mod-security-users — General discussion about mod_security

[mod-security-users] Problem with mod_security 1.9 and the new "SecFilterSignatureActi on"

[CASTELLE T. <tca...@ge...>]

Hi there,

I just installed mod_security 1.9, and I have a problem with the
SecFilterSignatureAction directive which might be a bug...

Let's consider this conf (We want mod_security to work in "Log Only"
mode) :

	SecFilterEngine On

	SecFilterScanPOST On

	SecFilterSelective REQUEST_METHOD "^POST$" chain
	SecFilterSelective HTTP_Content-Length "^$"

	SecFilterSelective HTTP_Transfer-Encoding "!^$"

	SecFilterDefaultAction "pass,log"

	SecFilterActionsRestricted On

	SecFilterCheckURLEncoding On

	SecFilterCheckUnicodeEncoding Off

	SecFilterForceByteRange 1 255

	SecServerResponseToken Off

	SecAuditEngine RelevantOnly

	SecFilter 111  

	SecFilter 111 chain
	SecFilter 333

And let's consider these requests and the corresponding log entry :

GET /111.html HTTP/1.1
=> Log entry : 
	Warning. Pattern match "111" at REQUEST_URI

GET /333.html HTTP/1.1
=> Log entry : 
	nothing

GET /111/333.html HTTP/1.1
=> Log entry : 
	Warning. Pattern match "111" at REQUEST_URI
	Warning. Pattern match "333" at REQUEST_URI

Everything's fine here.

But if I add an id to the rules, like :

	SecFilter 111 id:1

	SecFilter 111 chain,id:2
	SecFilter 333	

Then, the warning becomes a deny because, as documented : " Per-rule
actions are merged with the actions specified in the most recent
SecFilterSignatureAction directive (the default value is
log,deny,status:403)"

So, I add the appropriate SecFilterSignatureAction like this :

	SecFilterSignatureAction "pass,log"

	SecFilter 111 id:1

	SecFilter 111 chain,id:2
	SecFilter 333	

And then, the chain action seems to be ignored :

GET /111.html HTTP/1.1
=> Log entry : 
	Warning. Pattern match "111" at REQUEST_URI [id "1"]
	Warning. Pattern match "111" at REQUEST_URI [id "2"]

GET /333.html HTTP/1.1
=> Log entry : 
	nothing

GET /111/333.html HTTP/1.1
=> Log entry : 
	Warning. Pattern match "111" at REQUEST_URI [id "1"]
	Warning. Pattern match "111" at REQUEST_URI [id "2"]

This is resulting in *many* false positive warnings in the log...

Can you solve this issue please, or tell me what's wrong in my config
file ?

Thank you very much for your help !

Regards,

Thomas Castelle

Re: [mod-security-users] Webdav won't work with SecFilter

[Ivan R. <iv...@we...>]

li...@32... wrote:
> Hello,
> 
> I am running Mac OS X Tiger. When I attempt to connect to my webdav folder I
> cannot. The 2 secfilters blocking me are as follows...
> 
> #XSS Attacks
> SecFilter "<(.|\n)+>"
> 
> # Only accept request encodings we know how to handle
> # we exclude GET requests from this because some (automated)
> # clients supply "text/html" as Content-Type
> SecFilterSelective HTTP_Content-Type
> "!(^$|^application/x-www-form-urlencoded$|^multipart/form-data)"
> 
> 
> Is there any changes I can make to the secfilter syntax so webdav will work,
> BUT not opening up possible exploit paths?

  The only thing you can do is disable those two rules selectively,
  for the WebDAV areas. The attacks they are guarding against are
  not effective for WebDAV anyway.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Problem with Apache installation

[Ivan R. <iv...@we...>]

Ramesh wrote:
> hello,
> 
> I had installed postgres successfully in my linux box and able to work with it 
> creating databases tables etc ....
> 
> Butwhen i restarted Apache iam getting an error like
> 
> httpd failed. The error was: Starting httpd: Syntax error on line 6 
> of /etc/httpd/conf.d/auth_pgsql.conf:
> Cannot load /etc/httpd/modules/mod_auth_pgsql.so into server: libpq.so.3: 
> cannot open shared object file: No such file or directory
> [FAILED] 

  Hi Ramesh,

  This list is for discussions related to mod_security. We are unlikely to
  be able to help you with other problems, even if they are related to Apache.


