...>]

Hey Ed,

Sorry, this won't work.

Reason being SecRuleRemoveById is a startup / config time directive. It 
removes the rule from the list of rules at the startup of the server.
The directive is not evaluated during the handling of the requests.

What you want is to apply the exclusion conditionally at runtime. That's what
the ctl:ruleRemoveById action (and friends) are here for.

The details are described in a certain detail in my tutorial at
https://www.netnea.com/cms/apache-tutorial-7_including-modsecurity-core-rules/
in step 7 and 8. Plus a handy cheatsheet near the end of the guide.

Hope this helps.

Christian


On Mon, Dec 18, 2017 at 06:06:02PM +0000, Ed Greenberg wrote:
>    I'm trying to remove a rule for only one page.
> 
>    Does this look correct?
> 
>    <Directory "/var/www/html/assistancecheck">
> 
>        <Files "sendddocument.php">
> 
>            SecRuleRemoveById 210220
> 
>            SecRuleRemoveById 210240
> 
>        </Files>
> 
>    </Directory>
> 
>    When I make it unconditional, it works.
> 
>    Thanks
> 
> --
> 
>    Ed Greenberg  |  Web Developer and LInux System Administrator
>    __________________________________________________________________
> 
>    HAPPY Software, Inc. l  Work HAPPY-er!
>    t. 888-484-2779  l  f. 518-584-5388
>    This message and any of its attachments are intended only for the use
>    of the designated recipient, or the recipient’s designee, and may
>    contain information that is confidential or privileged. If you are not
>    the intended recipient, please immediately notify HAPPY Software, Inc.,
>    delete all copies of the message and any attachments and do not
>    disseminate or make any use of their contents.

> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot

> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/


-- 
https://www.feistyduck.com/training/modsecurity-training-course
https://www.feistyduck.com/books/modsecurity-handbook/
mailto:chr...@ne...
twitter: @ChrFolini

[mod-security-users] Conditional SecRuleRemoveById

[Ed G. <ED...@ha...>]

I'm trying to remove a rule for only one page.

Does this look correct?

<Directory "/var/www/html/assistancecheck">
    <Files "sendddocument.php">
        SecRuleRemoveById 210220
        SecRuleRemoveById 210240
    </Files>
</Directory>

When I make it unconditional, it works.

Thanks

--

Ed Greenberg  |  Web Developer and LInux System Administrator
________________________________
HAPPY Software, Inc. l  Work HAPPY-er!
t. 888-484-2779  l  f. 518-584-5388

This message and any of its attachments are intended only for the use of the designated recipient, or the recipient’s designee, and may contain information that is confidential or privileged. If you are not the intended recipient, please immediately notify HAPPY Software, Inc., delete all copies of the message and any attachments and do not disseminate or make any use of their contents.

Re: [mod-security-users] LoadModule arguments for 3.0.0

[Felipe C. <FC...@tr...>]

Hi Ed,


ModSecurity version 3.x is not longer an Apache module, but a library. In order to have it working on Apache, you have to have the Apache connector installed. You can find further information here:

 - https://github.com/SpiderLabs/ModSecurity-apache


Notice however that the Apache connector is not yet production ready. It still under testing.


Br.,

Felipe “Zimmerle” Costa

Security Researcher, Lead Developer ModSecurity.



Trustwave | SMART SECURITY ON DEMAND

www.trustwave.com<http://www.trustwave.com/>



________________________________
From: Ed Greenberg <ED...@ha...>
Sent: Friday, December 15, 2017 4:58:47 PM
To: mod...@li...
Subject: [mod-security-users] LoadModule arguments for 3.0.0

Hi Folks, I looked for this in various documentation, but never found an answer

Load the ModSecurity module with:

LoadModule security2_module modules/MyModSecurity3.so (or whatever I call it)



What is the correct first argument for this line?  Is it still security2_module?

Did I miss this in the documentation somewhere?

