mod-security-users — General discussion about mod_security

[mod-security-users] Mutex errors in chroot Apache

[Skye P. <sk...@f4...>]

Hi, thanks for mod_security!!!!  Made chrooting my Apache2 relatively easy.

However I'm getting a lot of these in my httpd-error.log

[Wed Mar 29 22:52:29 2006] [notice] mod_security: chroot checkpoint #1 (pid=1599
ppid=1594)
[Wed Mar 29 22:52:29 2006] [notice] mod_security/1.9.2 configured
[Wed Mar 29 22:52:29 2006] [notice] mod_security: chroot checkpoint #2 (pid=1600
ppid=1)
[Wed Mar 29 22:52:29 2006] [notice] mod_security: chroot successful, path=/home
[Wed Mar 29 22:52:29 2006] [crit] (2)No such file or directory: mod_rewrite:
could not init rewrite log lock in child
[Wed Mar 29 22:52:29 2006] [crit] (2)No such file or directory: mod_rewrite:
could not init rewrite log lock in child
[Wed Mar 29 22:52:29 2006] [error] (2)No such file or directory: Failed to
child-init auditlog mutex
[Wed Mar 29 22:52:29 2006] [notice] Apache/2.0.55 (FreeBSD) RAQdevil/1.0
mod_ssl/2.0.55 OpenSSL/0.9.7e-p1 configured -- resuming normal operations
[Wed Mar 29 22:52:29 2006] [error] (2)No such file or directory: Failed to
child-init auditlog mutex
[Wed Mar 29 22:52:29 2006] [crit] (2)No such file or directory: mod_rewrite:
could not init rewrite log lock in child
[Wed Mar 29 22:52:29 2006] [error] (2)No such file or directory: Failed to
child-init auditlog mutex
[Wed Mar 29 22:52:29 2006] [crit] (2)No such file or directory: mod_rewrite:
could not init rewrite log lock in child
[Wed Mar 29 22:52:29 2006] [error] (2)No such file or directory: Failed to
child-init auditlog mutex
[Wed Mar 29 22:52:29 2006] [crit] (2)No such file or directory: mod_rewrite:
could not init rewrite log lock in child
[Wed Mar 29 22:52:29 2006] [error] (2)No such file or directory: Failed to
child-init auditlog mutex                                                      
                                                                               
                  

... etc (a pair of these errors for every HTTP request).

Any thoughts on this?  Google/Yahoo search doesn't turn up anything.

apache-2.0.55_2
mod_security-1.9.2
FreeBSD 6.1-PRERELEASE

Relevent settings....

    SecAuditLog /var/log/www/audit_log
    SecFilterDebugLog /var/log/www/modsec_debug_log                            
           
    SecChrootDir /home                                                         
           

If I change SecFilterDebugLevel from 0 to 9 I do get stuff in in the debug log,
and everything else seems to be normal, but the errors are annoying.

Thanks,
Skye

[mod-security-users] False-positive running cgi script

[Steve W. <ste...@ya...>]

ModSecurity version: 1.9.2
Apache version: 1.3.34
OS: Red Hat Enterprise Linux ES release 3 (Taroon Update 7)
Kernel: Linux 2.4.21-40.ELsmp #1 SMP Thu Feb 2 22:22:39 EST 2006 i686 i686 i386 GNU/Linux
Browser: IE 6 and Firefox 1.5.1

Hi folks,

We have a cgi script which works fine except for one function which mod_security blocks when users click on a link sent to their email to approve their mailing list subscription (double opt-in).

