mod-security-users — General discussion about mod_security

Re: [mod-security-users] Wrong post trigger

[Ivan R. <iv...@we...>]

Gerwin Krist -|- Digitalus Webhosting wrote:
> Hey there my fellow list readers. I was testing some new rules (mostly for php 
> email injection rules), for this it was required to have ScanPOST on.
> 
> I have the following rule:
> SecFilterSelective ARGS_VALUES  "(http:/).+(\.txt|\.jpg|\.dat|\.gif|\.jpeg 
> \.ini|\:[0-9]{1,9})"
> Which should check for remote locations in server arguments (GET) only right?

  No. It checks all arguments, no matter where they are. If you are
  only interested in GET try QUERY_STRING.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Wrong post trigger

[Justin G. <web...@sw...>]

What solution can PHP add? You do want to have an email address as an ARG, right?
You do want to have multiple recipients, right?

If this is a private server and it DOESN'T do mailing lists (only submission forms),
you can tweak the smtp to send one mail/minute. Spammers will not waiste time on a server
that sends one message per minute out and will probably leave you alone.

For better performance, put the mailboxes on the same server as the web and set the smtp to
send to local immediatelly and remote email one per minute.

	Justin

Gerwin Krist -|- Digitalus Webhosting wrote:
> He Justin,
> 
> We do install it on a private server (i still not agree on your opinion 
> though), I rather see php adding a solution for it. 
> 
> Greetings,
> 
> On Friday 16 December 2005 09:33, Justin Grindea wrote:
> 
>>Gerwin,
>>
>>Unless this is a dedicated server in which you have absolute control on the
>>scripts, I find these techniques more hurting than adding something...
>>
>>We are using shared servers here and anything we tried gave false
>>positives.
>>
>>We are hitting the issue from a different pov - installing spam-assassin on
>>the gateway and quarantining the suspected spam messages for later review.
>>If we find false positives, we instruct the client on how to fix it (mainly
>>modify the email text).
>>Adding spamhaus/spamcop with a big score in spam-assassin does the trick,
>>many spammers are blacklisted or use zombies to send spam which are also
>>getting listed fast in the bls.
>>
>>happy spam fighting,
>>
>>	Justin
>>
>>Gerwin Krist -|- Digitalus Webhosting wrote:
>>
>>>Hey there my fellow list readers. I was testing some new rules (mostly
>>>for php email injection rules), for this it was required to have ScanPOST
>>>on.
>>>
>>>I have the following rule:
>>>SecFilterSelective ARGS_VALUES 
>>>"(http:/).+(\.txt|\.jpg|\.dat|\.gif|\.jpeg \.ini|\:[0-9]{1,9})"
>>>Which should check for remote locations in server arguments (GET) only
>>>right? Well mod_security also triggers it when I put a remote location in
>>>an email form. Am I making a thinking error here? Maybe I looked to long
>>>to this issue :)
>>
>>-------------------------------------------------------
>>This SF.net email is sponsored by: Splunk Inc. Do you grep through log
>>files for problems?  Stop!  Download the new AJAX search engine that makes
>>searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
>>http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
>>_______________________________________________
>>mod-security-users mailing list
>>mod...@li...
>>https://lists.sourceforge.net/lists/listinfo/mod-security-users
> 
> 

Re: [mod-security-users] Wrong post trigger

[Gerwin K. -|- D. W. <ge...@di...>]

He Justin,

We do install it on a private server (i still not agree on your opinion 
though), I rather see php adding a solution for it. 

Greetings,

On Friday 16 December 2005 09:33, Justin Grindea wrote:
> Gerwin,
>
> Unless this is a dedicated server in which you have absolute control on the
> scripts, I find these techniques more hurting than adding something...
>
> We are using shared servers here and anything we tried gave false
> positives.
>
> We are hitting the issue from a different pov - installing spam-assassin on
> the gateway and quarantining the suspected spam messages for later review.
> If we find false positives, we instruct the client on how to fix it (mainly
> modify the email text).
> Adding spamhaus/spamcop with a big score in spam-assassin does the trick,
> many spammers are blacklisted or use zombies to send spam which are also
> getting listed fast in the bls.
>
> happy spam fighting,
>
> 	Justin
>
> Gerwin Krist -|- Digitalus Webhosting wrote:
> > Hey there my fellow list readers. I was testing some new rules (mostly
> > for php email injection rules), for this it was required to have ScanPOST
> > on.
> >
> > I have the following rule:
> > SecFilterSelective ARGS_VALUES 
> > "(http:/).+(\.txt|\.jpg|\.dat|\.gif|\.jpeg \.ini|\:[0-9]{1,9})"
> > Which should check for remote locations in server arguments (GET) only
> > right? Well mod_security also triggers it when I put a remote location in
> > an email form. Am I making a thinking error here? Maybe I looked to long
> > to this issue :)
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through log
> files for problems?  Stop!  Download the new AJAX search engine that makes
> searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
> http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users

