mod-security-users — General discussion about mod_security

[mod-security-users] Filtering 404's and 500's

[Philippe B. <pbo...@ci...>]

Hi,

On a reverse proxy, I'm trying to filter HTTP 404 and HTTP 500 errors.

I'm using the following rule :
SecFilterSelective OUTPUT "HTTP\/(0\.9|1\.0|1\.1) 404 Not Found"
and the 500 one is similar.

I've tried a few other ones, but this one looks fine to me.

It doesn't work, why ?
Could it be that the headers are not part of "OUTPUT" ?


Sincerely,

Philippe Bourcier

Re: [mod-security-users] Add SCRIPT_NAME to known CGI variables?

[Ivan R. <iv...@we...>]

Eli wrote:
> I was looking for a CGI variable which contained only the path of the script
> called in the URI, minus the DOCUMENT_ROOT.  Apparently both
> REQUEST_FILENAME and SCRIPT_FILENAME are the full script path on the server,
> and the only CGI variable I can find that would be those, minus the
> DOCUMENT_ROOT, is SCRIPT_NAME, but it isn't accepted (1.9RC1 being used).
> 
> Is there any reason this CGI variable is not allowed in mod_security?

  There is no particular reason for that - I simply missed the variable. I'll
  add it to the TODO list for the next release.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Supressing Warning (chained rule)" in the log ?

[Ivan R. <iv...@we...>]

Ivan Ristic wrote:
> Steffen wrote:
> 
>> Searched in the docu, but could not find an answer.
>>
>> It it possible not to log in the Apache error.log the "Warning
>> (chained rule)" entries?
>>
>> eg.:
>>
>> [Thu Oct 20 10:09:16 2005] [error] [client 63.196.49.252]
>> mod_security: Warning (chained rule). Pattern match "!^(GET|HEAD)$" at
>> REQUEST_METHOD [hostname "www.apachelounge.com"] [uri "/mail/web.cgi"]
> 
>  You should be able to add "nolog" to the rule to supress it.

   But this approach has some unexpected side-effects. If a rule
   after the one with "nolog" triggers the request will not be
   recorded in the audit log. Although further attempts can be
   made (with "auditlog") to restore this functionality, I have
   decided to simply move the above warning to level 3 (from
   level 1). This works as of 1.9RC4.

   I don't expect any more RC releases so maybe you should not
   upgrade to 1.9RC4. 1.9 stable will be released over the weekend.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Add SCRIPT_NAME to known CGI variables?

[Eli <eli...@ex...>]

I was looking for a CGI variable which contained only the path of the script
called in the URI, minus the DOCUMENT_ROOT.  Apparently both
REQUEST_FILENAME and SCRIPT_FILENAME are the full script path on the server,
and the only CGI variable I can find that would be those, minus the
DOCUMENT_ROOT, is SCRIPT_NAME, but it isn't accepted (1.9RC1 being used).

Is there any reason this CGI variable is not allowed in mod_security?  If so
what is it?  If not, would a patch submitted adding it be accepted (pending
proper coding techniques and testing obviously)?

Eli.

[mod-security-users] Directive SecUploadApproveScript

[Tomas H. S. <thi...@te...>]

Hello,

=20

Environment:  RH ES 3.0 Upgrade 5 + apache 2.0.54 + mod_security 1.8.7 + =
webmail=20

=20

This work fine:

=20

SecUploadApproveScript /usr/local/apache2/bin/verify_upload_webmail.pl

=20

But, this not work fine:

=20

SecUploadApproveScript =
/usr/local/apache2/bin/verificar_upload_webmail.pl  "log,pass"

=20

The error:

=20

root@myserver:/usr/local/apache2/conf> /etc/init.d/httpd stop

stopping Apache-2 ...

Syntax error on line 32 of /usr/local/apache2/conf/mod-security.conf:

SecUploadApproveScript takes one argument, The path to the script that =
will be called to approve every uploaded file

=20

How I can control the default action with SecUploadApproveScript?

I would like to warn the user that its file is infected by virus.

=20

Many thanks for you help

=20

=20

Tom=E1s Hidalgo Salvador

thi...@te...

Dpto. Sistemas Unix

Tlf.: 2333

DSF Almariya

=20

RE: [mod-security-users] mod_security + webmail + body message

[Tomas H. S. <thi...@te...>]

Thanks to both!!

I am going to continue making tests with your indications.

According to the table 12-1 of the book of Ivan, I believe that =
THE_REQUEST=3DREQUEST_METOD + REQUEST_URI + REQUEST_PROTOCOL.=20

As he would be formulates it for POST_PAYLOAD?
As it is the result of POST_PAYLOAD - THE_REQUEST?