The mod_security audit log shows the following:

==5f227777==============================
Request: www.mydomain.com xxx.xxx.xxx.xxx - - [29/Mar/2006:21:48:51 -0500] "GET /cgi-bin/mail.cgi/n/domain.com/user/domain.com/14416046/ HTTP/1.1" 500 538 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)" RCtHEtEI6AoAAD7BFCA "-"
Handler: cgi-script
Error: Premature end of script headers: /hsphere/shared/apache/htdocs/cgi-bin/mail.cgi
----------------------------------------
GET /cgi-bin/mail.cgi/n/domain.com/user/domain.com/14416046/ HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-us
Connection: Keep-Alive
Host: mydomain.com
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
XXXXXXXXXXXXXXX: XXXXXXXXXXXXX

HTTP/1.1 500 Internal Server Error
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=iso-8859-1
--5f227777-- 

Our apache mod_security directive contains the following:

#Mod_Security Global Configuration File

# Enable ModSecurity
# On , Off , DynamicOnly
SecFilterEngine On

# Reject requests with status 403
SecFilterDefaultAction "deny,log,status:500"

# Some sane defaults
SecFilterScanPOST On
SecFilterCheckURLEncoding On
SecFilterCheckUnicodeEncoding Off

# Accept almost all byte values
SecFilterForceByteRange 1 255

# Designate a directory for temporary files
# storage. It is a good idea to change the
# value below to a private directory, just as
# an additional measure against race conditions
SecUploadDir /tmp
SecUploadKeepFiles Off

# Only record the interesting stuff
SecAuditEngine RelevantOnly

# Uncomment below to record responses with unusual statuses
SecAuditLogRelevantStatus ^5
SecAuditLog /var/log/modsec_audit-httpd.log

# You normally won't need debug logging
SecFilterDebugLevel 0
SecFilterDebugLog /var/log/modsec_debug-httpd.log

Can anyone point me to where I can look to see what mod_sec rule is causing this issue. We use a number of rules from gotroot. Any help is greatly appreciated.

Thanks,

SW

		
---------------------------------
New Yahoo! Messenger with Voice. Call regular phones from your PC and save big.

Re: [mod-security-users] auditlog and noauditlog

[Ivan R. <iv...@we...>]

fo...@po... wrote:
> Hi there,
> 
> I work with a small mod_security ruleset. It's a big help when
> debugging web applications.
> 
> The audit log is configured as follows:
> 
> SecFilterScanOutput   On
> SecAuditLogType       Concurrent
> SecAuditLogStorageDir /logs/weblogs/apache/myservice/audit_data/
> SecAuditLog           /logs/weblogs/apache/myservice/audit_index.log
> SecAuditLogParts      ABCDEFGHZ
> SecFilterSelective    REQUEST_URI   "^/heartbeat.html"  noauditlog,pass
> 
> I want to avoid logging the loadbalancer's heartbeat request every five
> second (and in  a different setup, i want the audit log to concentrate
> on
> a single arbitrary IP address).
> 
> Now the thing i do not understand is, that i get what i expected
> in audit_index.log, but the storage dir fills up with the heartbeat
> requests
> nevertheless.
> 
> Is there something i missed in the documentation?

  No, but you are probably running 1.9.1 or earlier. From
  http://www.modsecurity.org/documentation/known-issues-1.9.x.html:

  "Fixed a bug in the concurrent audit logging code where partial audit
   log entry files were being created for all requests."

-- 
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall
Apache Security (O'Reilly): http://www.apachesecurity.net

[mod-security-users] auditlog and noauditlog

[<fo...@po...>]

Hi there,

I work with a small mod_security ruleset. It's a big help when
debugging web applications.

The audit log is configured as follows:

SecFilterScanOutput   On
SecAuditLogType       Concurrent
SecAuditLogStorageDir /logs/weblogs/apache/myservice/audit_data/
SecAuditLog           /logs/weblogs/apache/myservice/audit_index.log
SecAuditLogParts      ABCDEFGHZ
SecFilterSelective    REQUEST_URI   "^/heartbeat.html"  noauditlog,pass

I want to avoid logging the loadbalancer's heartbeat request every five
second (and in  a different setup, i want the audit log to concentrate
on
a single arbitrary IP address).

Now the thing i do not understand is, that i get what i expected
in audit_index.log, but the storage dir fills up with the heartbeat
requests
nevertheless.

Is there something i missed in the documentation?

best regards,

Christian Folini

[mod-security-users] About Version

[j l. <no...@gm...>]

Hello:
      If I want to use Mod_Security1.9.2, which version of Apache I need to
use?
      Is Mod_Filter.so needed?