-- 
Met vriendelijke groet/With kind regards,

Gerwin Krist

Digitalus
First-class Internet Webhosting

(w) http://www.digitalus.nl
(e) gerwin at digitalus.nl
(p) PGP-ID: 79B325D4
(t) +31 (0) 598 630000
(f) +31 (0) 598 631860


***************************************************************************************
This message may contain information which is confidential or privileged.
If you are not the intended recipient, please advise the sender immediately
by reply e-mail and delete this message and any attachments without
retaining
a copy.
***************************************************************************************

Re: [mod-security-users] Wrong post trigger

[Justin G. <web...@sw...>]

Gerwin,

Unless this is a dedicated server in which you have absolute control on the scripts, I find
these techniques more hurting than adding something...

We are using shared servers here and anything we tried gave false positives.

We are hitting the issue from a different pov - installing spam-assassin on the gateway and
quarantining the suspected spam messages for later review. If we find false positives, we instruct
the client on how to fix it (mainly modify the email text).
Adding spamhaus/spamcop with a big score in spam-assassin does the trick, many spammers are blacklisted
or use zombies to send spam which are also getting listed fast in the bls.

happy spam fighting,

	Justin


Gerwin Krist -|- Digitalus Webhosting wrote:
> Hey there my fellow list readers. I was testing some new rules (mostly for php 
> email injection rules), for this it was required to have ScanPOST on.
> 
> I have the following rule:
> SecFilterSelective ARGS_VALUES  "(http:/).+(\.txt|\.jpg|\.dat|\.gif|\.jpeg 
> \.ini|\:[0-9]{1,9})"
> Which should check for remote locations in server arguments (GET) only right?
> Well mod_security also triggers it when I put a remote location in an email 
> form. Am I making a thinking error here? Maybe I looked to long to this 
> issue :)
> 

[mod-security-users] Wrong post trigger

[Gerwin K. -|- D. W. <ge...@di...>]

Hey there my fellow list readers. I was testing some new rules (mostly for php 
email injection rules), for this it was required to have ScanPOST on.

I have the following rule:
SecFilterSelective ARGS_VALUES  "(http:/).+(\.txt|\.jpg|\.dat|\.gif|\.jpeg 
\.ini|\:[0-9]{1,9})"
Which should check for remote locations in server arguments (GET) only right?
Well mod_security also triggers it when I put a remote location in an email 
form. Am I making a thinking error here? Maybe I looked to long to this 
issue :)

-- 
Met vriendelijke groet/With kind regards,

Gerwin Krist

Digitalus
First-class Internet Webhosting

(w) http://www.digitalus.nl
(e) gerwin at digitalus.nl
(p) PGP-ID: 79B325D4
(t) +31 (0) 598 630000
(f) +31 (0) 598 631860


***************************************************************************************
This message may contain information which is confidential or privileged.
If you are not the intended recipient, please advise the sender immediately
by reply e-mail and delete this message and any attachments without
retaining
a copy.
***************************************************************************************

Re: [mod-security-users] Performance using ModSecurity with Apache 1.3.x

[Justin G. <web...@sw...>]

I'm on h-sphere, same problem, specially on busy servers.
Using gotroot's rules was always a pain, specially their blacklists and badips, if I turn
these on, server skyrockets :)

Ivan, please keep us posted on your findings.

thanks,
	Justin


Zach Roberts wrote:
> This sounds like a very good idea. Some of us that use mod_security do 
> so with cPanel, Plesk, or other commercial control panels in shared 
> hosting environments and cannot switch to Apache 2 since it is not 
> supported.
> 
> Keep up the great work Ivan. :)
> 
> Zach
> 
> Ivan Ristic wrote:
> 
>> Some information for those of you using ModSecurity with
>> Apache 1.3.x:
>>
>> I have just completed a round of performance tests. As some of
>> you already know, the regular expression engine that comes
>> with Apache 1.3.x is much slower than the one that comes with
>> Apache 2.x (PCRE). When I say slower I mean *several times*
>> slower for non-trivial requests.
>>
>> However, today I tried something else: I compiled
>> ModSecurity for Apache 1.3.x against PCRE instead of the
>> built-in regex library. I only had a very brief time to
>> test the result but it appears that everything works
>> well and the regex execution speed is equal to that of
>> Apache 2.x.
>>
>> Chances are I will officially support compilation against
>> PCRE in the forthcoming 1.9.2.
>>
>>  
>>
> 
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through log 
> files
> for problems?  Stop!  Download the new AJAX search engine that makes
> searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
> http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users