:-( Some reference to know more on headers HTTP?=20

Many thanks for you help.


Tom=E1s Hidalgo Salvador
thi...@te...
Dpto. Sistemas Unix
Tlf.: 2333
DSF Almariya

-----Mensaje original-----
De: Ivan Ristic [mailto:iv...@we...]=20
Enviado el: s=E1bado, 29 de octubre de 2005 21:09
Para: Ryan Barnett
CC: Tomas Hidalgo Salvador; mod...@li...
Asunto: Re: [mod-security-users] mod_security + webmail + body message

Ryan Barnett wrote:
> Tomas - Welcome to my world :)  I have been using Apache/Mod_Security =
as
> a reverse proxy for Microsoft's Outlook Web Access and have run this
> same issue.  We you are dealing with webmail apps, it gets infinitely
> more difficult to fine tune your filters.  This is due in most part =
from
> the concept of mixing HTTP and SMTP.  We just have no way to forecast
> "expcected behavior" for what people will write in the body of their
> emails.
> =20
> With that being said, you can try some of the following -
> =20
> 1) Turn off PostPayload scanning.
> This would certainly stop these errors, but then you would also not be
> monitoring a key area where attackers target.
> =20
> 2) Use SecFilterSelective instead of SecFilter
> SecFilter is too broad.  SecFilterSelective will allow you to focus =
your
> search to specific request locations.  The best locations to look for
> attacks (exluding the post payload) are THE_REQUEST, QUERY_STRING or
> choose some specific headers such as COOKIE_VAULES.  So, an updated
> filter would look like this -
> =20
> SecFilterSelective "THE_REQUEST|COOKIE_VALUES" "/bin/chmod"

  Just a small correction: here you really want to use COOKIES_VALUES,
  because COOKIE_VALUES would only look in a cookie named "values".
  COOKIES_VALUES (with an "S") examines all cookies present in a
  request.

--=20
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] mod_security + webmail + body message

[Ivan R. <iv...@we...>]

Ryan Barnett wrote:
> Tomas - Welcome to my world :)  I have been using Apache/Mod_Security as
> a reverse proxy for Microsoft's Outlook Web Access and have run this
> same issue.  We you are dealing with webmail apps, it gets infinitely
> more difficult to fine tune your filters.  This is due in most part from
> the concept of mixing HTTP and SMTP.  We just have no way to forecast
> "expcected behavior" for what people will write in the body of their
> emails.
>  
> With that being said, you can try some of the following -
>  
> 1) Turn off PostPayload scanning.
> This would certainly stop these errors, but then you would also not be
> monitoring a key area where attackers target.
>  
> 2) Use SecFilterSelective instead of SecFilter
> SecFilter is too broad.  SecFilterSelective will allow you to focus your
> search to specific request locations.  The best locations to look for
> attacks (exluding the post payload) are THE_REQUEST, QUERY_STRING or
> choose some specific headers such as COOKIE_VAULES.  So, an updated
> filter would look like this -
>  
> SecFilterSelective "THE_REQUEST|COOKIE_VALUES" "/bin/chmod"

  Just a small correction: here you really want to use COOKIES_VALUES,
  because COOKIE_VALUES would only look in a cookie named "values".
  COOKIES_VALUES (with an "S") examines all cookies present in a
  request.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] mod_security + webmail + body message

[Ryan B. <rcb...@gm...>]