Thanks,
Ed

--

Ed Greenberg  |  Web Developer and LInux System Administrator
________________________________
HAPPY Software, Inc. l  Work HAPPY-er!
t. 888-484-2779  l  f. 518-584-5388

This message and any of its attachments are intended only for the use of the designated recipient, or the recipient’s designee, and may contain information that is confidential or privileged. If you are not the intended recipient, please immediately notify HAPPY Software, Inc., delete all copies of the message and any attachments and do not disseminate or make any use of their contents.

[mod-security-users] LoadModule arguments for 3.0.0

[Ed G. <ED...@ha...>]

Hi Folks, I looked for this in various documentation, but never found an answer

Load the ModSecurity module with:

LoadModule security2_module modules/MyModSecurity3.so (or whatever I call it)



What is the correct first argument for this line?  Is it still security2_module?

Did I miss this in the documentation somewhere?

Thanks,
Ed

--

Ed Greenberg  |  Web Developer and LInux System Administrator
________________________________
HAPPY Software, Inc. l  Work HAPPY-er!
t. 888-484-2779  l  f. 518-584-5388

This message and any of its attachments are intended only for the use of the designated recipient, or the recipient’s designee, and may contain information that is confidential or privileged. If you are not the intended recipient, please immediately notify HAPPY Software, Inc., delete all copies of the message and any attachments and do not disseminate or make any use of their contents.

Re: [mod-security-users] BUilding 3.0.0

[Felipe C. <FC...@tr...>]

Hi Ed,


Good point.


Let me try to compile a list with dependency vs functionality.


+ GeoIP: Used by the operator @GeoLookup and variables: COUNTRY_CODE, COUNTRY_CODE3, COUNTRY_NAME, COUNTRY_CONTINENT,

REGION, CITY, POSTAL_CODE, LATITUDE, LONGITUDE, DMA_CODE, AREA_CODE


+ LibCURL: SecRemoteRules directive and external resources download.


+ YAJL: JSON support for logging and the ability to parser JSON data.


+ LMDB: Support for the lmdb as a collection backend.


+ SSDEEP: @fuzzyHash operator


+ LUA: Lua script execution from @inpectFile or exec action.



Br.,

Felipe “Zimmerle” Costa

Security Researcher, Lead Developer ModSecurity.



Trustwave | SMART SECURITY ON DEMAND

www.trustwave.com<http://www.trustwave.com/>



________________________________
From: Ed Greenberg <ED...@ha...>
Sent: Friday, December 15, 2017 11:02:51 AM
To: mod...@li...
Subject: [mod-security-users] BUilding 3.0.0

Thank you to the developers for all your work on Mod Security and congratulations on 3.0.0.

When running configure, I see this:

 Optional dependencies
   + GeoIP                                         ....not found
   + LibCURL                                       ....found v7.29.0
      -lcurl  ,  -DWITH_CURL
   + YAJL                                          ....not found
   + LMDB                                          ....not found
   + LibXML2                                       ....found v2.9.1
      -lxml2 -lz -lm -ldl, -I/usr/include/libxml2 -DWITH_LIBXML2
   + SSDEEP                                        ....not found
   + LUA                                           ....not found

Which of these missing optional depedencies would be worth adding to production Centos/Apache servers?

Thanks,


--

Ed Greenberg  |  Web Developer and LInux System Administrator
________________________________
HAPPY Software, Inc. l  Work HAPPY-er!
t. 888-484-2779  l  f. 518-584-5388

This message and any of its attachments are intended only for the use of the designated recipient, or the recipient’s designee, and may contain information that is confidential or privileged. If you are not the intended recipient, please immediately notify HAPPY Software, Inc., delete all copies of the message and any attachments and do not disseminate or make any use of their contents.