Re: [mod-security-users] Performance using ModSecurity with Apache 1.3.x

[Zach R. <ad...@li...>]

This sounds like a very good idea. Some of us that use mod_security do 
so with cPanel, Plesk, or other commercial control panels in shared 
hosting environments and cannot switch to Apache 2 since it is not 
supported.

Keep up the great work Ivan. :)

Zach

Ivan Ristic wrote:

>Some information for those of you using ModSecurity with
>Apache 1.3.x:
>
>I have just completed a round of performance tests. As some of
>you already know, the regular expression engine that comes
>with Apache 1.3.x is much slower than the one that comes with
>Apache 2.x (PCRE). When I say slower I mean *several times*
>slower for non-trivial requests.
>
>However, today I tried something else: I compiled
>ModSecurity for Apache 1.3.x against PCRE instead of the
>built-in regex library. I only had a very brief time to
>test the result but it appears that everything works
>well and the regex execution speed is equal to that of
>Apache 2.x.
>
>Chances are I will officially support compilation against
>PCRE in the forthcoming 1.9.2.
>
>  
>

[mod-security-users] PHP mail() header injection issues

[Mojo J. <my...@li...>]

Hello, I am new to the list and hope this post is not off topic in some way.


I have read in a few places that installing mod_security was a good way to 
combat PHP mail() header injection issues.


I have installed mod_security on the server in question and think I have got 
it setup to protect against future attacks.


For now I have turned it off because I want to first duplicate the issue so 
I can then turn mod_security on and see if it stops the same exploit I can 
do with it off.


Please see my post below which I recently posted to a web hosting forum, any 
help would be greatly appreciated!


####################Post to forum##############################


We are seeing some issues on one of our servers where SPAMMERS are taking 
advantage of some of the php forms using mail() to send SPAM.


I have been reading about this for days and I am stuck on a few things.


First, I need to know how to re-create the issue before I can test to see if 
I stopped it.


I have read this article here for example:

http://securephp.damonkohler.com/ind...mail_Injection


which is a great article.


Thing I don't get is this, it shows that the SPAMMER could enter a string 
like this in the "From:" field of your form:

"se...@an...%0ACc:rec...@so...%0AB...@gr...,som...@oo..."which 
would send out his SPAM.


Thing that has me stuck is this, everytime I try to punch this string into a 
sample "From:" field on a test form, when I print the string to the screen 
it comes out exactly like that with the "%0A" and all. The "%0A" is suppose 
to be converted into a "\n" which is needed of for the exploit to work. 
Problem is that POST data does not get unencoded like GET data on the other 
end and the PHP mail() just barfs.


If I try to send the same string with plain old "\n" then it ends up looking 
like this "\\n" on the other side because Magic Quotes is escaping my 
backslash.

I am confused as to how the SPAMMERS have been able to successfully pass the 
"\n" which is needed in a POST when I can't do it myself.

I know they are doing it because I have seen the SPAM go through the machine 
and I know if came from a FORM pretty much identical to my test form.

Any ideas? This is driving me seriously buggy..

[mod-security-users] modsecurity and spam in OWA

[Jason H. <Jas...@tr...>]

This may sound like a feature instead of a bug, but I thought it might
reflect how complex Web security can actually be...

We use an Apache reverse-proxy to protect a Microsoft Outlook Web Access
(OWA) server, and I have modsecurity-1.9.1 in there doing it's thing.

However, I just found it blocked me from reading some nice Asian spam
someone kindly thought to send me:

GET
/exchange/username/Inbox/%E4%B8%8A%E7%BD%91%E9%A1%BA%E5%B8%A6%E6%8C%A3%E7%BE%8E%E5%85%83.EML?Cmd=open
HTTP/1.1

(OWA creates links to each msg based on the Subject line)

Anyway, I had "SecFilterForceByteRange 32 126" and it blocked that URL
as there was a char 228 in there

Sooo, what should I block instead? Given the fact that the Webapp needs
to present almost any char (i.e. assuming a Subject line could contain
any char), could I do an exclusion list instead? i.e. accept everything
other than NULL, etc? And if so, can someone tell me what "etc" should
actually be? ;-)

Thanks!