VG9tYXMgLSBXZWxjb21lIHRvIG15IHdvcmxkIDopIEkgaGF2ZSBiZWVuIHVzaW5nIEFwYWNoZS9N
b2RfU2VjdXJpdHkgYXMgYQpyZXZlcnNlIHByb3h5IGZvciBNaWNyb3NvZnQncyBPdXRsb29rIFdl
YiBBY2Nlc3MgYW5kIGhhdmUgcnVuIHRoaXMgc2FtZQppc3N1ZS4gV2UgeW91IGFyZSBkZWFsaW5n
IHdpdGggd2VibWFpbCBhcHBzLCBpdCBnZXRzIGluZmluaXRlbHkgbW9yZQpkaWZmaWN1bHQgdG8g
ZmluZSB0dW5lIHlvdXIgZmlsdGVycy4gVGhpcyBpcyBkdWUgaW4gbW9zdCBwYXJ0IGZyb20gdGhl
CmNvbmNlcHQgb2YgbWl4aW5nIEhUVFAgYW5kIFNNVFAuIFdlIGp1c3QgaGF2ZSBubyB3YXkgdG8g
Zm9yZWNhc3QgImV4cGNlY3RlZApiZWhhdmlvciIgZm9yIHdoYXQgcGVvcGxlIHdpbGwgd3JpdGUg
aW4gdGhlIGJvZHkgb2YgdGhlaXIgZW1haWxzLgogV2l0aCB0aGF0IGJlaW5nIHNhaWQsIHlvdSBj
YW4gdHJ5IHNvbWUgb2YgdGhlIGZvbGxvd2luZyAtCiAxKSBUdXJuIG9mZiBQb3N0UGF5bG9hZCBz
Y2FubmluZy4KVGhpcyB3b3VsZCBjZXJ0YWlubHkgc3RvcCB0aGVzZSBlcnJvcnMsIGJ1dCB0aGVu
IHlvdSB3b3VsZCBhbHNvIG5vdCBiZQptb25pdG9yaW5nIGEga2V5IGFyZWEgd2hlcmUgYXR0YWNr
ZXJzIHRhcmdldC4KIDIpIFVzZSBTZWNGaWx0ZXJTZWxlY3RpdmUgaW5zdGVhZCBvZiBTZWNGaWx0
ZXIKU2VjRmlsdGVyIGlzIHRvbyBicm9hZC4gU2VjRmlsdGVyU2VsZWN0aXZlIHdpbGwgYWxsb3cg
eW91IHRvIGZvY3VzIHlvdXIKc2VhcmNoIHRvIHNwZWNpZmljIHJlcXVlc3QgbG9jYXRpb25zLiBU
aGUgYmVzdCBsb2NhdGlvbnMgdG8gbG9vayBmb3IgYXR0YWNrcwooZXhsdWRpbmcgdGhlIHBvc3Qg
cGF5bG9hZCkgYXJlIFRIRV9SRVFVRVNULCBRVUVSWV9TVFJJTkcgb3IgY2hvb3NlIHNvbWUKc3Bl
Y2lmaWMgaGVhZGVycyBzdWNoIGFzIENPT0tJRV9WQVVMRVMuIFNvLCBhbiB1cGRhdGVkIGZpbHRl
ciB3b3VsZCBsb29rCmxpa2UgdGhpcyAtCiBTZWNGaWx0ZXJTZWxlY3RpdmUgIlRIRV9SRVFVRVNU
fENPT0tJRV9WQUxVRVMiICIvYmluL2NobW9kIgogSG9wZSB0aGlzIGhlbHBzLgogLS0KUnlhbiBD
LiBCYXJuZXR0CldlYiBBcHBsaWNhdGlvbiBTZWN1cml0eSBDb25zb3J0aXVtIChXQVNDKSBNZW1i
ZXIKQ0lTIEFwYWNoZSBCZW5jaG1hcmsgUHJvamVjdCBMZWFkClNBTlMgSW5zdHJ1Y3RvcjogU2Vj
dXJpbmcgQXBhY2hlCkdDSUEsIEdDRkEsIEdDSUgsIEdTTkEsIEdDVVgsIEdTRUMKQXV0aG9yOiBQ
cmV2ZW50aW5nIFdlYiBBdHRhY2tzIHdpdGggQXBhY2hlCgogT24gMTAvMjgvMDUsIFRvbWFzIEhp
ZGFsZ28gU2FsdmFkb3IgPHRoaWRhbGdvQHRlY25vbG9naWEuY2FqYW1hci5lcz4gd3JvdGU6Cj4K
PiAgSGksCj4KPiAgSSdhbSB0dW5uaW5nIG1vZF9zZWN1cml0eSAxLjguNyBpbiBSZWQgSGF0IDMu
MCBVcGdyYWRlIDUgKDIuNC4yMS0zMi5FTHNtcCkKPiArIGFwYWNoZSAyLjAuNTQgKyB3ZWJtYWls
ICh1ZWJpbWlhdSkKPgo+ICBGcm9tIG15IG93biB3ZWJtYWlsLCBpZiB3aGVuIHNlbmRpbmcgYSBt
ZXNzYWdlLCBpbiB0aGUgYm9keSB0aGUgbWVzc2FnZSwKPiBhcHBlYXJzIGEgY2hhaW4gaW50cm9k
dWNlZCBpbiB0aGUgZmlsZSBvZiBjb25maWd1cmF0aW9uLCB0aGUgbWVzc2FnZSBpcwo+IHJlamVj
dGVkLiBGb3IgZXhhbXBsZToKPgo+ICBJbiBmaWxlIG1vZF9zZWN1cml0eS5jb25mOgo+Cj4gIFNl
Y0ZpbHRlckRlZmF1bHRBY3Rpb24gImRlbnksbG9nLHN0YXR1czo0MDMiCj4KPiAuIC4gLiAuIC4K
Pgo+IC4gLiAuIC4gLgo+Cj4gU2VjZmlsdGVyIC9iaW4vY2htb2QKPgo+ICBJbiB0aGUgYm9keSBv
ZiBtYWlsIG1lc3NhZ2UKPgo+ICJ0aGlzIGlzIGEgZXhhbXBsZSBmb3IgdGhlIHN0cmluZyAvYmlu
L2NobW9kIgo+Cj4gIFRoaXMgZ2VuZXJhdGVzIGZvbGxvd2luZyBsb2cuCj4KPiAgPT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQo+Cj4gVU5JUVVFX0lEOiBqRm42TE1Db3la
Z0FBQmxDR0RvQUFBQXIKPgo+IFJlcXVlc3Q6IDE5Mi4xNjguMjA3LjEgPGh0dHA6Ly8xOTIuMTY4