LiuJian

Re: [mod-security-users] SecFilterSelective OUTPUT

[Ivan R. <iv...@we...>]

fredoun wrote:
> Hi everyone,
> 
> seems i have a problem with SecFilterSelective OUTPUT:
> 
> f.e. i have 
> 
> SecFilterSelective OUTPUT "mySQL query error"
> 
> when i have a file
> 
> http//blahblah/file containing this string it's ok
> 
> but when the string is hidden f.e. : (from php generated url)
> 
> 
> 			<!-- THE POST 33930 -->
> 			<div class="postcolor" id='post-33930'>mySQL query error</div>
> 			<!--IBF.ATTACHMENT_33930-->
> 			<br /><br />--------------------<br />
> <div class="signature"><img src="http://img508.imageshack.us/img508/594/admindark4do.jpg" /></div>
> 			<!-- THE POST -->		
> 		</td>
> 
> It doesn't work ...
> 
> May someone help me ?

  It works for me here. Perhaps you have some unusual Apache setup
  that prevents ModSecurity from seeing the response generated by PHP.

  You should be able to check that by observing debug log at level 4. Here
  are the lines I get:

[26/Mar/2006:16:43:14 +0100] [192.168.2.111/sid#810e6e0][rid#829b760][/cgi-bin/php/x.php][2]
Checking signature "mySQL query error" at OUTPUT
[26/Mar/2006:16:43:14 +0100] [192.168.2.111/sid#810e6e0][rid#8292f00][/x.php][4] Checking
against "<!-- THE POST 33930 -->\n\t\t\t<div class=\"postcolor\" id='post-33930'>mySQL query
error</div>\n"

  If you still can't get it to work, submit a support request as
  described here:

  http://www.thinkingstone.com/download/ModSecurity_Support_Request_Preparation_Guide.pdf

  and I'll be happy to look into it.

-- 
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall
Apache Security (O'Reilly): http://www.apachesecurity.net

[mod-security-users] SecFilterSelective OUTPUT

[fredoun <fr...@gm...>]

Hi everyone,

seems i have a problem with SecFilterSelective OUTPUT:

f.e. i have 

SecFilterSelective OUTPUT "mySQL query error"

when i have a file

http//blahblah/file containing this string it's ok

but when the string is hidden f.e. : (from php generated url)


			<!-- THE POST 33930 -->
			<div class="postcolor" id='post-33930'>mySQL query error</div>
			<!--IBF.ATTACHMENT_33930-->
			<br /><br />--------------------<br />
<div class="signature"><img src="http://img508.imageshack.us/img508/594/admindark4do.jpg" /></div>
			<!-- THE POST -->		
		</td>

It doesn't work ...

May someone help me ?

thx 

fredoun


--------------=  Posted using GrabIt  =----------------
------=  Binary Usenet downloading made easy =---------
-=  Get GrabIt for free from http://www.shemes.com/  =-

Re: [mod-security-users] dynamiconly

[Ivan R. <iv...@we...>]

Chris wrote:
> I noticed that dynamiconly is been depreciated, it is my understanding
> this saves resources since it stops static files such as images been
> checked.
> 
> What is the reason for this, is the performance improvement tiny? is
> it unstable? or some other reason?

  It's a combination of various factors.

  To use the feature successfully one needs to configure Apache
  in a special way, but I've seen too many people just ignore that
  part and/or forget to test if it works. Furthermore, there are
  inconsistencies in the ways Apache handles certain request
  types (e.g. for directory requests) which make dynamic-detection
  somewhat unreliable.

  ModSecurity has always supported the HANDLER variable (although
  I see now it's not documented). For 2.0 I'll make sure it is
  possible to implement the same thing using just rules.

  But even without that, you could just use SCRIPT_FILENAME to
  test the file extensions and execute "nolog,allow" for static files.