> The path of .so file is right unable to catch the error .....
> 
> Iam using apache  2.0.52
> 
> postgresql is 8.0.1 
> 
> 
> server: libpq.so.3: i have libpq.so.4 in my lib directory
> 
> This could make any difference ?

  I think so. I think you have a problem with mod_auth_pgsql.so compiled
  for one version of Postgres, but you have another version installed. Try
  recompiling mod_auth_pgsql.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Problem with Apache installation

[Ramesh <ram...@gm...>]

hello,

I had installed postgres successfully in my linux box and able to work with it 
creating databases tables etc ....

Butwhen i restarted Apache iam getting an error like

httpd failed. The error was: Starting httpd: Syntax error on line 6 
of /etc/httpd/conf.d/auth_pgsql.conf:
Cannot load /etc/httpd/modules/mod_auth_pgsql.so into server: libpq.so.3: 
cannot open shared object file: No such file or directory
[FAILED] 

The path of .so file is right unable to catch the error .....

Iam using apache  2.0.52

postgresql is 8.0.1 


server: libpq.so.3: i have libpq.so.4 in my lib directory

This could make any difference ?


How to rectify this error please give me any suggestion or help it will be very 
handy for me....

Regards
Ramesh

[Fwd: Re: [mod-security-users] more on clamAV and mod_security]

[Ivan R. <iv...@we...>]

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Webdav won't work with SecFilter

[<li...@32...>]

Hello,

I am running Mac OS X Tiger. When I attempt to connect to my webdav folder I
cannot. The 2 secfilters blocking me are as follows...

#XSS Attacks
SecFilter "<(.|\n)+>"

# Only accept request encodings we know how to handle
# we exclude GET requests from this because some (automated)
# clients supply "text/html" as Content-Type
SecFilterSelective HTTP_Content-Type
"!(^$|^application/x-www-form-urlencoded$|^multipart/form-data)"


Is there any changes I can make to the secfilter syntax so webdav will work,
BUT not opening up possible exploit paths?

Thanks 

-Mike

Re: [mod-security-users] more on clamAV and mod_security

[Ivan R. <iv...@we...>]

Justin Grindea wrote:
> hi,
> 
> [23/Nov/2005:19:46:47 +0200]
> [XXX/sid#810a3c8][rid#8248ee0][/src/compose.php][2] Approver script
> said: 0 Unable to parse clamscan output
> [/tmp/webfiles/20051123-194646-xxx.xxx.xxx.xxx-: Empty file]
>
> ...
>
> maybe empty files can be ignored and modsec can check if return is 1 or
> anything else?

  It's supposed to work that way. They appear to have changed the
  format of the error message.

  Try chaning this line (in modsec-clamav.pl):

  if ($error_message =~ m/: Empty file\.$/) {

  to

  if ($error_message =~ m/: Empty file$/) {

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] clamav perl scrip and su_exec

[Ivan R. <iv...@we...>]

Justin Grindea wrote:
> hi,
> 
> I'm running into problems implementing the clamav/perl script to scan
> uploaded files.
> This is an apache1 + su_exec setup for shared hosting.
>
> ...
>
> Any ideas other than this to solve this issue?

  No, you can either work to satisfy suexec or re-write the
  script in PHP.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] more on clamAV and mod_security

[Ivan R. <iv...@we...>]

Justin Grindea wrote:
> hi,
> 
> I gave another shot to this setup, on a different server using apache2,
> modsec 1.9 (stable) and PHP.
> This server only serves a webmail system - SquirrelMail.
> 
> The script works OK here, no su_exec or permissions problems.
> If I upload an attachment to the message in SM, it gets scanned OK.
> When I hit the "Send" button to actually have the message sent, I get
> 500 error.
> Look like modsec thinks I'm uploading a file again and looks for an
> uploaded file again.
> 
> This is the error from audit_log:
> 
> mod_security-message: Access denied with code 500. Error verifying
> files: File "/tmp/webfiles/20051123-025721-XXX.XXX.XXX.XXX-" rejected by
> the approver script "/var/www/cgi-bin//modsec-clamscan.pl"
> 
> (no file name is after the dash)

  That looks like the script is rejecting an empty file (which
  it should not do). Can you increase the debug log level to at
  least 2, try that again, and then look in the debug log for
  a line that begins with "Approver script said:"?