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

Re: [mod-security-users] Performance using ModSecurity with Apache 1.3.x

[K. C. L. <li...@la...>]

On Thu, 15 Dec 2005, Ivan Ristic wrote:

> However, today I tried something else: I compiled
> ModSecurity for Apache 1.3.x against PCRE instead of the
> built-in regex library. I only had a very brief time to
> test the result but it appears that everything works
> well and the regex execution speed is equal to that of
> Apache 2.x.

That sounds interesting. How does one compile Apache 1.3.x with PCRE
instead of the built-in regex engine please?

While on the subject of response time, we deployed mod_security on one of
our Apache 1.3.33 servers (PHP-4.4.1, OpenSSL-0.9.8, Apache_SSL and
mmcache-2.4.4) running Linux 2.2.26. It worked well for anything between a
few hours to a day before two, and only two, of the Apache child processes
start eating up CPU time. eg. 45% and 49%. Apache would eventually become
unresponsive and had to be restarted. Recompiling Apache without
mod_security would restore it to it's former steady running state. Any
pointers as what might be causing the high CPU consumption please?

Please see the Apache configuration section of mod_security at the end.

Regards,

Kwong Li
London


httpsd.conf mod_security section:

<IfModule mod_security.c>
    SecFilterEngine DynamicOnly
    SecFilterScanPOST On
    SecFilterSelective HTTP_Transfer-Encoding "!^$"
    SecFilterDefaultAction "deny,log,status:403"
    SecFilterInheritance On
    SecFilterCheckURLEncoding On
    SecFilterCheckUnicodeEncoding Off
    SecFilterForceByteRange 1 255  
    SecFilter "\.\./"
    SecFilter /etc/password
    SecFilter /bin/ls
    SecFilter "<(.|\n)+>"
    SecFilter "<[[:space:]]*script"
    SecFilter "delete[[:space:]]+from"
    SecFilter "insert[[:space:]]+into"
    SecFilter "drop[[:space:]]table"  
    SecFilter "select.+from"
    SecFilterSelective REQUEST_METHOD "!^(GET|HEAD)$" chain
    SecFilterSelective HTTP_Content-Type "!(^application/x-www-form-urlencoded$|^multipart/form-data;)"
    SecFilterSelective REQUEST_METHOD "^(GET|HEAD)$" chain
    SecFilterSelective HTTP_Content-Length "!^$"
    SecFilterSelective REQUEST_METHOD "^POST$" chain
    SecFilterDebugLog logs/modsec_debug_log
    SecFilterDebugLevel 0
    SecAuditEngine RelevantOnly
    SecAuditLog logs/audit_log
</IfModule>

[mod-security-users] Performance using ModSecurity with Apache 1.3.x

[Ivan R. <iv...@we...>]

Some information for those of you using ModSecurity with
Apache 1.3.x:

I have just completed a round of performance tests. As some of
you already know, the regular expression engine that comes
with Apache 1.3.x is much slower than the one that comes with
Apache 2.x (PCRE). When I say slower I mean *several times*
slower for non-trivial requests.

However, today I tried something else: I compiled
ModSecurity for Apache 1.3.x against PCRE instead of the
built-in regex library. I only had a very brief time to
test the result but it appears that everything works
well and the regex execution speed is equal to that of
Apache 2.x.

Chances are I will officially support compilation against
PCRE in the forthcoming 1.9.2.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] file upload error

[Ivan R. <iv...@we...>]

scOrpiOnn wrote:
> hi all, one question :D
> 
> i have a upload form -> upload.asp , and i put one gif image, and do
> upload...  (mozilla firefox)
> 
> modsec.conf -------------
>  <Location /asp/upload.asp>
>         SecFilterInheritance Off
>         SecFilterSelective POST_PAYLOAD "!image/(jpeg|bmp|gif)"
>     </Location>
> ---------------------------------
>
> ...
>
> any ideas ? THX ALL :)

  It doesn't work the way you think it does :) You don't get
  to access the raw request payload for multipart/form-data
  requests. And even if you did, the content-type field is
  client-driven and thus easy to fake.