-- 
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall
Apache Security (O'Reilly): http://www.apachesecurity.net

[mod-security-users] dynamiconly

[Chris <chr...@gm...>]

I noticed that dynamiconly is been depreciated, it is my understanding
this saves resources since it stops static files such as images been
checked.

What is the reason for this, is the performance improvement tiny? is
it unstable? or some other reason?

thanks

Chris

[Fwd: Re: [mod-security-users] Subversion (WebDAV?)]

[Ivan R. <iv...@we...>]

-- 
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall
Apache Security (O'Reilly): http://www.apachesecurity.net

Re: [mod-security-users] Subversion (WebDAV?)

[Ivan R. <iv...@we...>]

Bryce Fischer wrote:
> Having an issue trying to get Subversion access to work with
> mod_security. Access to Subversion works great when I have ModSecurity
> disabled, but when I enable it, I get the error:
> 
> PUT of '/svn/TestRepo/!svn/wrk/..../trunk/file1': 403 Forbidden (
> http://www.<mydomain>.com)

  Is this what you get in the Apache error log? Or from the
  Subversion client? There's probably more information in
  the error log. Increase the debug log to 9:

  SecFilterDebugLevel 9

  and then send your debug log file to me privately
  (/var/log/httpd/modsec_debug_log).


> # Where to store temporary and intercepted files
> SecUploadDir /var/log/httpd/files

  Can the httpd user write to the above location?


> <Location /svn/TestRepo>
>   SecFilterInheritance OFf

  Use SecFilterEngine Off instead and you'll probably
  get it working.

-- 
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall
Apache Security (O'Reilly): http://www.apachesecurity.net

[mod-security-users] Subversion (WebDAV?)

[Bryce F. <br...@be...>]

Having an issue trying to get Subversion access to work with mod_security.
Access to Subversion works great when I have ModSecurity disabled, but when
I enable it, I get the error:

PUT of '/svn/TestRepo/!svn/wrk/..../trunk/file1': 403 Forbidden (http://www=
.
<mydomain>.com)

I have the following rules setup for ModSecurity:

# Enable mod_security
SecFilterEngine On

# Retrieve request payload
SecFilterScanPOST On

# Reasonable automatic validation defaults
SecFilterCheckURLEncoding On
SecFilterCheckCookieFormat Off
SecFilterNormalizeCookies Off
SecFilterCheckUnicodeEncoding Off

# Accept almost all byte values
SecFilterForceByteRange 0 255

# Reject invalid requests with status 403
SecFilterDefaultAction deny,log,status:403

# Only record the relevant information
SecAuditEngine RelevantOnly
SecAuditLog /var/log/httpd/audit_log

# Where to store temporary and intercepted files
SecUploadDir /var/log/httpd/files
# Do not store intercepted files for the time being
SecUploadKeepFiles Off

# Use 0 for the debug level in production
# and 4 for testing
SecFilterDebugLog /var/log/httpd/modsec_debug_log
SecFilterDebugLevel 4

SecServerSignature "Microsoft-IIS/5.0"

=3D=3D=3D=3D END =3D=3D=3D=3D=3D

And the following rule specified for the location where the Subversion
repository is:

<Location /svn/TestRepo>
  SecFilterInheritance OFf

  DAV svn
  SVNPath /usr/local/src/TestRepository

  <LimitExcept GET PROPFIND OPTIONS REPORT>
  AuthType Basic
  AuthName "Subversion Repository"
  AuthUserFile /etc/httpd/passwd/passwords
  Require valid-user
  </LimitExcept>

</Location>

=3D=3D=3D=3D END =3D=3D=3D=3D

Any help appreciated.

THanks
Bryce

Re: [mod-security-users] Noauditlog

[Ivan R. <iv...@we...>]

li...@32... wrote:
> 
> I have noticed that if I use the 'noauditlog' parameter on a filter(rule),
> ModSec does not log any filter loaded after that one? Is this how it is
> supposed to work?

  Yes, that's how it's supposed to work: "noauditlog" applies to the
  request, not the rule. However, as you note, it is somewhat unexpected
  so it might be a good idea to add another action that would only
  skip logging to the audit log for the rule it is used in.

