mod-security-users — General discussion about mod_security

Re: [mod-security-users] AuthorizeNet blocks?

[Ivan R. <iv...@we...>]

li...@32... wrote:
> 
> I recently started using the rules at gotroot, last month. Around that time
> a script I use for payment processing thru Anet is acting up. Anet is
> supposed to send back TransID and AVS codes for every transaction. .. They
> are not now (were before). Is it possible that modsec is partially blocking
> the response and not logging it (nothing in logs).

  No, unless you've explicitly disabled logging in the configuration.

  Your access logs will always contain logs of requests. Look
  there for further information.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] AuthorizeNet blocks?

[<li...@32...>]

I recently started using the rules at gotroot, last month. Around that time
a script I use for payment processing thru Anet is acting up. Anet is
supposed to send back TransID and AVS codes for every transaction. .. They
are not now (were before). Is it possible that modsec is partially blocking
the response and not logging it (nothing in logs).


P.S. Using 1.9.2

TIA


-Mike

[mod-security-users] ModSecurity Rules subproject is now live

[Ivan R. <iv...@we...>]

I've just made the ModSecurity Rules subproject live. The rules
are available for download straight away:

  http://www.modsecurity.org/projects/rules/

At the moment the rules consist of two parts:

  1) Hardening rules, in a form of a ModSecurity deployment
     guide.

  2) Rules to detect common web application attacks, designed
     to use ModSecurity as an web intrusion detection tool.

I am open to the idea of having part 3 for rules that deal with
specific application vulnerabilities. However, I don't have much
time to do this myself. I was wondering if there are any list
members that would be interested in contributing the rules
as the vulnerabilities are made public?

Although such specific rules are interesting for their base
value, if properly documented they can be very interesting
as mini case studies and allow new users to understand how
ModSecurity can be used.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Article in O3 Magazine

[Meder B. <ba...@tr...>]

Hi there,

There is a Mod-Security article in O3 Magazine, Issue #2, named "Web=20
Application Firewalls with Modsecurity".=20

You can get it here: http://www.o3magazine.com/current.html

=2D-=20
=F3 =D5=D7=C1=D6=C5=CE=C9=C5=CD,

=ED=C5=C4=C5=D2 =E2=C1=CB=C9=D2=CF=D7

Re: [mod-security-users] compiling against PCRE

[Zach R. <ad...@li...>]

You need to abandon the blacklist.conf completely. You just cannot load 
that ruleset under a heavy load and keep your server stable. Also change 
from On to DynamicOnly.

Load the badips.conf IPs into your firewall, keep the blacklist2.conf, 
and load these rules from the blacklist.conf into your rules.conf:

SecFilterSelective REQUEST_URI "!(horde/imp/compose\.php\?)" chain
SecFilterSelective THE_REQUEST "Subject\:" chain
SecFilterSelective ARG_Bcc ".*\@"
SecFilterSelective REQUEST_URI "!(horde/imp/compose\.php\?)" chain
SecFilterSelective POST_PAYLOAD "Subject\:" chain
SecFilterSelective POST_PAYLOAD "\s*bcc\:"
SecFilterSelective REQUEST_URI "!(horde/imp/compose\.php\?)" chain
SecFilterSelective POST_PAYLOAD "\s*bcc\:\s*[a-z0-9._%-]+@[A-Z0-9.-]+\.[a-z]{2,}"
SecFilterSelective REQUEST_URI "!(horde/imp/compose\.php\?)" chain
SecFilterSelective ARGS_VALUES "\s*bcc\:\s*[a-z0-9._%-]+\@.*\.[a-z]{2,}"
SecFilterSelective HTTP_x-aaaaaaaaa|HTTP_XAAAAAAAAA ".+$"
SecFilterSelective HTTP_x-aaaaaaaaaaa|HTTP_XAAAAAAAAAAA ".+$"
SecFilterSelective HTTP_x-aaaaaaaaaaaa|HTTP_X_AAAAAAAAAAAA ".+$"

That will help quite a bit. :)

Zach

Justin Grindea wrote:

> ok, my finding are not so good. load didn't go down drastically on a 
> quite busy server loaded with quite a lot
> rules from gotroot.
> Trying to load gotroot's blacklist.conf immediatelly raised the load 
> way above normal use and I had it off in 10
> seconds.
>
> thanks,
>     Justin
>
>
> Ivan Ristic wrote:
>
>> Justin Grindea wrote:
>>
>>> hmm, forgot to paste the output...
>>> here it is:
>>
>>
>>
>>   Try this first:
>>   <apache1-home>/bin/apxs -DUSE_PCRE -cia mod_security.c
>>
>>   If that works but you still need to use LoadFile
>>   use:
>>
>>   LoadFile /usr/lib/libpcre.so
>>
>>   Otherwise just download the source from pcre.org
>>   and install it exactly as described in the manual.
>>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through log 
> files
> for problems?  Stop!  Download the new AJAX search engine that makes
> searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
> http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users

Re: [mod-security-users] compiling against PCRE

[Justin G. <web...@sw...>]

ok, my finding are not so good. load didn't go down drastically on a quite busy server loaded with quite a lot
rules from gotroot.
Trying to load gotroot's blacklist.conf immediatelly raised the load way above normal use and I had it off in 10
seconds.

thanks,
	Justin


Ivan Ristic wrote:
> Justin Grindea wrote:
> 
>>hmm, forgot to paste the output...
>>here it is:
> 
> 
>   Try this first:
>   <apache1-home>/bin/apxs -DUSE_PCRE -cia mod_security.c
> 
>   If that works but you still need to use LoadFile
>   use:
> 
>   LoadFile /usr/lib/libpcre.so
> 
>   Otherwise just download the source from pcre.org
>   and install it exactly as described in the manual.
> 

Re: [mod-security-users] compiling against PCRE

[Tom A. <tan...@oa...>]

Zach Roberts wrote:
> Mod_security cannot handle the thousands of rules necessary to secure 
> against all the security threats there seem to be.

Thousands of rules?  Are you mad?  No wonder your server is screeching 
to a halt.  Rather than starting with thousands of rules and slowly 
removing them as they are unneeded, how about starting with the bare 
minimum and adding rules as needed.  I'd be surprised if I run with more 
than two dozen rules!  I can understand the desire to protect against 
any possible entry point, but you should really customize your rule set 
to the applications actually running on your server.  For instance, if 
you don't have PHP, then you shouldn't need any rules which address PHP 
vulnerabilities.  If you don't have a blog, then you don't need blog 
spamming rules.  And I think blacklisting rules are probably unnecessary 
overhead for anyone unless you can do something like a DNS block list 
where it is a simple query instead of a huge list of sequential rules.

Finally, I would imagine that condensing rules would help significantly, 
but maybe someone who has time can test it for certain.  But 
intuitively, I'd think that defining a new rule would require more 
instructions than tacking on elements to another rule.  For instance, if 
you want to block these IPs:

SecFilterSelective REMOTE_ADDR 192\.168\.123\.456
SecFilterSelective REMOTE_ADDR 10\.2\.3\.4
SecFilterSelective REMOTE_ADDR 172\.16\.17\.18
SecFilterSelective REMOTE_ADDR 192\.168\.123\.789
SecFilterSelective REMOTE_ADDR 192\.168\.456\.789
SecFilterSelective REMOTE_ADDR 10\.3\.4\.5
SecFilterSelective REMOTE_ADDR 10\.2\.3\.10
SecFilterSelective REMOTE_ADDR 172\.16\.17\.20

Then you should be able to write this as one rule:

SecFilterSelective REMOTE_ADDR 
(192\.(168\.(123\.(456|789)|456\.789))|(10\.(2\.3\.(4|10)|3\.4\.5))|(172\.(16\.17\.(18|20))))

Or if you wanted to block these URLs:

SecFilterSelective THE_REQUEST www\.hackers\.com
SecFilterSelective THE_REQUEST www\.hackerz\.com
SecFilterSelective THE_REQUEST www\.hax0rz\.com
SecFilterSelective THE_REQUEST www\.h4ckers\.com
SecFilterSelective THE_REQUEST www\.hack3rs\.net
SecFilterSelective THE_REQUEST www\.hackerz\.net
SecFilterSelective THE_REQUEST www\.h4x0rz\.net
SecFilterSelective THE_REQUEST www\.h4ckerz\.net

Seems like quite a cacophony of spellings, but you could use this one rule:

SecFilterSelective THE_REQUEST www\.h(a|4)(ck|x)(e|3|0)r(s|z)\.(com|net)

Let's say that the actual URL coming to the site is "www.h4ckerz.net"... 
then in the first case (multiple rules), it would begin each rule, start 
matching the "www\.h" and then fail, over and over again, until it 
finally matched the whole string.  In the second case, it matches on the 
very first rule and only fails in part, such as on the "a" instead of 
"4", but then picks up where it left off without having to start all 
over again with a new rule.