  To filter uploaded files you need to create a script and
  use SecUploadApproveScript. But you'll need to figure out
  the content types by yourself.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] file upload error

[scOrpiOnn <sco...@gm...>]

hi all, one question :D

i have a upload form -> upload.asp , and i put one gif image, and do
upload...  (mozilla firefox)

modsec.conf -------------
 <Location /asp/upload.asp>
        SecFilterInheritance Off
        SecFilterSelective POST_PAYLOAD "!image/(jpeg|bmp|gif)"
    </Location>
---------------------------------

error message:
[Thu Dec 15 11:07:01 2005] [error] [client 10.10.5.14] mod_security: Access
denied with code 403. Pattern match "!image/(jpeg|bmp|gif)" at POST_PAYLOAD
[hostname "www.euromadi.es"] [uri "/asp/upload.asp"]

i was tested lot of combinations for SecFilterSelective POST_PAYLOAD , like
"!image/(gif)" , "(gif)" ...
lots of tests, but never works.

any ideas ? THX ALL :)
 <mod...@li...>

[mod-security-users] Patch to avoid mod_security execute upload approve scripts with suEXEC

[<mb...@co...>]

Hi,

this is also a followup to Justin Grindea and "clamav perl scrip and su_e=
xec".

We faced the same problem and considered it a design error for an upload =
approve
script to be called using suEXEC for these two reasons:

1. suEXEC executes CGIs as different users, which might                =20
   not have access to the uploaded files (which are usually            =20
   in /tmp and owned by www-data:www-data, permissions 600)            =20
                                                                       =20
2. suEXEC check 18, "Is the target user/group the same as              =20
   the program's user/group?" means for us that we would need          =20
   as many upload approve scripts as virtual hosts, each               =20
   owned by the user the respective virtual host runs his              =20
   CGIs under.                                                         =20

The solution in the attached patch is to avoid ap_call_exec() using suEXE=
C.

Most likely, soemone with more experience in apache programming can boil =
this
patch down to the essentials. It runs on our test system as intended, but=
 we
didn't put it into production use yet. It would be nice to get some feedb=
ack first.

The patch is against mod_security.c of the apache1 directory of the curre=
nt
1.9.1 release of mod_security.

Kindest regards,
 Michael Bunk

-----------------------------------------
Gesendet mit Computer Leipzig - WebMail
http://www.computer-leipzig.de

[mod-security-users] SecAuditLogParts , only A and B showing?

[<li...@32...>]

Hello,

I have this parameter set up...

SecAuditLogParts ABCDEFGHZ

But my audit log entries only show A and B sections.

Did I miss something?



-Mike

[mod-security-users] Log console?

[<li...@32...>]

Is there a web UI to see the results of audit logs? I am using the
Concurrent setting and wondered if anyone has written such a utility yet?

TIA -Mike

Re: [mod-security-users] problem compiling?

[Ivan R. <iv...@we...>]

Aviram Carmi wrote:
> Hi all,
> 
> relatively new to this, so I am probably making a very obvious mistake...
> 
> I am getting errors installing/compiling mod_security.
> 
> can you help?
> 
> thanks,
> 
> -avi
> 
> here is the requested info
> 
> 
> # cd apache2/
> # apxs -cia mod_security.c
> /etc/httpd/build/libtool --silent --mode=compile gcc -prefer-pic
> -DAP_HAVE_DESIGNATED_INITIALIZER -DLINUX=2 -D_REENTRANT
> -D_XOPEN_SOURCE=500 -D_BSD_SOURCE -D_SVID_SOURCE -g -O2 -pthread
> -DNO_DBM_REWRITEMAP -I/usr/include/httpd  -c -o mod_security.lo
> mod_security.c && touch mod_security.slo
> mod_security.c: In function `sec_audit_logger_concurrent':
> mod_security.c:5419: `APR_MD5_DIGESTSIZE' undeclared (first use in this
> function)
> mod_security.c:5419: (Each undeclared identifier is reported only once
> mod_security.c:5419: for each function it appears in.)

  This looks like the MD5 functions are missing from
  your distribution.


> mod_security.c: In function `register_hooks':
> mod_security.c:7959: incompatible type for argument 3 of
> `ap_register_input_filter'
> mod_security.c:7959: too many arguments to function
> `ap_register_input_filter'
> mod_security.c:7960: incompatible type for argument 3 of
> `ap_register_output_filter'
> mod_security.c:7960: too many arguments to function
> `ap_register_output_filter'
> apxs:Error: Command failed with rc=65536

  This, however, looks far more serious. It appears the version
  of Apache you are using is an older, incompatible, one.

> .
> # uname -a
> Linux otn.com 2.4.20-28.7smp #1 SMP Thu Dec 18 11:18:31 EST 2003 i686
> unknown
> # cat /etc/redhat-release
> Red Hat Linux release 7.3 (Valhalla)
> # httpd -V
> Server version: Apache/2.0.36

  I am afraid I don't think you will be able to get mod_security
  working with that version of Apache.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] problem compiling?