-- 
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall
Apache Security (O'Reilly): http://www.apachesecurity.net

[mod-security-users] Noauditlog

[<li...@32...>]

I have noticed that if I use the 'noauditlog' parameter on a filter(rule),
ModSec does not log any filter loaded after that one? Is this how it is
supposed to work?

I fixed it by adding 'auditlog' to the following filter so it will keep
logging all the other filters(rules).

-Mike

[mod-security-users] how to config modsecurity on apache chinese version

[<hao...@gm...>]

dear all maillist user:
i write a document is tell about how to config modsecurity on apache .And
this file is Chinese version .as not have Chinese document on internet .
detailed content on ther:
http://www.cublog.cn/u/12/showart.php?id=3D88774

--
http://wanghao.cublog.cn

Re: [mod-security-users] modsecurity for tomcat or resin ?

[Ivan R. <iv...@we...>]

fatb wrote:
> hi list:
>   I originally thought that I could secure tomcat by secure the apache
> with modsecurity,which was in the front of it.
> Today I used mod_jk2 to connect apache2 and tomcat5,and filter
> something with modsecurity,but it did not filter anything I wish.
> Maybe I did not know how the mod_jk2 work,anybody could suggest one way
> to filter something for jsp script and Servlet.

  Isn't mod_jk2 deprecated? I have successfully used Apache + Tomcat
  + ModSecurity with mod_jk (1.2.x) in the past. I never tried mod_jk2.

-- 
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall
Apache Security (O'Reilly): http://www.apachesecurity.net

[mod-security-users] modsecurity for tomcat or resin ?

[fatb <fa...@se...>]

aGkgbGlzdDoNCiAgSSBvcmlnaW5hbGx5IHRob3VnaHQgdGhhdCBJIGNvdWxkIHNlY3VyZSB0b21j
YXQgYnkgc2VjdXJlIHRoZSBhcGFjaGUgd2l0aCBtb2RzZWN1cml0eSx3aGljaCB3YXMgaW4gdGhl
IGZyb250IG9mIGl0Lg0KVG9kYXkgSSB1c2VkIG1vZF9qazIgdG8gY29ubmVjdCBhcGFjaGUyIGFu
ZCB0b21jYXQ1LGFuZCBmaWx0ZXIgc29tZXRoaW5nIHdpdGggbW9kc2VjdXJpdHksYnV0IGl0IGRp
ZCBub3QgZmlsdGVyIGFueXRoaW5nIEkgd2lzaC4NCk1heWJlIEkgZGlkIG5vdCBrbm93IGhvdyB0
aGUgbW9kX2prMiB3b3JrLGFueWJvZHkgY291bGQgc3VnZ2VzdCBvbmUgd2F5IHRvIGZpbHRlciBz
b21ldGhpbmcgZm9yIGpzcCBzY3JpcHQgYW5kIFNlcnZsZXQuDQoNClRoYW5rIFlvdSENCg==

Re: [mod-security-users] ModSecurity 2.0.0-dev1 Question

[Alberto G. I. <ag...@in...>]

On Tue, Mar 21, 2006 at 11:10:15AM +0000, Ivan Ristic wrote:
> Alberto Gonzalez Iniesta wrote:
> >
> > But you asked for stats, so here there are some:
> > http://popcon.debian.org/by_inst  (WARNING: 5 MB file)
> >=20
> > To sum up:
> > mod-security-common              245 installations=20
> > (common package for both the Apache 2.x and the Apache 1.3.x packages=
)
> > libapache2-mod-security          175 installs
> > libapache-mod-security            99 installs
> > (probably more than one has both installed)
>=20
>   That's quite interesting. Judging by those numbers there are
>   more Apache 1.3.x users than I thought there would be.
>=20
>   Are there any estimates of the total number of Debian
>   users? It would be nice to be able to extrapolate the total
>   number of Debian users of ModSecurity.
>=20


Hi Ivan,

I guess it's pretty hard to estimate the number of Debian users. Since
there's no licences, no registration, and lots of derivated distros.