But like I said, I don't know the interal processing of these things, so 
it may not make a huge difference.  The best thing to do would be to 
test it.

Tom

Re: [mod-security-users] statistics

[Justin G. <web...@sw...>]

looks good,
let us know when we can give it a try.

	Justin


li...@32... wrote:
> on 12/21/05 7:18 PM, Justin Grindea at web...@sw... wrote:
> 
> 
>>hi,
>>
>>I've asked here before and kept googling but can't find any piece of script
>>that can parse the audit log(s) and provide a picture of what's going on.
>>
>>I'd like to know for example top attacking IP's, top attacked sites, top
>>signatures used.
>>
>>Also I'm thinking about email notification of possible intrussions, anyone has
>>a sane logic
>>and possible script for notifications? Maybe email for one IP getting x errors
>>in y seconds?
>>
>>Such script could also help detect false positives, I'm always having troubles
>>detecting them
>>before my clients :(
>>
>>thanks,
>>Justin
> 
> 
> 
> I have this done using php. Also has an archive feature that will take all
> files created by Concurrent logging method, and add them to a MySQL database
> for future searches and stats.
> 
> I am still working on it, but here is an example...
> 
> https://cp.macdock.com/audit_log/
> 
> When I finish it, I will make it available for free :)
> 
> Php 4 and mysql required.
> 
> -Mike 
> 

Re: [mod-security-users] compiling against PCRE

[Ivan R. <iv...@we...>]

On 12/22/05, Zach Roberts <ad...@li...> wrote:
> In my more updated tests it appears as if the PCRE does help quite a bit
> but, it still isn't enough.

Hi Zach,

Thanks for the update.


> Since gotroot.com's ruleset seems to be standard for mod_security
> installations I did tests with those rules.

I have to disagree slightly. I don't think there is such thing as
standard rules for ModSecurity. That's why I don't include any with
the distribution. ModSecurity is a versatile tool. It can be applied
to many different scenarios and there can not be a single rule set
that fits them all.

Having thousands of rules in the configuration is clearly wrong, even
if there were no performance problems. Take the bad IP addresses list,
for example. It makes no sense (at least to me) to watch for them on
the Apache level. As you have noted, a much better approach is to
restrict access at the firewall. That way Apache would not even have
to bother.

ModSecurity should, in my opinion, be configured with a couple of
hundred of rules at the most. Processing of such a rule set takes only
a millisecond or two on a reasonably fast box. Processing thousands of
regular expressions for every request, where 99% of them do not apply,
is a tremendous waste of resources. For that one would clearly need to
either use specialised hardware (making the regexes much faster) or
front the web servers with a cluster of reverse proxies with
ModSecurity.

People running shared hosting facilities are clearly in a very
difficult position. (I used to do just that in my previous job, BTW.)
I think a completely different approach is needed to solve the
problem: 1) completely isolate customers from one another (so that an
intrusion in one account can not affect the others), 2) give customers
option to run certified applications (applications which can be
patched automatically), and 3) explain to those that do not choose
option 2 that they are responsible for maintaining security.

Ivan

Re: [mod-security-users] Chrooting and Windows ?

[Ivan R. <iv...@we...>]

On 12/22/05, Steffen <in...@ap...> wrote:
> Is anyone using Chrooting under Windows ?
>
> ...
>
> Afterall I am not sure if it is running with Windows and maybe it is a Li=
nux
> thingy.

Windows does not support the chroot facility. It's an UNIX-only thing.

Ivan

Re: [mod-security-users] AddType/AddHandler

[Ivan R. <iv...@we...>]

On 12/22/05, Justin Grindea <web...@sw...> wrote:
> hi,
>
> We use H-sphere control panel and it adds AddType php entries. The code i=
s coming from
> a java binary and cannot be edited. While we look for a script that will =
crawl the conf
> files and change it to AddHandler, maybe we can had mod_security to inclu=
de everything that starts
> with AddType application/x-httpd-php in the DynamicOnly scan?