Re: [mod-security-users] BUilding 3.0.0

[Ervin H. <ai...@gm...>]

Hi Ed,


On Fri, Dec 15, 2017 at 01:02:51PM +0000, Ed Greenberg wrote:
> Thank you to the developers for all your work on Mod Security and congratulations on 3.0.0.
> 
> When running configure, I see this:
> 
>  Optional dependencies
>    + GeoIP                                         ....not found

on Debian, there are these packages:

geoip-bin geoip-database libgeoip-dev libgeoip1:amd64

looks like on RH these packages are with same names:

https://www.rpmfind.net/linux/rpm2html/search.php?query=geoip
https://www.rpmfind.net/linux/rpm2html/search.php?query=libgeoip

>    + YAJL                                          ....not found

Deb: libyajl-dev:amd64 libyajl2:amd64

RH: https://www.rpmfind.net/linux/rpm2html/search.php?query=yajl
RH: https://www.rpmfind.net/linux/rpm2html/search.php?query=libyajl

>    + LMDB                                          ....not found

Deb: liblmdb-dev:amd64 liblmdb0:amd64 lmdb-doc

RH: https://www.rpmfind.net/linux/rpm2html/search.php?query=lmdb
RH: https://www.rpmfind.net/linux/rpm2html/search.php?query=liblmdb

>    + SSDEEP                                        ....not found

on Debian 8, there isn't ssdeep package, only on Deb9, but I'm
not using so much prod system. There is the pkg sseed.

On Centos, I've found this:

https://apps.fedoraproject.org/packages/ssdeep/overview/

>    + LUA                                           ....not found

Deb: liblua5.1-0:amd64 liblua5.1-0-dev:amd64 liblua5.2-0:amd64
     liblua5.2-dev:amd64 libluajit-5.1-2:amd64 libluajit-5.1-common
     libluajit-5.1-dev:amd64 lua5.1 lua5.2

(you can install more version of Lua as paralell)

On RH, you can find many Lua packages:

https://www.rpmfind.net/linux/rpm2html/search.php?query=lua
https://www.rpmfind.net/linux/rpm2html/search.php?query=liblua
 
> Which of these missing optional depedencies would be worth adding to production Centos/Apache servers?

anyway, I'm not an expert RH user/admin, but as I remember, you
can search in packages with "rpm -qa | grep PATTERN", where the
pattern is what you're looking for.



Regards,

a.
 

Re: [mod-security-users] [Mod-security-developers] ModSecurity version 3.0.0 announcement

[Christian F. <chr...@ne...>]

On Fri, Dec 15, 2017 at 03:10:33PM +0000, Felipe Costa wrote:
>    Thank you Christian. Indeed I am very happy with this release :) Hope
>    to make the life of ModSecurity users better.

I bet it will!

>    Thanks, also, to everybody that was involved on with it, including you
>    :)

You're welcome. But we all know you did all the heavy lifting yourself!