--=20
Alberto Gonzalez Iniesta    | Formaci=F3n, consultor=EDa y soporte t=E9cn=
ico
agi@(inittab.org|debian.org)| en GNU/Linux y software libre
Encrypted mail preferred    | http://inittab.com

Key fingerprint =3D 9782 04E7 2B75 405C F5E9  0C81 C514 AF8E 4BA4 01C3

Re: [mod-security-users] ModSecurity 2.0.0-dev1 Question

[Ivan R. <iv...@we...>]

Alberto Gonzalez Iniesta wrote:
>
> But you asked for stats, so here there are some:
> http://popcon.debian.org/by_inst  (WARNING: 5 MB file)
> 
> To sum up:
> mod-security-common              245 installations 
> (common package for both the Apache 2.x and the Apache 1.3.x packages)
> libapache2-mod-security          175 installs
> libapache-mod-security            99 installs
> (probably more than one has both installed)

  That's quite interesting. Judging by those numbers there are
  more Apache 1.3.x users than I thought there would be.

  Are there any estimates of the total number of Debian
  users? It would be nice to be able to extrapolate the total
  number of Debian users of ModSecurity.

-- 
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall
Apache Security (O'Reilly): http://www.apachesecurity.net

Re: [mod-security-users] I get requests like:

[Ivan R. <iv...@we...>]

Sub Zero wrote:
>>> Access denied with code 406. Pattern match "!^[0-9a-f]*$" at
>>> ARG("PHPSESSID")
>>>
>>> How do I add ; to the argument seperators?
>> Put in the character set "!^[0-9a-f;]*$"
> 
> Is this an internal bug of mod_security? Can't I define ; as an argument
> seperator like &?

  I wouldn't call it a bug. It's more like a missing feature.


> Tom Anderson wrote:
>
> I see.  I hadn't realized semicolons were valid separators.  It would
> seem that the mod_security argument parsing needs to be modified, as
> semicolons appear to be RFC-compliant and W3C-recommended separators.
>
> http://www.freesoft.org/CIE/RFC/1808/index.htm

  BTW, the RFC you cited does not define the contents of the
  query parameter. The semicolons refer to path parameters, which
  are different (and, as far as I know, not used in HTTP).


> http://www.w3.org/TR/html4/appendix/notes.html#h-B.2.2

  Recommendations like that are seldom helpful. Standards
  need to be *very* clear about encodings, with no room
  for interpretation. Otherwise we get in a mess, like,
  for example, with the cookies specifications.


Tom Anderson wrote:
> 1.9.2 seems to hardcode the "&" character in a couple of places.

  It does. I'll probably add support this feature in the
  next release.


-- 
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall
Apache Security (O'Reilly): http://www.apachesecurity.net

Re: [mod-security-users] 2 newbie questions ...

[Ivan R. <iv...@we...>]

Thomas Fuerle wrote:
> Hi list,
> 
> 1.) reduced access_log
> 
> I wonder if there is chance to configure mod_security, that filtered
> requests does not show up in the access_log. I would like to see
> something like

  The following will *not* log filtered requests:

CustomLog logs/modsec_custom_log \
"%h %l %u %t \"%r\" %>s %b %{mod_security-message}i" \
env=!mod_security-relevant


> 2.) block everything but ...
> 
> I would like to issue a positive list like block everything but. It
> looks like this ...
> 
>    SecFilter .jsp      "nolog,allow"
>    SecFilter /robots.txt "nolog,allow"
>    SecFilter !.do

  You're close but this is better:

  SecFilterSelective SCRIPT_FILENAME \.jsp$ "nolog,allow"

  But you'll need further chained rules to verify the
  parameters are correct and do not contain attacks, no?

-- 
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall
Apache Security (O'Reilly): http://www.apachesecurity.net

[mod-security-users] 2 newbie questions ...