Nope. If that were possible I would have done it already. But you can
ignore stuff based on the extension of the requested file. For example
(put it on top):

SecFilterSelective SCRIPT_FILENAME "!\.php$" allow

Ivan

[mod-security-users] Chrooting and Windows ?

[Steffen <in...@ap...>]

Is anyone using Chrooting under Windows ?

I set the SecChrootDir to all kind of paths, even not a Apache path.
But still no indication it is working.

Also in the Debug log, no indication that Chrooting is doing some.

The docs says "Only the root user can escape the jail", when I understand
that, when you run Apache under an Administrator account then it does not
work.

Maybe I have to run Apache under a user account.

Afterall I am not sure if it is running with Windows and maybe it is a Linux
thingy.


Steffen
http://www.apachelounge.com

Re: [mod-security-users] compiling against PCRE

[Zach R. <ad...@li...>]

I also removed the badips and converted it into firewall rules. ipfw2 
seems to handle them just fine.

blacklist.conf has quite a bit of potential to solve a rather annoying 
problem but, 6900+ lines of rules is just too much to effectively run 
for all requests.

The rules.conf file I have now was cut down only to include applications 
that I see used. Quite a few of those seem to be for applications that 
aren't run quite as much.

Standard: 4239
Cut down:1975

After switching it back to DynamicOnly and the cutdown rules.conf 
everything seems to work just fine.

I didn't mean to say that mod_security alone was responsible but, its 
use with the complete ruleset is problematic. Optimizing and being 
selective is definitely necessary even with PCRE but, PCRE is a huge 
boost to speed any way you look at it.

Zach

Justin Grindea wrote:

> badips is good maybe on a quad opteron box :)
> while it's impossible to use them in mod_security, we found that 
> iptables can
> handle them without much pain, well, depending on the amount of 
> traffic. Our
> servers do less than 5Mb in average so it's fine.
>
> One drawback is blacklist.conf which I also drop. It should be broken 
> down to
> few files and sorted out by relevance/priority.
>
> rules.conf should also definatelly be edited, tons of junk and also 
> duplicates in
> there. Looks like author starts to use IDs for the rules so I hope it 
> will be easier
> to categorize per/server rules and make the update process easier.
>
> Also, try using DynamicOnly. How PCRE would speed up processing a 
> PDF/SWF/JPG?
>
>     Justin
>
>
> Zach Roberts wrote:
>
>> In my more updated tests it appears as if the PCRE does help quite a 
>> bit but, it still isn't enough.
>>
>> Mod_security cannot handle the thousands of rules necessary to secure 
>> against all the security threats there seem to be.
>>
>> Since gotroot.com's ruleset seems to be standard for mod_security 
>> installations I did tests with those rules.
>>
>> To start off I loaded the rules into the configuration in no 
>> particular order except exclude.conf being first and watched as the 
>> server became unstable then crashed.
>>
>> After rebooting I reordered them where the less intensive rules were 
>> first (badips.conf) and others were last but, no ordering seemed to 
>> have a very noticeable effect. The server's load went back up and it 
>> crashed again.
>>
>> By removing badips.conf, several thousand rules from rules.conf, and 
>> reordering them again I did get the server stable enough with 
>> "SecFilterEngine On" with low to medium traffic. When traffic picked 
>> up at 5PM the server load started to rise and the server crashed again.
>>
>> Any further improvements would definitely be welcomed. ;)
>>
>> Zach
>>
>> Ivan Ristic wrote:
>>
>>> Justin Grindea wrote:
>>>  
>>>
>>>> hmm, forgot to paste the output...
>>>> here it is:
>>>>   
>>>
>>>
>>>
>>>  Try this first:
>>>  <apache1-home>/bin/apxs -DUSE_PCRE -cia mod_security.c
>>>
>>>  If that works but you still need to use LoadFile
>>>  use:
>>>
>>>  LoadFile /usr/lib/libpcre.so
>>>
>>>  Otherwise just download the source from pcre.org
>>>  and install it exactly as described in the manual.
>>>
>>>  
>>>
>>
>>
>>
>> -------------------------------------------------------
>> This SF.net email is sponsored by: Splunk Inc. Do you grep through 
>> log files
>> for problems?  Stop!  Download the new AJAX search engine that makes
>> searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
>> http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through log 
> files
> for problems?  Stop!  Download the new AJAX search engine that makes
> searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
> http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users

[mod-security-users] AddType/AddHandler

[Justin G. <web...@sw...>]

hi,

We use H-sphere control panel and it adds AddType php entries. The code is coming from
a java binary and cannot be edited. While we look for a script that will crawl the conf
files and change it to AddHandler, maybe we can had mod_security to include everything that starts
with AddType application/x-httpd-php in the DynamicOnly scan?

thanks,
	Justin

Re: [mod-security-users] compiling against PCRE

[Justin G. <web...@sw...>]

badips is good maybe on a quad opteron box :)
while it's impossible to use them in mod_security, we found that iptables can
handle them without much pain, well, depending on the amount of traffic. Our
servers do less than 5Mb in average so it's fine.