Christian

> 
>    Br.,
> 
>    Felipe “Zimmerle” Costa
> 
>    Security Researcher, Lead Developer ModSecurity.
> 
> 
>    Trustwave | SMART SECURITY ON DEMAND
> 
>    [1]www.trustwave.com
>      __________________________________________________________________
> 
>    From: Christian Folini <chr...@ne...>
>    Sent: Friday, December 15, 2017 8:11:55 AM
>    To: mod...@li...;
>    mod...@li...
>    Subject: Re: [Mod-security-developers] ModSecurity version 3.0.0
>    announcement
> 
>    Congratulations Zimmerle!
>    This is a very big day and I am impressed by your achievement! I drink
>    to a
>    bright future for libModSecurity 3.0!
>    Christian
>    On Thu, Dec 14, 2017 at 10:26:17PM +0000, Felipe Costa wrote:
>    >
>    > It is a pleasure to announce the release of ModSecurity version
>    3.0.0, aka
>    > libModSecurity. This version contains fixes on top of v3.0.0-rc1 and
>    > improvements on some features.
>    >
>    > The most important addition of this release was the full support for
>    some
>    > missing pieces such as: Lua, SecRuleRemoveByTag and the @fuzzyHash
>    operator.
>    >
>    > At this point ModSecurity version 3 is considerable to be feature
>    complete. Any
>    > missing piece may not be suitable for version 3 family. At least not
>    > before discussion.
>    >
>    > The list with the full changes can be found on the project CHANGES
>    file,
>    > available here:
>    >  -
>    [2]https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0J
>    Y3XGs_SrVbV5HsA&s=5&u=https%3a%2f%2fgithub%2ecom%2fSpiderLabs%2fModSecu
>    rity%2freleases%2ftag%2fv3%2e0%2e0%2fCHANGES
>    >
>    > The version 3.0.0 can be downloaded straight from GitHub:
>    >  -
>    [3]https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0J
>    Y3XGs_XuJPgVM5w&s=5&u=https%3a%2f%2fgithub%2ecom%2fSpiderLabs%2fModSecu
>    rity%2freleases%2ftag%2fv3%2e0%2e0%2f
>    >
>    > The list of open issues is also available on GitHub:
>    >  -
>    [4]https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0J
>    Y3XGs_XuJOVNNsA&s=5&u=https%3a%2f%2fgithub%2ecom%2fSpiderLabs%2fModSecu
>    rity%2fissues%3fq%3dis%253Aissue%2bis%253Aopen%2blabel%253Alibmodsecuri
>    ty
>    >
>    > Notice that differently from version 2, ModSecurity v3 does not
>    target any
>    > specific web server or web server version. The version 3 is about a
>    library.
>    > The connectors are the ones responsible to create the link between
>    the web
>    > server and libModSecurity. Each web server should have its own
>    connector.
>    > Currently we support the Nginx connector and there is a Apache
>    connector
>    > available for test (not yet released).
>    >
>    > IMPORTANT: ModSecurity version 2 will be available and maintained
>    parallel
>    > to version 3. There is no ETA to deprecate the version 2.x. New
>    features and
>    > major improvements will be implemented on version 3.x. Security or
>    major bugs
>    > are planned to be back ported. Version 2 and version 3 has a
>    completely
>    > independent development/release cycle.
>    >
>    > Thanks to everybody who helped in this process: reporting issues,
>    making
>    > comments and suggestions, sending patches and so on.
>    >
>    > Further details on the compilation process for ModSecurity v3, can be
>    found on
>    > the project README:
>    >  -
>    [5]https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0J
>    Y3XGs_X2HOldK4w&s=5&u=https%3a%2f%2fgithub%2ecom%2fSpiderLabs%2fModSecu
>    rity%2ftree%2fv3%2fmaster%23compilation
>    >
>    > Complementary documentation for the connectors are available here:
>    >  - nginx:
>    [6]https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0J
>    Y3XGs_XjUPlEYtg&s=5&u=https%3a%2f%2fgithub%2ecom%2fSpiderLabs%2fModSecu
>    rity-nginx%2f%23compilation
>    >  - Apache:
>    [7]https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0J
>    Y3XGs_S6AOVZO4g&s=5&u=https%3a%2f%2fgithub%2ecom%2fSpiderLabs%2fModSecu
>    rity-apache%2f%23compilation
>    >
>    >
>    > Br.,
>    > Felipe "Zimmerle" Costa
>    > Security Researcher, Lead Developer ModSecurity.
>    >
>    > Trustwave | SMART  SECURITY ON DEMAND
>    > [8]www.trustwave.com
>    >
>    >
>    >
>    -----------------------------------------------------------------------
>    -------
>    > Check out the vibrant tech community on one of the world's most
>    > engaging tech sites,
>    [9]http://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0JY
>    3XGs_S6Ga1Ea5g&s=5&u=http%3a%2f%2fSlashdot%2eorg%21
>    [10]http://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0J
>    Y3XGs_XjVbVUc4g&s=5&u=http%3a%2f%2fsdm%2elink%2fslashdot
>    > _______________________________________________
>    > mod-security-developers mailing list
>    > mod...@li...
>    >
>    [11]https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0
>    JY3XGs_S-CZ1NJsQ&s=5&u=https%3a%2f%2flists%2esourceforge%2enet%2flists%
>    2flistinfo%2fmod-security-developers
>    > ModSecurity Services from Trustwave's SpiderLabs:
>    > [12]https://www.trustwave.com/spiderLabs.php
>    --
>    [13]https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0
>    JY3XGs_SuGaFUd4A&s=5&u=https%3a%2f%2fwww%2efeistyduck%2ecom%2ftraining%
>    2fmodsecurity-training-course
>    [14]https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0
>    JY3XGs_SyFb18b7A&s=5&u=https%3a%2f%2fwww%2efeistyduck%2ecom%2fbooks%2fm
>    odsecurity-handbook%2f
>    [15]mailto:chr...@ne...
>    twitter: @ChrFolini
> 
> References
> 
>    1. http://www.trustwave.com/
>    2. https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0JY3XGs_SrVbV5HsA&s=5&u=https://github.com/SpiderLabs/ModSecurity/releases/tag/v3.0.0/CHANGES
>    3. https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0JY3XGs_XuJPgVM5w&s=5&u=https://github.com/SpiderLabs/ModSecurity/releases/tag/v3.0.0/
>    4. https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0JY3XGs_XuJOVNNsA&s=5&u=https://github.com/SpiderLabs/ModSecurity/issues?q=is%3Aissue+is%3Aopen+label%3Alibmodsecurity
>    5. https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0JY3XGs_X2HOldK4w&s=5&u=https://github.com/SpiderLabs/ModSecurity/tree/v3/master#compilation
>    6. https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0JY3XGs_XjUPlEYtg&s=5&u=https://github.com/SpiderLabs/ModSecurity-nginx/#compilation
>    7. https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0JY3XGs_S6AOVZO4g&s=5&u=https://github.com/SpiderLabs/ModSecurity-apache/#compilation
>    8. http://www.trustwave.com/
>    9. http://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0JY3XGs_S6Ga1Ea5g&s=5&u=http://Slashdot.org!
>   10. http://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0JY3XGs_XjVbVUc4g&s=5&u=http://sdm.link/slashdot
>   11. https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0JY3XGs_S-CZ1NJsQ&s=5&u=https://lists.sourceforge.net/lists/listinfo/mod-security-developers
>   12. https://www.trustwave.com/spiderLabs.php
>   13. https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0JY3XGs_SuGaFUd4A&s=5&u=https://www.feistyduck.com/training/modsecurity-training-course
>   14. https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0JY3XGs_SyFb18b7A&s=5&u=https://www.feistyduck.com/books/modsecurity-handbook/
>   15. mailto:chr...@ne...

> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot

> _______________________________________________
> mod-security-developers mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-developers
> ModSecurity Services from Trustwave's SpiderLabs:
> https://www.trustwave.com/spiderLabs.php


-- 
https://www.feistyduck.com/training/modsecurity-training-course
https://www.feistyduck.com/books/modsecurity-handbook/
mailto:chr...@ne...
twitter: @ChrFolini

Re: [mod-security-users] [Mod-security-developers] ModSecurity version 3.0.0 announcement

[Felipe C. <FC...@tr...>]

Thank you Christian. Indeed I am very happy with this release :) Hope to make the life of ModSecurity users better.

Thanks, also, to everybody that was involved on with it, including you :)



Br.,

Felipe “Zimmerle” Costa

Security Researcher, Lead Developer ModSecurity.



Trustwave | SMART SECURITY ON DEMAND

www.trustwave.com<http://www.trustwave.com/>



________________________________
From: Christian Folini <chr...@ne...>
Sent: Friday, December 15, 2017 8:11:55 AM
To: mod...@li...; mod...@li...
Subject: Re: [Mod-security-developers] ModSecurity version 3.0.0 announcement

Congratulations Zimmerle!

This is a very big day and I am impressed by your achievement! I drink to a
bright future for libModSecurity 3.0!

Christian



On Thu, Dec 14, 2017 at 10:26:17PM +0000, Felipe Costa wrote:
>
> It is a pleasure to announce the release of ModSecurity version 3.0.0, aka
> libModSecurity. This version contains fixes on top of v3.0.0-rc1 and
> improvements on some features.
>
> The most important addition of this release was the full support for some
> missing pieces such as: Lua, SecRuleRemoveByTag and the @fuzzyHash operator.
>
> At this point ModSecurity version 3 is considerable to be feature complete. Any
> missing piece may not be suitable for version 3 family. At least not
> before discussion.
>
> The list with the full changes can be found on the project CHANGES file,
> available here:
>  - https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0JY3XGs_SrVbV5HsA&s=5&u=https%3a%2f%2fgithub%2ecom%2fSpiderLabs%2fModSecurity%2freleases%2ftag%2fv3%2e0%2e0%2fCHANGES
>
> The version 3.0.0 can be downloaded straight from GitHub:
>  - https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0JY3XGs_XuJPgVM5w&s=5&u=https%3a%2f%2fgithub%2ecom%2fSpiderLabs%2fModSecurity%2freleases%2ftag%2fv3%2e0%2e0%2f
>
> The list of open issues is also available on GitHub:
>  - https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0JY3XGs_XuJOVNNsA&s=5&u=https%3a%2f%2fgithub%2ecom%2fSpiderLabs%2fModSecurity%2fissues%3fq%3dis%253Aissue%2bis%253Aopen%2blabel%253Alibmodsecurity
>
> Notice that differently from version 2, ModSecurity v3 does not target any
> specific web server or web server version. The version 3 is about a library.
> The connectors are the ones responsible to create the link between the web
> server and libModSecurity. Each web server should have its own connector.
> Currently we support the Nginx connector and there is a Apache connector
> available for test (not yet released).
>
> IMPORTANT: ModSecurity version 2 will be available and maintained parallel
> to version 3. There is no ETA to deprecate the version 2.x. New features and
> major improvements will be implemented on version 3.x. Security or major bugs
> are planned to be back ported. Version 2 and version 3 has a completely
> independent development/release cycle.
>
> Thanks to everybody who helped in this process: reporting issues, making
> comments and suggestions, sending patches and so on.
>
> Further details on the compilation process for ModSecurity v3, can be found on
> the project README:
>  - https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0JY3XGs_X2HOldK4w&s=5&u=https%3a%2f%2fgithub%2ecom%2fSpiderLabs%2fModSecurity%2ftree%2fv3%2fmaster%23compilation
>
> Complementary documentation for the connectors are available here:
>  - nginx: https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0JY3XGs_XjUPlEYtg&s=5&u=https%3a%2f%2fgithub%2ecom%2fSpiderLabs%2fModSecurity-nginx%2f%23compilation
>  - Apache: https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0JY3XGs_S6AOVZO4g&s=5&u=https%3a%2f%2fgithub%2ecom%2fSpiderLabs%2fModSecurity-apache%2f%23compilation
>
>
> Br.,
> Felipe "Zimmerle" Costa
> Security Researcher, Lead Developer ModSecurity.
>
> Trustwave | SMART  SECURITY ON DEMAND
> www.trustwave.com<http://www.trustwave.com>
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, http://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0JY3XGs_S6Ga1Ea5g&s=5&u=http%3a%2f%2fSlashdot%2eorg%21 http://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0JY3XGs_XjVbVUc4g&s=5&u=http%3a%2f%2fsdm%2elink%2fslashdot
> _______________________________________________
> mod-security-developers mailing list
> mod...@li...
> https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0JY3XGs_S-CZ1NJsQ&s=5&u=https%3a%2f%2flists%2esourceforge%2enet%2flists%2flistinfo%2fmod-security-developers
> ModSecurity Services from Trustwave's SpiderLabs:
> https://www.trustwave.com/spiderLabs.php