LjIwNy4xLz4gLSAtIFsyOC9PY3QvMjAwNToxMDo0ODowNgo+ICswMjAwXSAiUE9TVCAvd2VibWFp
bC9uZXdtc2cucGhwIEhUVFAvMS4wIiA0MDMgMjIwCj4KPiBIYW5kbGVyOiBwaHAtc2NyaXB0Cj4K
PiAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCj4KPiBQT1NUIC93ZWJt
YWlsL25ld21zZy5waHAgSFRUUC8xLjAKPgo+IEFjY2VwdDogaW1hZ2UvZ2lmLCBpbWFnZS94LXhi
aXRtYXAsIGltYWdlL2pwZWcsIGltYWdlL3BqcGVnLAo+IGFwcGxpY2F0aW9uL3gtc2hvY2t3YXZl
LWZsYXNoLCBhcHBsaWNhdGlvbi92bmQubXMtZXhjZWwsCj4gYXBwbGljYXRpb24vdm5kLm1zLXBv
d2VycG9pbnQsIGFwcGxpY2F0aW9uL21zd29yZCwgKi8qCj4KPiBSZWZlcmVyOgo+IGh0dHBzOi8v
Y29ycmVvLnBydWViYXMuZXMvd2VibWFpbC9uZXdtc2cucGhwP3BhZz0xJmZvbGRlcj1pbmJveCZz
aWQ9ezQzNjFFMjI2MEVBNTAtNDM2MUUyMjYxMzg2Ri0xMTMwNDg4MzU4fSZ0aWQ9MCZsaWQ9MDxo
dHRwczovL2NvcnJlby5wcnVlYmFzLmVzL3dlYm1haWwvbmV3bXNnLnBocD9wYWc9MSZmb2xkZXI9
aW5ib3gmc2lkPSU3QjQzNjFFMjI2MEVBNTAtNDM2MUUyMjYxMzg2Ri0xMTMwNDg4MzU4JTdEJnRp
ZD0wJmxpZD0wPgo+Cj4gQWNjZXB0LUxhbmd1YWdlOiBlcwo+Cj4gQ29udGVudC1UeXBlOiBhcHBs
aWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQKPgo+IENvbm5lY3Rpb246IEtlZXAtQWxpdmUK
Pgo+IFVzZXItQWdlbnQ6IE1vemlsbGEvNC4wIChjb21wYXRpYmxlOyBNU0lFIDYuMDsgV2luZG93
cyBOVCA1LjE7IFNWMTsKPiBJbmZvUGF0aC4xKQo+Cj4gSG9zdDogY29ycmVvLmNhamFtYXIuZXMg
PGh0dHA6Ly9jb3JyZW8uY2FqYW1hci5lcy8+Cj4KPiBDb250ZW50LUxlbmd0aDogMzYzCj4KPiBD
YWNoZS1Db250cm9sOiBuby1jYWNoZQo+Cj4gQ29va2llOgo+IHs0MzYxRTIyNjBFQTUwLTQzNjFF
MjI2MTM4NkYtMTEzMDQ4ODM1OH09JTdCNDM2MUUyMjYwRUE1MC00MzYxRTIyNjEzODZGLTExMzA0
ODgzNTglN0QKPgo+IG1vZF9zZWN1cml0eS1tZXNzYWdlOiBBY2Nlc3MgZGVuaWVkIHdpdGggY29k
ZSA0MDMuIFBhdHRlcm4gbWF0Y2gKPiAiL2Jpbi9jaG1vZCIgYXQgUE9TVF9QQVlMT0FECj4KPiBt
b2Rfc2VjdXJpdHktYWN0aW9uOiA0MDMKPgo+ICAzNjMKPgo+Cj4gdGlwbz1zZW5kJmlzX2h0bWw9
dHJ1ZSZzaWQ9JTdCNDM2MUUyMjYwRUE1MC00MzYxRTIyNjEzODZGLTExMzA0ODgzNTglN0QmbGlk
PTAmdGlkPTAmZm9sZGVyPWluYm94JnNpZz1Ub21hcytIaWRhbGdvJTNDYnIrJTJGJTNFJTBEJTBB
JTI4YyUyOSsyMDA1JnRleHRtb2RlPSZ0bz0KPiB0aGlkYWxnb0B0ZWNub2xvZ2lhLmNhamFtYXIu
ZXMKPiAmY2M9JmJjYz0mc3ViamVjdD1wcnVlYmEzJmJvZHk9JTNDQlIlM0VlbitlbCtjdWVycG8r
ZGVsK21lbnNhamUrYXBhcmVjZStsYStwYWxhYnJhKyUyRmJpbiUyRmNobW9kJTNDQlIlM0UtLSUz
Q0JSJTNFVG9tYXMrSGlkYWxnbyUzQ0JSJTNFJTI4YyUyOSsyMDA1JTNDQlIlM0UlM0NCUiUzRSZw
cmlvcml0eT0zCj4KPiAgSFRUUC8xLjAgNDAzIEZvcmJpZGRlbgo+Cj4gQ29udGVudC1MZW5ndGg6
IDIyMAo+Cj4gQ29ubmVjdGlvbjogY2xvc2UKPgo+IENvbnRlbnQtVHlwZTogdGV4dC9odG1sOyBj
aGFyc2V0PWlzby04ODU5LTEKPgo+ICBRdWVzdGlvbnM6Cj4KPiAgMSkgaXQgaXMgcG9zc2libGUg
dG8gYXZvaWQgdGhhdCBtb2Rfc2VjdXJpdHkgZG9lcyBub3QgdmVyaWZ5IHRoZSBib2R5IG9mCj4g
dGhlIG1lc3NhZ2U/Cj4KPiAyKSBIZSBpcyBjb2hlcmVudCB0byB1c2UgbW9kX3NlY3VyaXR5IHdp
dGggYSB3ZWJtYWlsPyBJIGhhdmUgbm90IGZvdW5kIGFueQo+IHBvc2l0aXZlIG9yIG5lZ2F0aXZl
IHJlZmVyZW5jZQo+Cj4gIE1hbnkgdGhhbmtzIGZvciB5b3UgaGVscC4KPgo+ICAgIFRvbeFzIEhp
ZGFsZ28gU2FsdmFkb3IKPgo+IHRoaWRhbGdvQHRlY25vbG9naWEuY2FqYW1hci5lcwo+Cj4gRHB0
by4gU2lzdGVtYXMgVW5peAo+Cj4gRFNGIEFsbWFyaXlhCj4KPiBBbG1lcmlhIJYgQW5kYWx1Y2lh
IC0gU3BhaW4KPgo+Cg==