One drawback is blacklist.conf which I also drop. It should be broken down to
few files and sorted out by relevance/priority.

rules.conf should also definatelly be edited, tons of junk and also duplicates in
there. Looks like author starts to use IDs for the rules so I hope it will be easier
to categorize per/server rules and make the update process easier.

Also, try using DynamicOnly. How PCRE would speed up processing a PDF/SWF/JPG?

	Justin


Zach Roberts wrote:
> In my more updated tests it appears as if the PCRE does help quite a bit 
> but, it still isn't enough.
> 
> Mod_security cannot handle the thousands of rules necessary to secure 
> against all the security threats there seem to be.
> 
> Since gotroot.com's ruleset seems to be standard for mod_security 
> installations I did tests with those rules.
> 
> To start off I loaded the rules into the configuration in no particular 
> order except exclude.conf being first and watched as the server became 
> unstable then crashed.
> 
> After rebooting I reordered them where the less intensive rules were 
> first (badips.conf) and others were last but, no ordering seemed to have 
> a very noticeable effect. The server's load went back up and it crashed 
> again.
> 
> By removing badips.conf, several thousand rules from rules.conf, and 
> reordering them again I did get the server stable enough with 
> "SecFilterEngine On" with low to medium traffic. When traffic picked up 
> at 5PM the server load started to rise and the server crashed again.
> 
> Any further improvements would definitely be welcomed. ;)
> 
> Zach
> 
> Ivan Ristic wrote:
> 
>> Justin Grindea wrote:
>>  
>>
>>> hmm, forgot to paste the output...
>>> here it is:
>>>   
>>
>>
>>  Try this first:
>>  <apache1-home>/bin/apxs -DUSE_PCRE -cia mod_security.c
>>
>>  If that works but you still need to use LoadFile
>>  use:
>>
>>  LoadFile /usr/lib/libpcre.so
>>
>>  Otherwise just download the source from pcre.org
>>  and install it exactly as described in the manual.
>>
>>  
>>
> 
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through log 
> files
> for problems?  Stop!  Download the new AJAX search engine that makes
> searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
> http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users

Re: [mod-security-users] statistics

[Andras G. <an...@an...>]

Hi,

Write a munin or MRTG plugin for this and additonaly you can set up email=
 notification, depeding on=20
the seriousness (number of tries, type of tries etc) of the action. I wou=
ld say that be careful of=20
emailing because you can DoS yourself easily.

False positives should be detected by yourself by examining the error log=
 and carefully adding=20
rules. Your customers should be aware of such IDS is in use and know what=
 they can't do. Of course=20
these rules mustn't stop the usefulness of PHP or CGI (Perl).

Imho you should start with a simple script then add functionality as it n=
eeds. You can also pipe=20
through the log messages thourgh a script which examines it (maybe makes =
an sql insert, and you=20
client may be surprised by the attack logging) and then logs it. This att=
ack logging for customers=20
is so good imho that I'll make a script for this in february on our new s=
erver. :)

One of our clients used some silly ../ like things in of his html forms (=
action maybe) so i had to=20
turn off the anti-directory-traversal rule. I almost rent a seat for him =
on the next Mars mission.=20
(I develop PHP apps and never used and even never thought about using .. =
in the client side of the=20
coding.)

Regards,
Andrej


Justin Grindea =EDrta:

> hi,
>=20
> I've asked here before and kept googling but can't find any piece of sc=
ript
> that can parse the audit log(s) and provide a picture of what's going o=
n.
>=20
> I'd like to know for example top attacking IP's, top attacked sites, to=
p=20
> signatures used.
>=20
> Also I'm thinking about email notification of possible intrussions,=20
> anyone has a sane logic
> and possible script for notifications? Maybe email for one IP getting x=
=20
> errors in y seconds?
>=20
> Such script could also help detect false positives, I'm always having=20
> troubles detecting them
> before my clients :(
>=20
> thanks,
>     Justin

Re: [mod-security-users] compiling against PCRE

[Zach R. <ad...@li...>]

In my more updated tests it appears as if the PCRE does help quite a bit 
but, it still isn't enough.