--
https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0JY3XGs_SuGaFUd4A&s=5&u=https%3a%2f%2fwww%2efeistyduck%2ecom%2ftraining%2fmodsecurity-training-course
https://scanmail.trustwave.com/?c=4062&d=-J-z2kP3sJBdn_MkkJUUMkJvM0JY3XGs_SyFb18b7A&s=5&u=https%3a%2f%2fwww%2efeistyduck%2ecom%2fbooks%2fmodsecurity-handbook%2f
mailto:chr...@ne...
twitter: @ChrFolini

[mod-security-users] BUilding 3.0.0

[Ed G. <ED...@ha...>]

Thank you to the developers for all your work on Mod Security and congratulations on 3.0.0.

When running configure, I see this:

 Optional dependencies
   + GeoIP                                         ....not found
   + LibCURL                                       ....found v7.29.0
      -lcurl  ,  -DWITH_CURL
   + YAJL                                          ....not found
   + LMDB                                          ....not found
   + LibXML2                                       ....found v2.9.1
      -lxml2 -lz -lm -ldl, -I/usr/include/libxml2 -DWITH_LIBXML2
   + SSDEEP                                        ....not found
   + LUA                                           ....not found

Which of these missing optional depedencies would be worth adding to production Centos/Apache servers?

Thanks,


--

Ed Greenberg  |  Web Developer and LInux System Administrator
________________________________
HAPPY Software, Inc. l  Work HAPPY-er!
t. 888-484-2779  l  f. 518-584-5388

This message and any of its attachments are intended only for the use of the designated recipient, or the recipient’s designee, and may contain information that is confidential or privileged. If you are not the intended recipient, please immediately notify HAPPY Software, Inc., delete all copies of the message and any attachments and do not disseminate or make any use of their contents.

Re: [mod-security-users] [Mod-security-developers] ModSecurity version 3.0.0 announcement

[Christian F. <chr...@ne...>]

Congratulations Zimmerle! 

This is a very big day and I am impressed by your achievement! I drink to a
bright future for libModSecurity 3.0!

Christian



On Thu, Dec 14, 2017 at 10:26:17PM +0000, Felipe Costa wrote:
> 
> It is a pleasure to announce the release of ModSecurity version 3.0.0, aka
> libModSecurity. This version contains fixes on top of v3.0.0-rc1 and
> improvements on some features.
> 
> The most important addition of this release was the full support for some
> missing pieces such as: Lua, SecRuleRemoveByTag and the @fuzzyHash operator.
> 
> At this point ModSecurity version 3 is considerable to be feature complete. Any
> missing piece may not be suitable for version 3 family. At least not
> before discussion.
> 
> The list with the full changes can be found on the project CHANGES file,
> available here:
>  - https://github.com/SpiderLabs/ModSecurity/releases/tag/v3.0.0/CHANGES
> 
> The version 3.0.0 can be downloaded straight from GitHub:
>  - https://github.com/SpiderLabs/ModSecurity/releases/tag/v3.0.0/
> 
> The list of open issues is also available on GitHub:
>  - https://github.com/SpiderLabs/ModSecurity/issues?q=is%3Aissue+is%3Aopen+label%3Alibmodsecurity
> 
> Notice that differently from version 2, ModSecurity v3 does not target any
> specific web server or web server version. The version 3 is about a library.
> The connectors are the ones responsible to create the link between the web
> server and libModSecurity. Each web server should have its own connector.
> Currently we support the Nginx connector and there is a Apache connector
> available for test (not yet released).
> 
> IMPORTANT: ModSecurity version 2 will be available and maintained parallel
> to version 3. There is no ETA to deprecate the version 2.x. New features and
> major improvements will be implemented on version 3.x. Security or major bugs
> are planned to be back ported. Version 2 and version 3 has a completely
> independent development/release cycle.
> 
> Thanks to everybody who helped in this process: reporting issues, making
> comments and suggestions, sending patches and so on.
> 
> Further details on the compilation process for ModSecurity v3, can be found on
> the project README:
>  - https://github.com/SpiderLabs/ModSecurity/tree/v3/master#compilation
> 
> Complementary documentation for the connectors are available here:
>  - nginx: https://github.com/SpiderLabs/ModSecurity-nginx/#compilation
>  - Apache: https://github.com/SpiderLabs/ModSecurity-apache/#compilation
> 
> 
> Br.,
> Felipe "Zimmerle" Costa
> Security Researcher, Lead Developer ModSecurity.
> 
> Trustwave | SMART  SECURITY ON DEMAND
> www.trustwave.com
> 
> 
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> mod-security-developers mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-developers
> ModSecurity Services from Trustwave's SpiderLabs:
> https://www.trustwave.com/spiderLabs.php