[Aviram C. <avi...@ot...>]

Hi all,

relatively new to this, so I am probably making a very obvious mistake...

I am getting errors installing/compiling mod_security.

can you help?

thanks,

-avi

here is the requested info


# cd apache2/
# apxs -cia mod_security.c
/etc/httpd/build/libtool --silent --mode=compile gcc -prefer-pic 
-DAP_HAVE_DESIGNATED_INITIALIZER -DLINUX=2 -D_REENTRANT 
-D_XOPEN_SOURCE=500 -D_BSD_SOURCE -D_SVID_SOURCE -g -O2 -pthread 
-DNO_DBM_REWRITEMAP -I/usr/include/httpd  -c -o mod_security.lo 
mod_security.c && touch mod_security.slo
mod_security.c: In function `sec_audit_logger_concurrent':
mod_security.c:5419: `APR_MD5_DIGESTSIZE' undeclared (first use in 
this function)
mod_security.c:5419: (Each undeclared identifier is reported only once
mod_security.c:5419: for each function it appears in.)
mod_security.c: In function `register_hooks':
mod_security.c:7959: incompatible type for argument 3 of 
`ap_register_input_filter'
mod_security.c:7959: too many arguments to function `ap_register_input_filter'
mod_security.c:7960: incompatible type for argument 3 of 
`ap_register_output_filter'
mod_security.c:7960: too many arguments to function `ap_register_output_filter'
apxs:Error: Command failed with rc=65536
.
# uname -a
Linux otn.com 2.4.20-28.7smp #1 SMP Thu Dec 18 11:18:31 EST 2003 i686 unknown
# cat /etc/redhat-release
Red Hat Linux release 7.3 (Valhalla)
# httpd -V
Server version: Apache/2.0.36
Server built:   Jul 24 2002 07:53:25
Server's Module Magic Number: 20020329:1
Architecture:   32-bit
Server compiled with....
  -D APACHE_MPM_DIR="server/mpm/prefork"
  -D APR_HAS_SENDFILE
  -D APR_HAS_MMAP
  -D APR_HAVE_IPV6
  -D APR_USE_SYSVSEM_SERIALIZE
  -D APR_USE_PTHREAD_SERIALIZE
  -D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
  -D APR_HAS_OTHER_CHILD
  -D AP_HAVE_RELIABLE_PIPED_LOGS
  -D HTTPD_ROOT="/etc/httpd"
  -D SUEXEC_BIN="/usr/sbin/suexec"
  -D DEFAULT_ERRORLOG="logs/error_log"
  -D SERVER_CONFIG_FILE="conf/httpd.conf"
# httpd -l
Compiled in modules:
   core.c
   prefork.c
   http_core.c
   mod_so.c
# grep RELEASE mod_security.c
#define MODULE_RELEASE "1.9.1"



-- 

--
Aviram Carmi
Owner
Executive Vice President, Technology          (805) 384-1144
Over TheNet
PO Box 1499                                   http://www.otn.com/
Camarillo, CA 93011-1499

(c) Copyright 2004, Over TheNet.  All rights reserved.

Re: [mod-security-users] Apache 2.2.0 - Mod Security 1.9.1 - Webdav Folder

[Philippe B. <pbo...@ci...>]

Hi,

If think I had issues with Webdav/IE too.

You should replace this :

>     SecFilterSelective HTTP_Content-Type
>"!(^application/x-www-form-urlencoded$|^multipart/form-data;)"

With this :
SecFilterSelective HTTP_Content-Type 
"!(^$|^application/x-www-form-urlencoded$|^multipart/form-data|^text/xml)"

It worked for me.


Sincerely,

Philippe Bourcier

Re: [mod-security-users] Apache 2.2.0 - Mod Security 1.9.1 - Webdav Folder

[Ann H. <sea...@ha...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

I forgot to add that I was using Windows XP to connect using Webdav.

"/tails/" did not work.  I also have to trick Windows XP to use basic
authentication otherwise it fails miserably.  "http://www.example.com:80/tails"
does work after changing the alias to what you suggested.

Weird that it worked before in pre-2.2.0 but I have a lot of those quirks yesterday.

Thank you.