Mod_security cannot handle the thousands of rules necessary to secure 
against all the security threats there seem to be.

Since gotroot.com's ruleset seems to be standard for mod_security 
installations I did tests with those rules.

To start off I loaded the rules into the configuration in no particular 
order except exclude.conf being first and watched as the server became 
unstable then crashed.

After rebooting I reordered them where the less intensive rules were 
first (badips.conf) and others were last but, no ordering seemed to have 
a very noticeable effect. The server's load went back up and it crashed 
again.

By removing badips.conf, several thousand rules from rules.conf, and 
reordering them again I did get the server stable enough with 
"SecFilterEngine On" with low to medium traffic. When traffic picked up 
at 5PM the server load started to rise and the server crashed again.

Any further improvements would definitely be welcomed. ;)

Zach

Ivan Ristic wrote:

>Justin Grindea wrote:
>  
>
>>hmm, forgot to paste the output...
>>here it is:
>>    
>>
>
>  Try this first:
>  <apache1-home>/bin/apxs -DUSE_PCRE -cia mod_security.c
>
>  If that works but you still need to use LoadFile
>  use:
>
>  LoadFile /usr/lib/libpcre.so
>
>  Otherwise just download the source from pcre.org
>  and install it exactly as described in the manual.
>
>  
>

[mod-security-users] statistics

[Justin G. <web...@sw...>]

hi,

I've asked here before and kept googling but can't find any piece of script
that can parse the audit log(s) and provide a picture of what's going on.

I'd like to know for example top attacking IP's, top attacked sites, top signatures used.

Also I'm thinking about email notification of possible intrussions, anyone has a sane logic
and possible script for notifications? Maybe email for one IP getting x errors in y seconds?

Such script could also help detect false positives, I'm always having troubles detecting them
before my clients :(

thanks,
	Justin

Re: [mod-security-users] compiling against PCRE

[Ivan R. <iv...@we...>]

Justin Grindea wrote:
> hmm, forgot to paste the output...
> here it is:

  Try this first:
  <apache1-home>/bin/apxs -DUSE_PCRE -cia mod_security.c

  If that works but you still need to use LoadFile
  use:

  LoadFile /usr/lib/libpcre.so

  Otherwise just download the source from pcre.org
  and install it exactly as described in the manual.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] compiling against PCRE

[Justin G. <web...@sw...>]

hmm, forgot to paste the output...
here it is:

/lib/libpcre.so.0
/lib/libpcre.so.0.0.1
/usr/share/man/man1/pcregrep.1.gz
/usr/share/man/man1/pcretest.1.gz
/usr/share/man/man3/clnt_pcreateerror.3.gz
/usr/share/man/man3/clnt_spcreateerror.3.gz
/usr/share/man/man3/pcreposix.3.gz
/usr/share/man/man3/pcre.3.gz
/usr/bin/pcregrep
/usr/bin/pcretest
/usr/bin/pcre-config
/usr/include/pcre
/usr/include/pcre/pcreposix.h
/usr/include/pcre/pcre.h
/usr/lib/python2.2/lib-dynload/pcre.so
/usr/lib/libpcreposix.so.0
/usr/lib/libpcreposix.so.0.0.0
/usr/lib/libpcreposix.a
/usr/lib/libpcre.a
/usr/lib/libpcre.so
/usr/lib/libpcreposix.so



Justin Grindea wrote:
> 
> thanks,
> found it.
> 
> locate pcre finds the following, not sure what I need to copy to 
> apache/libexex
> and what <pcre-source> would be when installing mod_security. Also not 
> sure about loading
> the library before mod_security in httpd.conf, again, maybe I can use 
> /lib/libpcre.so.0
> or /usr/lib/libpcre.so in httpd.conf and compile.
> 
> Ivan, can you look at this please, I want to install it tonight.
> 
> 
> thanks,
>     Justin
> 
> 
> 
> K. C. Li wrote:
> 
>> On Wed, 21 Dec 2005, Justin Grindea wrote:
>>
>>
>>> What is the compile flag for apache1/PCRE?
>>> Do I need anything special installed on the server in order to use PCRE?
>>
>>
>>
>> The relevant information is available in the section "Compiling the 
>> Apache
>> 1.x version against PCRE" in doc/modsecurity.txt (and others) file.
>>
>> Regards,
>>
>> Kwong Li
>> London
>>
>>
>>
>>
>> -------------------------------------------------------
>> This SF.net email is sponsored by: Splunk Inc. Do you grep through log 
>> files
>> for problems?  Stop!  Download the new AJAX search engine that makes
>> searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
>> http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> 
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through log 
> files
> for problems?  Stop!  Download the new AJAX search engine that makes
> searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
> http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users