-- 
https://www.feistyduck.com/training/modsecurity-training-course
https://www.feistyduck.com/books/modsecurity-handbook/
mailto:chr...@ne...
twitter: @ChrFolini

[mod-security-users] ModSecurity version 3.0.0 announcement

[Felipe C. <FC...@tr...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


It is a pleasure to announce the release of ModSecurity version 3.0.0, aka
libModSecurity. This version contains fixes on top of v3.0.0-rc1 and
improvements on some features.

The most important addition of this release was the full support for some
missing pieces such as: Lua, SecRuleRemoveByTag and the @fuzzyHash operator.

At this point ModSecurity version 3 is considerable to be feature complete. Any
missing piece may not be suitable for version 3 family. At least not
before discussion.

The list with the full changes can be found on the project CHANGES file,
available here:
 - https://github.com/SpiderLabs/ModSecurity/releases/tag/v3.0.0/CHANGES

The version 3.0.0 can be downloaded straight from GitHub:
 - https://github.com/SpiderLabs/ModSecurity/releases/tag/v3.0.0/

The list of open issues is also available on GitHub:
 - https://github.com/SpiderLabs/ModSecurity/issues?q=is%3Aissue+is%3Aopen+label%3Alibmodsecurity

Notice that differently from version 2, ModSecurity v3 does not target any
specific web server or web server version. The version 3 is about a library.
The connectors are the ones responsible to create the link between the web
server and libModSecurity. Each web server should have its own connector.
Currently we support the Nginx connector and there is a Apache connector
available for test (not yet released).

IMPORTANT: ModSecurity version 2 will be available and maintained parallel
to version 3. There is no ETA to deprecate the version 2.x. New features and
major improvements will be implemented on version 3.x. Security or major bugs
are planned to be back ported. Version 2 and version 3 has a completely
independent development/release cycle.

Thanks to everybody who helped in this process: reporting issues, making
comments and suggestions, sending patches and so on.

Further details on the compilation process for ModSecurity v3, can be found on
the project README:
 - https://github.com/SpiderLabs/ModSecurity/tree/v3/master#compilation

Complementary documentation for the connectors are available here:
 - nginx: https://github.com/SpiderLabs/ModSecurity-nginx/#compilation
 - Apache: https://github.com/SpiderLabs/ModSecurity-apache/#compilation


Br.,
Felipe "Zimmerle" Costa
Security Researcher, Lead Developer ModSecurity.

Trustwave | SMART  SECURITY ON DEMAND
www.trustwave.com

-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iF0EARECAB0WIQQZDvrMoen6RmqOzZzm37CM6LESdwUCWjL5gQAKCRDm37CM6LES
d+I9AJ0W6S2jXBFSXcAPBQD/qhs4W0SOwQCgoeKBpOOSAcAZXsAqQOA4oUFV+yY=
=BrVr
-----END PGP SIGNATURE-----