  What did the approver script say?

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] error_code

[Ivan R. <iv...@we...>]

Andras Got wrote:
> Hi,
> 
> I get the following log entries:
> 
> [Tue Nov 22 15:15:04 2005] [error] [client xxxx] mod_security:
> Access denied with code 404. Error reading POST data, error_code=54
> [hostname "hostname"] [uri "/torzs/kepek/copy.php?fo=1"]
> [unique_id B2qD6D5wwkYAABE6BKYAAAAY]
> 
> [Thu Nov 17 18:04:13 2005] [error] [client xxxx] mod_security:
> Access denied with code 404. Error reading POST data, error_code=70007
> 
> I searched the mod_security page, for error it's error codes (54 and
> 70007) but could't find anything about them. Our client would like to
> know what they mean (I'm also interested. :) ).

  1.9 will actually print a message instead of just the number.

  The lower number (54) is a errno value. It differs from a
  system to system, but I think it means that the connection
  was reset. 70007 is an APR error code and I believe it means
  connection timed out.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Problem with Regex and SecFilterSelective

[Ivan R. <iv...@we...>]

Bianca Brick wrote:
> Hi folks,
> 
> i protect a webapplication with the latest 1.8 version of mod_security
> (exact version info is currently not at hand). Running on an Apache2.
> Upgrating to 1.9 is currently not possible.
> 
> The following rule:
> 
>          SecFilterSelective ARG_text !(.{0,250}$) 
> 
> should match, if someone enters a text longer 250 characters. I want no
> limitation of the character set, because it is a free text field.
> 
> However, if "&text" contains a %0D%0A, the signature matches, even if the
> content is smaller 250 chars.
> 
> The logmessage is:
> "mod_security-message: Access denied with code 200. Pattern match
> "!(^.{0,250}$)" at CUSTOM"
> 
> The request is a "POST" request. "SecFilterForceByteRange 1 255" is set.
> 
> Is this a known bug, or result to a bad configuration?
> Is someone able to reproduce this?

  I seem to remember trying to write a rule that uses {n,m} last
  week and it didn't work as it was supposed to. So it may very
  well be a bug of some kind. However, it is not likely to be a
  bug in ModSecurity. ModSecurity uses the underlying regex library
  that comes with Apache.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] more on clamAV and mod_security

[Justin G. <web...@sw...>]

hi,

I gave another shot to this setup, on a different server using apache2, modsec 1.9 (stable) and PHP.
This server only serves a webmail system - SquirrelMail.

The script works OK here, no su_exec or permissions problems.
If I upload an attachment to the message in SM, it gets scanned OK.
When I hit the "Send" button to actually have the message sent, I get 500 error.
Look like modsec thinks I'm uploading a file again and looks for an uploaded file again.

This is the error from audit_log:

mod_security-message: Access denied with code 500. Error verifying files: File 
"/tmp/webfiles/20051123-025721-XXX.XXX.XXX.XXX-" rejected by the approver script "/var/www/cgi-bin//modsec-clamscan.pl"

(no file name is after the dash)

please advise if this can be sorted out.

After all, what application needs this feature more than a Webmail system? :)

thanks,
	Justin

[mod-security-users] clamav perl scrip and su_exec

[Justin G. <web...@sw...>]

hi,

I'm running into problems implementing the clamav/perl script to scan uploaded files.
This is an apache1 + su_exec setup for shared hosting.

I see in su_exec.log that the user accessing the perl script is the one that the website
runs under (each site has a user for FTP, cgi, etc.).
It always fails because uid/gid of script and uid/gid of the user that runs it doesn't match.

The script looks simple and might be ported to PHP, which is not under su_exec and can fire
up clamdscan using exec() command.