[mod-security-users] mod_security + webmail + body message

[Tomas H. S. <thi...@te...>]

Hi,

=20

I'am tunning mod_security 1.8.7 in Red Hat 3.0 Upgrade 5 =
(2.4.21-32.ELsmp) + apache 2.0.54 + webmail (uebimiau)

=20

From my own webmail, if when sending a message, in the body the message, =
appears a chain introduced in the file of configuration, the message is =
rejected. For example:

=20

In file mod_security.conf:

=20

SecFilterDefaultAction "deny,log,status:403"

. . . . .=20

. . . . .=20

Secfilter /bin/chmod

=20

In the body of mail message

"this is a example for the string /bin/chmod"

=20

This generates following log.

=20

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

UNIQUE_ID: jFn6LMCoyZgAABlCGDoAAAAr

Request: 192.168.207.1 - - [28/Oct/2005:10:48:06 +0200] "POST =
/webmail/newmsg.php HTTP/1.0" 403 220

Handler: php-script

----------------------------------------

POST /webmail/newmsg.php HTTP/1.0

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, =
application/x-shockwave-flash, application/vnd.ms-excel, =
application/vnd.ms-powerpoint, application/msword, */*

Referer: =
https://correo.pruebas.es/webmail/newmsg.php?pag=3D1&folder=3Dinbox&sid=3D=
{4361E2260EA50-4361E2261386F-1130488358}&tid=3D0&lid=3D0

Accept-Language: es

Content-Type: application/x-www-form-urlencoded

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; =
InfoPath.1)