[Thomas F. <tho...@gm...>]

Hi list,

1.) reduced access_log

I wonder if there is chance to configure mod_security, that filtered 
requests does not show up in the access_log. I would like to see 
something like

access_log ... the good ones
mod_security.log ... the bad ones
error_log ... good one, but didn't get it right.

but I only managed get to run

access_log ... everything (good + filtered url's)
mod_security.log ... the bad ones (all filtered url's) or nolog
error_log. ... good one, but didn't get it right.

any ideas ?

2.) block everything but ...

I would like to issue a positive list like block everything but. It 
looks like this ...

    SecFilter .jsp      "nolog,allow"
    SecFilter /robots.txt "nolog,allow"
    SecFilter !.do


is this correct or is there a nicer version doing this ...

any help is appreciated ... tom

Re: [mod-security-users] I get requests like:

[Terry D. <tdo...@na...>]

Tom Anderson wrote:

> I see.  I hadn't realized semicolons were valid separators.  It would 
> seem that the mod_security argument parsing needs to be modified, as 
> semicolons appear to be RFC-compliant and W3C-recommended separators.
> 
> http://www.freesoft.org/CIE/RFC/1808/index.htm
> http://www.w3.org/TR/html4/appendix/notes.html#h-B.2.2
> http://www.w3.org/QA/2005/04/php-session

I was reading much the same docs prior to posting a "Why are you using a ; as 
a query separator?" response...

The SGML encoding headache is a fair point. Storing the text "&" inside, 
for instance, an XML file that is parsed and then displayed in a browser can 
leave you having to double escape it as "&". (I believe there are 
several support groups who help people recover from this sort of trauma)

1.9.2 seems to hardcode the "&" character in a couple of places. (is the 
separator normalised at some point?) Is it possible to defer to an outside 
authority for the accepted separator characters by the time mod_sec has hold 
of the query?

If it's possible to alternate between characters in a single request, I 
imagine that this could be used to evade certain rules in much the same way as 
the v0/v1 cookie parsing pitfall:

scripts/script.php?first=1&second=2;payload=evilcode&third=3...


Terry.

> Tom
> 
> 
> 
> -------------------------------------------------------
> This SF.Net email is sponsored by xPML, a groundbreaking scripting language
> that extends applications into web and mobile media. Attend the live 
> webcast
> and join the prime developer group breaking into this new coding territory!
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> 

Re: [mod-security-users] I get requests like:

[Tom A. <tan...@oa...>]

Sub Zero wrote:
>>>Access denied with code 406. Pattern match "!^[0-9a-f]*$" at
>>>ARG("PHPSESSID")
>>>
>>>How do I add ; to the argument seperators?
>>
>>Put in the character set "!^[0-9a-f;]*$"
> 
> 
> Is this an internal bug of mod_security? Can't I define ; as an argument
> seperator like &?
> 
> Tom, you can see that adding ; to the characterset will not fix those issues
> (because of other parameters in the url like board=10.0 or topic=9.new or
> etc) but open more PHPSESSID security vulnerabilities.. I also do not want
> to extend a-f to another characterset...

I see.  I hadn't realized semicolons were valid separators.  It would 
seem that the mod_security argument parsing needs to be modified, as 
semicolons appear to be RFC-compliant and W3C-recommended separators.

http://www.freesoft.org/CIE/RFC/1808/index.htm
http://www.w3.org/TR/html4/appendix/notes.html#h-B.2.2
http://www.w3.org/QA/2005/04/php-session

Tom

RE: [mod-security-users] I get requests like:

[Sub Z. <Su...@su...>]

>> Access denied with code 406. Pattern match "!^[0-9a-f]*$" at
>> ARG("PHPSESSID")
>> 
>> How do I add ; to the argument seperators?
>
> Put in the character set "!^[0-9a-f;]*$"

Is this an internal bug of mod_security? Can't I define ; as an argument
seperator like &?

Tom, you can see that adding ; to the characterset will not fix those issues
(because of other parameters in the url like board=10.0 or topic=9.new or
etc) but open more PHPSESSID security vulnerabilities.. I also do not want
to extend a-f to another characterset...