Re: [mod-security-users] compiling against PCRE

[Justin G. <web...@sw...>]

thanks,
found it.

locate pcre finds the following, not sure what I need to copy to apache/libexex
and what <pcre-source> would be when installing mod_security. Also not sure about loading
the library before mod_security in httpd.conf, again, maybe I can use /lib/libpcre.so.0
or /usr/lib/libpcre.so in httpd.conf and compile.

Ivan, can you look at this please, I want to install it tonight.


thanks,
	Justin



K. C. Li wrote:
> On Wed, 21 Dec 2005, Justin Grindea wrote:
> 
> 
>>What is the compile flag for apache1/PCRE?
>>Do I need anything special installed on the server in order to use PCRE?
> 
> 
> The relevant information is available in the section "Compiling the Apache
> 1.x version against PCRE" in doc/modsecurity.txt (and others) file.
> 
> Regards,
> 
> Kwong Li
> London
> 
> 
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
> for problems?  Stop!  Download the new AJAX search engine that makes
> searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
> http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users

Re: [mod-security-users] compiling against PCRE

[K. C. L. <li...@la...>]

On Wed, 21 Dec 2005, Justin Grindea wrote:

> What is the compile flag for apache1/PCRE?
> Do I need anything special installed on the server in order to use PCRE?

The relevant information is available in the section "Compiling the Apache
1.x version against PCRE" in doc/modsecurity.txt (and others) file.

Regards,

Kwong Li
London

[mod-security-users] compiling against PCRE

[Justin G. <web...@sw...>]

hi,

What is the compile flag for apache1/PCRE?
Do I need anything special installed on the server in order to use PCRE?

I've seen a script called filter-spamc.pl in the util dir, but not sure what it's
used for...

thanks,
	Justin

Re: [mod-security-users] Compilation error on v1.9.2-rc1

[Ivan R. <iv...@we...>]

Zach Roberts wrote:
> Commenting out line 694 will fix that.

  I've just released 1.9.2-rc2, which fixes that problem and
  the compilation problem under Windows.


> For example:
> 
> /* static void my_call_exec(request_rec *r, child_info *pinfo, char
> *command, char **env); */
> 
> Other than that I havn't noticed any errors when following the
> instructions in the manual and the speed increase is immediately
> noticable from my tests.

  Great!

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Compilation error on v1.9.2-rc1

[Zach R. <ad...@li...>]

Commenting out line 694 will fix that.

For example:

/* static void my_call_exec(request_rec *r, child_info *pinfo, char 
*command, char **env); */

Other than that I havn't noticed any errors when following the 
instructions in the manual and the speed increase is immediately 
noticable from my tests.

Zach

K. C. Li wrote:

>I am trying to compile version 1.9.2-rc1 with Apache1 but received the
>following error:
>
>===> src/modules/extra
>gcc -c  -I../../os/unix -I../../include -I/usr/src/openssl-0.9.8/include
>-O2 -DLINUX=22 -DTARGET=\"httpsd\" -I/usr/include/db1 -DUSE_EXPAT
>-I../../lib/expat-lite -DNO_DL_NEEDED -DAPACHE_SSL `../../apaci`
>mod_security.c
>mod_security.c:710: conflicting types for `my_call_exec'
>mod_security.c:694: previous declaration of `my_call_exec'
>make[4]: *** [mod_security.o] Error 1
>
>Regards,
>
>Kwong Li
>London
>
>
>
>-------------------------------------------------------
>This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
>for problems?  Stop!  Download the new AJAX search engine that makes
>searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
>http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
>_______________________________________________
>mod-security-users mailing list
>mod...@li...
>https://lists.sourceforge.net/lists/listinfo/mod-security-users
>  
>