Host: correo.cajamar.es

Content-Length: 363

Cache-Control: no-cache

Cookie: =
{4361E2260EA50-4361E2261386F-1130488358}=3D%7B4361E2260EA50-4361E2261386F=
-1130488358%7D

mod_security-message: Access denied with code 403. Pattern match =
"/bin/chmod" at POST_PAYLOAD

mod_security-action: 403

=20

363

tipo=3Dsend&is_html=3Dtrue&sid=3D%7B4361E2260EA50-4361E2261386F-113048835=
8%7D&lid=3D0&tid=3D0&folder=3Dinbox&sig=3DTomas+Hidalgo%3Cbr+%2F%3E%0D%0A=
%28c%29+2005&textmode=3D&to=...@te...&cc=3D&bcc=3D=
&subject=3Dprueba3&body=3D%3CBR%3Een+el+cuerpo+del+mensaje+aparece+la+pal=
abra+%2Fbin%2Fchmod%3CBR%3E--%3CBR%3ETomas+Hidalgo%3CBR%3E%28c%29+2005%3C=
BR%3E%3CBR%3E&priority=3D3

=20

HTTP/1.0 403 Forbidden

Content-Length: 220

Connection: close

Content-Type: text/html; charset=3Diso-8859-1

=20

Questions:

=20

1)       it is possible to avoid that mod_security does not verify the =
body of the message?

2)       He is coherent to use mod_security with a webmail? I have not =
found any positive or negative reference

=20

Many thanks for you help.

=20

=20

=20

Tom=E1s Hidalgo Salvador

thi...@te...

Dpto. Sistemas Unix

DSF Almariya

Almeria - Andalucia - Spain

=20

Re: [mod-security-users] problems getting mod_security rules included into Apache 2.1.8

[Sven K. <ce...@gm...>]

Great! Thank you!


Sven

>    You have uncovered a bug in ModSecurity 1.9RC1 (stable releases are
>    fine), related to chain actions. I will fix it over the weekend.
>

Re: [mod-security-users] Re: Strange error when blocking a petition

[Ivan R. <iv...@we...>]

I can't remember if I replied to this one at the time so I'll
just respond again.


>>>I'm getting the following error from time to time. I'm not running
>>>windows, so I'm not very worried about it, but the
>>>'ap_setup_client_block failed with 400' message doesn't look good. Is it
>>>a problem with my mod_security installation? Or is it normal?
>>>
>>>195.194.x.x - - [24/Mar/2005:00:54:50 +0100] "POST 
>>>/_vti_bin/_vti_aut/fp30reg.dll HTTP/1.1" 500 647 Access denied with code 
>>>500. ap_setup_client_block failed with 400
 >
 > ...
 >
 >>I have a bunch of "/_vti_bin" requests in my error log, but they are all
 >>404.  How did you get a 500 instead of a 404 if they're posting to a dll and
 >>you're not running Windows?

   This is probably with Apache 1.x. It will respond with 400 if
   an attempt to use chunked encoding (and ModSecurity is loaded). The
   same thing will be allowed with Apache 2.x.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] problems getting mod_security rules included into Apache 2.1.8

[Ivan R. <iv...@we...>]

Sven Kauber wrote:
> Hi Ivan!
> 
> What I meant was that it seemed to me that no rule was loaded at all

   Hi Sven,

   You have uncovered a bug in ModSecurity 1.9RC1 (stable releases are
   fine), related to chain actions. I will fix it over the weekend.

   Thanks!

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] problems getting mod_security rules included into Apache 2.1.8

[Sven K. <ce...@gm...>]

Hi Ivan!

What I meant was that it seemed to me that no rule was loaded at all
when I loaded all those rules from here
http://www.gotroot.com/mod_security+rules. Here is the mod_security
configuration I am using:

<IfModule mod_security.c>
   SecFilterEngine On

. . .the rules directly from
http://www.gotroot.com/tiki-index.php?page=3DSetup+of+mod_security . . .

   #First, add in your exclusion rules:
   #These MUST come first!

   Include /etc/modsecurity/exclude.conf
   #Application protection rules
   Include /etc/modsecurity/rules.conf
   #Comment spam rules
   Include /etc/modsecurity/blacklist.conf
   #Bad hosts, bad proxies and other bad players
   Include /etc/modsecurity/blacklist2.conf
   #Bad clients, known bogus useragents and other signs of malware
   Include /etc/modsecurity/useragents.conf
   #Known bad software, rootkits and other malware
   Include /etc/modsecurity/rootkits.conf
   #Signatures to prevent proxying through your server
   #only rule these rules if your server is NOT a proxy
   Include /etc/modsecurity/proxy.conf
   #Additional rules for Apache 2.x ONLY!  Do not add this line if you
use Apache 1.x
   Include /etc/modsecurity/apache2-rules.conf
</IfModule>

With this configuration when I try for example to enter this:
http://myhost.com/bin/nasm the server sends 404 error instead of error
500 like it should.
But when I add this: SecFilterSelective THE_REQUEST "bin/nasm" right
before the Include directives I will get the 500 error.