Any ideas other than this to solve this issue?

thanks,
	Justin

[mod-security-users] error_code

[Andras G. <an...@an...>]

Hi,

I get the following log entries:

[Tue Nov 22 15:15:04 2005] [error] [client xxxx] mod_security:
Access denied with code 404. Error reading POST data, error_code=54
[hostname "hostname"] [uri "/torzs/kepek/copy.php?fo=1"]
[unique_id B2qD6D5wwkYAABE6BKYAAAAY]

[Mon Nov 21 16:36:02 2005] [error] [client xxxx] mod_security:
Access denied with code 404. Error reading POST data, error_code=54
[hostname "hostname"] [uri "/torzs/kepek/copy.php?fo=1"]
[unique_id Ah9ctz5wwkYAAYX4izQAAAAX]

[Mon Nov 21 13:46:29 2005] [error] [client xxxx] mod_security:
Access denied with code 404. Error reading POST data, error_code=54
[hostname "hostname"] [uri "/torzs/kepek/copy.php?fo=1"]
[unique_id rHk-vD5wwkYAAUqSAdgAAAAb]

[Thu Nov 17 18:04:13 2005] [error] [client xxxx] mod_security:
Access denied with code 404. Error reading POST data, error_code=70007

I searched the mod_security page, for error it's error codes (54 and 70007) but could't find 
anything about them. Our client would like to know what they mean (I'm also interested. :) ).

Thx,
Andrej

[mod-security-users] problem with clamav integration

[Justin G. <web...@sw...>]

hi,

I've installed clamav and the perl script, set permissions to /tmp/webfiles as mentioned in the docs
but I get 500 error for any file I upload...

here is the output from the debug_log:

[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][2] Detection phase starting 
(request 97e8228): "POST /myscript/actions.php?m=put&up=1 HTTP/1.1"
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][4] sec_auditlog_init: Starting
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][4] Normalised REQUEST_URI: 
"/myscript/actions.php?m=put&up=1"
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][2] Parsing arguments...
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][4] Adding parameter "m"="put"
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][4] Adding parameter "up"="1"
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][4] Adding cookie 
"EZKLMN"="eF4rLy8vLU4tsipOsTAvKy0vLAYAP10G6w=="
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][3] Content-Type is 
"multipart/form-data; boundary=---------------------------14369700884912692551997532295"
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][2] read_post_payload: Created 
file to store request body: /tmp/webfiles/20051122-055521-192.168.1.55-request_body-hk5q0J
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][5] read_post_payload: read 
270 bytes
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][5] read_post_payload: read 
2141 bytes
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][5] read_post_payload: read 
986 bytes
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][5] read_post_payload: read 
590 bytes
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][4] verify_uploaded_file: 
executing "/usr/bin/modsec-clamscan.pl" to verify "/tmp/webfiles/20051122-055521-192.168.1.55-cart.jpg"
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][1] Access denied with code 
500. Error verifying files: Received no output from the approver script (execution failed?) "/usr/bin/modsec-clamscan.pl"
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][4] Logging phase starting
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][4] sec_guardian_logger: Starting
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][2] sec_audit_logger_serial: 
Starting
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][4] Multipart: deleting 
temporary file (part) "/tmp/webfiles/20051122-055521-192.168.1.55-"
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][4] Multipart: Deleted empty 
file (part) "/tmp/webfiles/20051122-055521-192.168.1.55-"
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][4] Multipart: deleting 
temporary file (part) "/tmp/webfiles/20051122-055521-192.168.1.55-"
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][1] Multipart: Failed to 
delete empty file (part) "/tmp/webfiles/20051122-055521-192.168.1.55-" because 2(No such file or directory)
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][4] Multipart: deleting 
temporary file (part) "/tmp/webfiles/20051122-055521-192.168.1.55-"
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][1] Multipart: Failed to 
delete empty file (part) "/tmp/webfiles/20051122-055521-192.168.1.55-" because 2(No such file or directory)
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][4] Multipart: deleting 
temporary file (part) "/tmp/webfiles/20051122-055521-192.168.1.55-"
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][1] Multipart: Failed to 
delete empty file (part) "/tmp/webfiles/20051122-055521-192.168.1.55-" because 2(No such file or directory)
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][4] Multipart: deleting 
temporary file (part) "/tmp/webfiles/20051122-055521-192.168.1.55-"
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][1] Multipart: Failed to 
delete empty file (part) "/tmp/webfiles/20051122-055521-192.168.1.55-" because 2(No such file or directory)
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][4] Multipart: deleting 
temporary file (part) "/tmp/webfiles/20051122-055521-192.168.1.55-"
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][1] Multipart: Failed to 
delete empty file (part) "/tmp/webfiles/20051122-055521-192.168.1.55-" because 2(No such file or directory)
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][4] Multipart: deleting 
temporary file (part) "/tmp/webfiles/20051122-055521-192.168.1.55-"
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][1] Multipart: Failed to 
delete empty file (part) "/tmp/webfiles/20051122-055521-192.168.1.55-" because 2(No such file or directory)
[22/Nov/2005:05:55:21 +0200] [XXX.XXX.COM/sid#9af17e0][rid#97e8228][/myscript/actions.php][2] request_body_file_cleanup: 
Deleted file "/tmp/webfiles/20051122-055521-192.168.1.55-request_body-hk5q0J"