Ivan Ristic wrote:
> Ann Hopkins wrote:
> 
>>I moved my webdav folder out of the general root directory structure in apache,
>>and used "SecFilterInheritance Off", but it "Mod_security" still blocks the
>>request.  I would appreciate any ideas. Thanks
> 
> 
>   The way you have Apache configured right now
> 
>     Alias /tails/ "/<non-standard location>/tails/"
> 
>   Alias "kicks in" only when you provide the / at the end of the
>   URI. But this is not happening:
> 
> 
>>[Fri Dec 02 16:24:47 2005] [error] [client 192.168.254.XXX] mod_security: Access
>>denied with code 403. Pattern match
>>"!(^application/x-www-form-urlencoded$|^multipart/form-data;)" at
>>HEADER("Content-Type") [hostname "www.example.com"] [uri "/tails"]
> 
> 
>   Without the / at the end Apache treats the request as one
>   for the root context. (You would be getting a 404 response if it
>   were not for ModSecurity.)
> 
>   You can test my assumption my making a request to "/tails/" instead
>   of "/tails".
> 
>   Changing the Alias line to:
> 
>     Alias /tails "/<non-standard location>/tails"
> 
>   should fix the problem.
> 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFDkeVXhs7JGk93PT0RA8feAJ4yHDYV0P9JMa/ZOsYGW9s/6JG3HACfYs10
A+HhuTK2AFzPui/6ifWMCRI=
=sy/S
-----END PGP SIGNATURE-----

Re: [mod-security-users] Apache 2.2.0 - Mod Security 1.9.1 - Webdav Folder

[Ivan R. <iv...@we...>]

Ann Hopkins wrote:
> I moved my webdav folder out of the general root directory structure in apache,
> and used "SecFilterInheritance Off", but it "Mod_security" still blocks the
> request.  I would appreciate any ideas. Thanks

  The way you have Apache configured right now

    Alias /tails/ "/<non-standard location>/tails/"

  Alias "kicks in" only when you provide the / at the end of the
  URI. But this is not happening:

> [Fri Dec 02 16:24:47 2005] [error] [client 192.168.254.XXX] mod_security: Access
> denied with code 403. Pattern match
> "!(^application/x-www-form-urlencoded$|^multipart/form-data;)" at
> HEADER("Content-Type") [hostname "www.example.com"] [uri "/tails"]

  Without the / at the end Apache treats the request as one
  for the root context. (You would be getting a 404 response if it
  were not for ModSecurity.)

  You can test my assumption my making a request to "/tails/" instead
  of "/tails".

  Changing the Alias line to:

    Alias /tails "/<non-standard location>/tails"

  should fix the problem.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Apache 2.2.0 - Mod Security 1.9.1 - Webdav Folder

[Ann H. <sea...@ha...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

Apache 2.2.0 configuration now uses a modular configuration file with includes
and this is the portion at the the end of the "http.conf" file - modules are
activated at the beginning of this file.

...
# Distributed authoring and versioning (WebDAV)
Include conf/httpd-dav.conf

# Various default settings
Include conf/httpd-default.conf

# Modsecurity filtering (Specific)
Include conf/httpd-modsecurity.conf

# Handypaws - Directories - Aliases (Specific)
Include conf/httpd-handypaws.conf

# Secure (SSL/TLS) connections
Include conf/httpd-ssl.conf
#
# Note: The following must must be present to support
#       starting without SSL on platforms with no /dev/random equivalent
#       but a statically compiled-in mod_ssl.
#
<IfModule ssl_module>
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
</IfModule>


Here is the file "httpd-modsecurity.conf"

# Module_Security
# Security module - recommended configuration
<IfModule mod_security.c>

    # Turn ModSecurity On
    SecFilterEngine On

    # Reject requests with status 403
    SecFilterDefaultAction "deny,log,status:403"

    # Some sane defaults
    SecFilterScanPOST On
    SecFilterCheckURLEncoding On
    SecFilterCheckUnicodeEncoding Off

    # Accept almost all byte values
    SecFilterForceByteRange 1 255

    # Server masking is optional
    # SecServerSignature "Microsoft-IIS/5.0"

    # Change Security Signature Requires
    # ServerSignature On and Server Tokens Full
    SecServerSignature "SOMETHING RATHER SILLY"

    SecUploadDir /tmp
    SecUploadKeepFiles Off

    # Only record the interesting stuff
    SecAuditEngine RelevantOnly
    SecAuditLog logs/audit_log

    # You normally won't need debug logging
    SecFilterDebugLevel 0
    SecFilterDebugLog logs/modsec_debug_log

    CustomLog "|/usr/local/apache/bin/rotatelogs
/usr/local/apache/logs/modseccustomlog.%Y-%m-%d-%H_%M_%S 5M" \
   "%h %l %u %t \"%r\" %>s %b %{mod_security-message}i" \
    env=mod_security-relevant