Sven

On 10/26/05, Ivan Ristic <iv...@we...> wrote:
> Sven Kauber wrote:
>  >
>
>    Hi Sven,
>
>
> > The problem is with having large rulesets. I would like to know how I
> > could use the rules I get from here:
> > http://www.gotroot.com/mod_security+rules This far I have tried the
> > Include directives and copying the rules with sed. Still no luck. I
> > have mod_security rules in a separate part of httpd.conf, between
> > <IfModule..> directives in global scope and users' reverse proxy
> > directives are inside a separate <VirtualServer..> .  For setting up
> > mod_security inside the <IfModule...> directive I have followed this
> > guide: http://www.gotroot.com/tiki-index.php?page=3DSetup+of+mod_securi=
ty
>
>    I am afraid I don't understand what the problem is. What results
>    are you expecting that you are not getting? Can you get any rule
>    to work, or do you have problems specifically with the rules from
>    gotroot?
>
>
> > I have not had the chance to try the version 1.8.7 in Apache 2.1.8
> > because it won't compile - I get errors.
>
>    ModSecurity 1.8.7 doesn't work with Apache 2.1.x - they're not
>    compatible.
>
> --
> Ivan Ristic
> Apache Security (O'Reilly) - http://www.apachesecurity.net
> Open source web application firewall - http://www.modsecurity.org
>

[mod-security-users] Re: Strange error when blocking a petition

[dusky <she...@li...>]

Tom Anderson <tanderso <at> oac-design.com> writes:

> 
> 
> ----- Original Message ----- 
> From: "Alberto Gonzalez Iniesta" <agi <at> inittab.org>
> To: <mod-security-users <at> lists.sourceforge.net>
> Sent: Tuesday, March 29, 2005 11:53 AM
> Subject: [mod-security-users] Strange error when blocking a petition
> 
> > Hi all,
> >
> > I'm getting the following error from time to time. I'm not running
> > windows, so I'm not very worried about it, but the
> > 'ap_setup_client_block failed with 400' message doesn't look good. Is it
> > a problem with my mod_security installation? Or is it normal?
> >
> > 195.194.x.x - - [24/Mar/2005:00:54:50 +0100] "POST 
> > /_vti_bin/_vti_aut/fp30reg.dll HTTP/1.1" 500 647 Access denied with code 
> > 500. ap_setup_client_block failed with 400
> 
> Here's some things that would probably catch this on my system:
> 
> SecFilterSelective "HTTP_TRANSFER_ENCODING" "chunked"
> 
> SecFilter 
> "\.
(conf|cf|ini|cfg|htpasswd|htaccess|htgroup|inc|history|bash_history|exe|pwd|cnf|
dll)"
> 
> I also have this, but I don't recall why:
> 
> SecFilter errors/400
> 
> I have a bunch of "/_vti_bin" requests in my error log, but they are all 
> 404.  How did you get a 500 instead of a 404 if they're posting to a dll and 
> you're not running Windows?
> 
> Tom
> 
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> 

I may be wrong, but if you have this in your apache's mod_security:
SecServerSignature "Microsoft-IIS/5.0" (when you're running Apache),
then someone obviously thinks you're truly running MS server. I have it in mine 
to confuse hackers... 
Try it and have a look at your headers in stats logs etc...it'll have that 
instead of the real info that you do not wish to disclose to competitors, 
hackers...( or to boost that you can afford an expensive server :)  !!!

I know most know about this trick, but there'll always be a newbie somewhere!

dusky

[mod-security-users] No URL Decoding patch - updated for 1.9RC1

[Eli <eli...@ex...>]

Hi all,

A long time ago, I had the requirement of NOT wanting mod_security to
normalize/decode the URL before applying filters on it (so I could =
filter
out urls with ";" and other characters unencoded, but leave URLs that =
were
properly encoded alone), so I made a simple little patch to add an =
option to
mod_security that prevented it from decoding encoded URLs so that the
down-stream filters would have an unmodified URL to match against.