What am I doing wrong?

thanks,
	Justin

[mod-security-users] Problem with Regex and SecFilterSelective

[Bianca B. <don...@gm...>]

Hi folks,

i protect a webapplication with the latest 1.8 version of mod_security
(exact version info is currently not at hand). Running on an Apache2.
Upgrating to 1.9 is currently not possible.

The following rule:

         SecFilterSelective ARG_text !(.{0,250}$) 

should match, if someone enters a text longer 250 characters. I want no
limitation of the character set, because it is a free text field.

However, if "&text" contains a %0D%0A, the signature matches, even if the
content is smaller 250 chars.

The logmessage is:
"mod_security-message: Access denied with code 200. Pattern match
"!(^.{0,250}$)" at CUSTOM"

The request is a "POST" request. "SecFilterForceByteRange 1 255" is set.

Is this a known bug, or result to a bad configuration?
Is someone able to reproduce this?

Any help is appreciated!

Thanx in advance,

Bianca



-- 
Lust, ein paar Euro nebenbei zu verdienen? Ohne Kosten, ohne Risiko!
Satte Provisionen für GMX Partner: http://www.gmx.net/de/go/partner

Re: [mod-security-users] Need some help with mod security and PostNuke .761

[Ivan R. <iv...@we...>]

Christopher Patricca wrote:
> Ivan,
> 
> Thanks for the tips. Do you have any starting points on how I can be more
> specific with my filters? I've been reading through various HOWTOs &
> articles on mod_security but don't fully grasp it quite yet. If I can get
> one or more examples on the direction I should head (or a really good
> article I should look at) I would appreciate it.

  If you are looking for something to provide automatic protection
  - that's very difficult. If you want to have a set of rules to
  only report anomalies then I can send you my generic (soon-to-be-
  public) rules for you to play with.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] ModSecurity Standard rule set

[Ivan R. <iv...@we...>]

For some time now I have wanted to start distributing ModSecurity
together with a set of "standard" rules. I think it is only possible
to have such a set for detect-only mode. Otherwise there would
simply be too many false positives. I also do not expect these
rules to be effective as a protection/detection for content
management systems, but standard business-like application should
be fine.

Anyway, I have a set of candidate rules but I'd like them to be
tested more before they are "unleashed" to the public. If you are
running a complex web application and you are willing to help
please send me an email to my private email address.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] need help fighting spam from PHP scripts

[Justin G. <web...@sw...>]

hi,

I'm trying to see how mod_security can help me prevent POST to vulnerable scripts
I host on several servers. I've been hit 3 times in the last couple of days by a spammer
who found 3 different scripts, on 3 different servers and used them to send spam to AOL.

I'm trying to put some logic together and see how mod_security can help.
I believe a POST with a @ in it, and without referer is a start, but as we know referer
can be faked. It can be a start though, anyone can make such a rule?

Also, any ideas on this matter are welcome.

thanks,
	Justin

RE: [mod-security-users] Need some help with mod security and PostNuke .761

[Christopher P. <chr...@ve...>]

Ivan,

Thanks for the tips. Do you have any starting points on how I can be more
specific with my filters? I've been reading through various HOWTOs &
articles on mod_security but don't fully grasp it quite yet. If I can get
one or more examples on the direction I should head (or a really good
article I should look at) I would appreciate it.