    # Only accept request encodings we know how to handle
    # we exclude GET requests from this because some (automated)
    # clients supply "text/html" as Content-Type
    SecFilterSelective REQUEST_METHOD "!^(GET|HEAD)$" chain
    SecFilterSelective HTTP_Content-Type
"!(^application/x-www-form-urlencoded$|^multipart/form-data;)"

    # Do not accept GET or HEAD requests with bodies
    SecFilterSelective REQUEST_METHOD "^(GET|HEAD)$" chain
    SecFilterSelective HTTP_Content-Length "!^$"

    # Require Content-Length to be provided with
    # every POST request
    SecFilterSelective REQUEST_METHOD "^POST$" chain
    SecFilterSelective HTTP_Content-Length "^$"

    # Don't accept transfer encodings we know we don't handle
    SecFilterSelective HTTP_Transfer-Encoding "!^$"

    # Kill email relay attempts and log
    # example : CONNECT news98.idv.tw:25 HTTP/1.0
    SecFilterSelective "SERVER_PORT" 25

</IfModule>


Ivan Ristic wrote:
> Ann Hopkins wrote:
> 
>>I moved my webdav folder out of the general root directory structure in apache,
>>and used "SecFilterInheritance Off", but it "Mod_security" still blocks the
>>request.  I would appreciate any ideas. Thanks
> 
> 
>   You appear to be doing the right thing. This may be a problem with
>   the order in which contexts are inherited in Apache.
> 
>   Show us the part where you create ModSecurity configuration.
> 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFDkdyOhs7JGk93PT0RA6zlAKDEKoslHC+mQYDoilpaWXy8j0eR+gCfUYFl
ho04ZyZABv6NBNM5kp9yk/s=
=qxog
-----END PGP SIGNATURE-----

Re: [mod-security-users] Apache 2.2.0 - Mod Security 1.9.1 - Webdav Folder

[Ivan R. <iv...@we...>]

Ann Hopkins wrote:
> I moved my webdav folder out of the general root directory structure in apache,
> and used "SecFilterInheritance Off", but it "Mod_security" still blocks the
> request.  I would appreciate any ideas. Thanks

  You appear to be doing the right thing. This may be a problem with
  the order in which contexts are inherited in Apache.

  Show us the part where you create ModSecurity configuration.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Apache 2.2.0 - Mod Security 1.9.1 - Webdav Folder

[Ann H. <sea...@ha...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

I moved my webdav folder out of the general root directory structure in apache,
and used "SecFilterInheritance Off", but it "Mod_security" still blocks the
request.  I would appreciate any ideas. Thanks

Error Message - Apache
========================
[Fri Dec 02 16:24:47 2005] [error] [client 192.168.254.XXX] mod_security: Access
denied with code 403. Pattern match
"!(^application/x-www-form-urlencoded$|^multipart/form-data;)" at
HEADER("Content-Type") [hostname "www.example.com"] [uri "/"]
[Fri Dec 02 16:24:47 2005] [error] [client 192.168.254.XXX] mod_security: Access
denied with code 403. Pattern match
"!(^application/x-www-form-urlencoded$|^multipart/form-data;)" at
HEADER("Content-Type") [hostname "www.example.com"] [uri "/tails"]


httpd-dav.conf
=========================
DavLockDB /usr/local/apache/var/DavLock
DAVMinTimeout 600

Alias /tails/ "/<non-standard location>/tails/"

<Directory "/<non-standard location>/tails">
    Dav On

    Options Indexes MultiViews

    AllowOverride AuthConfig
    Order allow,deny
    Allow from all

    SecFilterInheritance Off

    AuthName "Tails Area"
    AuthType Basic
    AuthBasicProvider dbm
    AuthDBMType DB
    AuthzDBMType DB
    AuthDBMUserFile /usr/local/apache/etc/password-file
    AuthDBMGroupFile /usr/local/apache/etc/password-file
    <LimitExcept GET OPTIONS>
        Require group tails
    </LimitExcept>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFDkOemhs7JGk93PT0RA7BxAKCNXMcy3gU36k8uSb5pKWXSXWHv8QCfT8aI
iSvzL9TlUWsYTAt5ccfTkEU=
=5cWP
-----END PGP SIGNATURE-----

Re: [mod-security-users] Exception

[Ivan R. <iv...@we...>]

Randvo wrote:
>
> But what if i want to disable a specific rule in a specific file on a
> specific domain/user ??

  Option #1, add the <Location> tags to the <VirtualHost> container.

  Option #2, use <Directory>

  Also have a look at SecFilterRemove (in the manual).

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org