Thanks,



Christopher Patricca
Server Administrator

-----Original Message-----
From: mod...@li...
[mailto:mod...@li...] On Behalf Of Ivan
Ristic
Sent: Friday, November 18, 2005 3:00 AM
To: Christopher Patricca
Cc: mod...@li...
Subject: Re: [mod-security-users] Need some help with mod security and
PostNuke .761

Christopher Patricca wrote:
> Hello folks,
> 
> Well I've been doing some tightening of security on my webserver but it
> seems that I've made things too tight. The problem is that I can't
> figure out how to best let PostNuke do what it needs to do. Right now
> several of my filters stop the execution of a large number of commands
> that I need to have available in postnuke. I'll start off by posting my
> current modsecurity.conf file:

  It's generally difficult to protect content management systems
  using generic negative signatures only.


> SecAuditEngine On

  You do know this logs every request? Just checking :)


> SecFilterCheckUnicodeEncoding On

  This should be enabled only if UTF-8 is used in the web site.


> SecFilter /bin/sh
> SecFilter hidden
> SecFilter "\.\./"
> SecFilterSelective ARGS "bin/"

  These are just too broad. It's what's causing your problems.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org


-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc.  Get Certified Today
Register for a JBoss Training Course.  Free Certification Exam
for All Training Attendees Through End of 2005. For more info visit:
http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click
_______________________________________________
mod-security-users mailing list
mod...@li...
https://lists.sourceforge.net/lists/listinfo/mod-security-users


-- 
No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.1.362 / Virus Database: 267.13.4/175 - Release Date: 11/18/2005

Re: [mod-security-users] HTTP_REFERER

[Ivan R. <iv...@we...>]

Achim Hoffmann wrote:
> On Fri, 18 Nov 2005, Ivan Ristic wrote:
> 
> !! > And now HTTP_HTTP_REFERER.
> !!
> !!   Won't do anything.
> !!
> !!
> !! > I followed this: HTTP_header � search request
> !! > header "header".
> !!
> !!   Right, but the header name is "Referer". Henece HTTP_Referer.
> 
> dooh, this brings up following question:
>  what if the HTTP header is really named   REFERER: blabla
> 
> Does this mean that mod_security only accepts the "recommended" upper-,
> lower-case spelling according RFC?
> (I mean matching the header, not mod_security's HTTP_<header> keywords)

  ModSecurity ignores case so you are fine either way. (This will be
  configurable in the future.)

  I just like to write the header names/variable names/cookie names
  in lowercase to lessen the chance of confusion.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] HTTP_REFERER

[Achim H. <ki...@se...>]

On Fri, 18 Nov 2005, Ivan Ristic wrote:

!! > And now HTTP_HTTP_REFERER.
!!
!!   Won't do anything.
!!
!!
!! > I followed this: HTTP_header =E2=80=93 search request
!! > header "header".
!!
!!   Right, but the header name is "Referer". Henece HTTP_Referer.


dooh, this brings up following question:
 what if the HTTP header is really named   REFERER: blabla

Does this mean that mod_security only accepts the "recommended" upper-,
lower-case spelling according RFC?
(I mean matching the header, not mod_security's HTTP_<header> keywords)

Achim

Re: [mod-security-users] HTTP_REFERER

[Ivan R. <iv...@we...>]

Andras Got wrote:
> 
> SecFilterSelective "HTTP_REFERER"
> "(dakolbass|techmusic|fairlight|warez|forum|sg\.hu)"

  This will inspect the Referer header looking for those keywords.


> And now HTTP_HTTP_REFERER.

  Won't do anything.


> I followed this: HTTP_header – search request
> header "header".

  Right, but the header name is "Referer". Henece HTTP_Referer.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Need some help with mod security and PostNuke .761

[Ivan R. <iv...@we...>]

Christopher Patricca wrote:
> Hello folks,
> 
> Well I’ve been doing some tightening of security on my webserver but it
> seems that I’ve made things too tight. The problem is that I can’t
> figure out how to best let PostNuke do what it needs to do. Right now
> several of my filters stop the execution of a large number of commands
> that I need to have available in postnuke. I’ll start off by posting my
> current modsecurity.conf file:

  It's generally difficult to protect content management systems
  using generic negative signatures only.


> SecAuditEngine On

  You do know this logs every request? Just checking :)


> SecFilterCheckUnicodeEncoding On

  This should be enabled only if UTF-8 is used in the web site.


> SecFilter /bin/sh
> SecFilter hidden
> SecFilter "\.\./"
> SecFilterSelective ARGS "bin/"

  These are just too broad. It's what's causing your problems.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] include snort rules

[<xx...@im...>]

Good idea - I'll make it more generic, and add some error handling; and 
I'll send it to Ivan

P




Javier Fernandez-Sanguino <jfe...@ge...> 
17/11/2005 10:20

To
Peter VE <xx...@im...>
cc
mod_security mailinglist <mod...@li...>
Subject
Re: [mod-security-users] include snort rules






Peter VE wrote:
> 
>>
>>
>>Peter VE wrote:
>>
>>>Hi,
>>>
>>>I wrote a script that pulls down multiple sets of snort rules, and
>>>converts specific rulefiles to SecFilters.
>>
>> You shouldn't have, there's a script included with ModSecurity
>> that does just that :)
> 
> 
> I'm using the ModSecurity script to convert, but it is launched from
> within my own script, which

BTW, are you open to sharing that script so that Ivan can add it to 
the util/ directory? I provided a nessus2modsec script a while back 
[1] which is now available there [2] and I would encourage others to 
do the same. These scripts are valid tools and helps other get up to 
speed when using mod-security. Contributing them back also makes it 
possible for the community to maintain them.

> - downloads various sets of rules (snort, bleeding, community)
> - extracts the rules
> - only converts the rules that I need
> - rips out some rules that I don't want/need
> (after converting snort rules, I noticed that the converted file
> contains a couple of  SecFilter ""   and SecFilter "="  entries,
> which kinda break basic functionality... )

This last comment (the SecFilter "" issue) looks to me like it is 
because you are using an older version of the script that does not 
skip Snort rules that do not apply to HTTP. I provided a patch [3]
to snor2modsec that fixed that.

Ivan applied that patch [4] (minus the documentation I added, but that 
is also available in the 'snortmodsec-rules.txt' file already).

If you are not willing to share the code, ut would be nice if you 
could tell us:

- which rules you don't think apply, and should not be converted
- what rules that do apply get converted to problematic SecFilters

Regards

Javier

[1] 
http://sourceforge.net/mailarchive/forum.php?thread_id=5857485&forum_id=33492

[2] 
http://cvs.sourceforge.net/viewcvs.py/mod-security/mod_security/util/nessus2modsec.pl?rev=1.1&view=markup

[3] 
http://sourceforge.net/mailarchive/forum.php?thread_id=5857484&forum_id=33492

[4]
http://cvs.sourceforge.net/viewcvs.py/mod-security/mod_security/util/snort2modsec.pl?r1=1.1&r2=1.2

> 
>>
>>>When I update the files with newer files, will mod_security
>>>automatically use the newer file ? Or does Apache need a restart ?
>>
>> You need to restart Apache.
>>
> 
> Will Apache start when one of the mod_security SecFilters is wrong ?
> After all, this is an automated process - there is a chance that
> something is wrong with the original snort rules, or with converting
> those rules into filters...
> 
>>>If it automatically uses the newer file, what happens at the very
>>
>>time
>>
>>>the file gets overwritten?
>>
>> Nothing. When Apache is started rules are read in memory. What
>> you do with the file afterwards is not important.
>>
> 
> Thanks !
> 
> 
>>-- 
>>Ivan Ristic
>>Apache Security (O'Reilly) - http://www.apachesecurity.net
>>Open source web application firewall - http://www.modsecurity.org
>>
>>
>>-------------------------------------------------------
>>This SF.Net email is sponsored by the JBoss Inc.  Get Certified Today
>>Register for a JBoss Training Course.  Free Certification Exam
>>for All Training Attendees Through End of 2005. For more info visit:
>>http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click
>>_______________________________________________
>>mod-security-users mailing list
>>mod...@li...
>>https://lists.sourceforge.net/lists/listinfo/mod-security-users
>>
>>
> 
> 
> 
> 
> -------------------------------------------------------
> This SF.Net email is sponsored by the JBoss Inc.  Get Certified Today
> Register for a JBoss Training Course.  Free Certification Exam
> for All Training Attendees Through End of 2005. For more info visit:
> http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>