I've been successfully using this patch on production servers since I
created it (at least 6 months), and it's working very well.  I haven't
however tried to break it, so I don't know if it would work for everyone =
-
HOWEVER, since I *do* find this extremely useful, and there is still no =
way
to do this in mod_security, I was hoping that someone may take this =
work,
extend it for apache2 (this patch modifies the apache1/mod_security.c =
file
only - not the apache2 file... Well, if it does, it's untested.) and
hopefully get it included in to the official mod_security release.

http://www.hoktar.com/downloads/other/mod_security-1.9RC1-no_decoding.pat=
ch

I accept all criticism - I've made many other "useless" patches for =
programs
before :)

Thanks,

Eli.

Re: [mod-security-users] problems getting mod_security rules included into Apache 2.1.8

[Ivan R. <iv...@we...>]

Sven Kauber wrote:
 >

   Hi Sven,


> The problem is with having large rulesets. I would like to know how I
> could use the rules I get from here:
> http://www.gotroot.com/mod_security+rules This far I have tried the
> Include directives and copying the rules with sed. Still no luck. I
> have mod_security rules in a separate part of httpd.conf, between
> <IfModule..> directives in global scope and users' reverse proxy
> directives are inside a separate <VirtualServer..> .  For setting up
> mod_security inside the <IfModule...> directive I have followed this
> guide: http://www.gotroot.com/tiki-index.php?page=Setup+of+mod_security

   I am afraid I don't understand what the problem is. What results
   are you expecting that you are not getting? Can you get any rule
   to work, or do you have problems specifically with the rules from
   gotroot?


> I have not had the chance to try the version 1.8.7 in Apache 2.1.8
> because it won't compile - I get errors.

   ModSecurity 1.8.7 doesn't work with Apache 2.1.x - they're not
   compatible.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] problems getting mod_security rules included into Apache 2.1.8

[Sven K. <ce...@gm...>]

I am trying to use Apache as as reverse proxy and I host some
PHP-based CMS sites for a couple of users. I also would like to use
mod_security as a web firewall to fend off attacks.

I have had clashes with the problems current "production" Apache
versions have. Reverse proxying doesn't work at all like it should,
users are getting redirected to each other pages after trying to log
in to theis sites etc. Reverse proxying works fine with the newest
beta version of Apache (2.1.8). But even after lot of testing, I am
unable to get the newest mod_security to work properly.

The problem is with having large rulesets. I would like to know how I
could use the rules I get from here:
http://www.gotroot.com/mod_security+rules This far I have tried the
Include directives and copying the rules with sed. Still no luck. I
have mod_security rules in a separate part of httpd.conf, between
<IfModule..> directives in global scope and users' reverse proxy
directives are inside a separate <VirtualServer..> .  For setting up
mod_security inside the <IfModule...> directive I have followed this
guide: http://www.gotroot.com/tiki-index.php?page=3DSetup+of+mod_security

I have not had the chance to try the version 1.8.7 in Apache 2.1.8
because it won't compile - I get errors.

Re: [mod-security-users] Filter Rules by IP Address

[Naveen A. <na...@gm...>]

Just curious,

Can i allow a full subnet like this
SecFilterSelective REMOTE_ADDR  ^196.168.0.*$ allow.
I will give it a try.

Thanks,
naveen

On 10/25/05, Naveen Amradi <na...@gm...> wrote:
> SecFilterSelective REMOTE_ADDR  ^196.168.0.94$ allow
> worked.  I tried that before Ryan replied but with allow,pass.
> So i guess wiht pass in it, it was allowing the IP address but still
> applying the other rules.
>
> I really appreciate your help guys.
>
>
> Thanks a lot,
> Naveen
>
> On 10/25/05, Ryan Barnett <rcb...@gm...> wrote:
> > Sorry about that - I used the wrong env token.  Use this instead -
> >
> > SecFilterSelective REMOTE_ADDR "^192\.168\.0\.94$" allow
> >
> > Also, just use "allow" at the end.  This should tell mod_security to al=
low
> > the request and to not apply and other filters.
> >
> > If it is still getting blocked by another filter, check the debug log f=
ile
> > Looking at your conf file, you need to turn this on (0 does no logging)=
.
> > Set this log level to 9 if you want the most verbose info. -
> >
> > # You normally won't need debug logging
> >     SecFilterDebugLevel 9
> >     SecFilterDebugLog logs/modsec_debug_log
> >
> > --
> > Ryan C. Barnett
> > Web Application Security Consortium (WASC) Member
> > CIS Apache Benchmark Project Lead
> > SANS Instructor: Securing Apache
> > GCIA, GCFA, GCIH, GSNA, GCUX, GSEC
> >
> > Author: Preventing Web Attacks with Apache
> >
> > On 10/25/05, Naveen Amradi <na...@gm...> wrote:
> > >
> > > HI Ryan,
> > >
> > >   I appreciate your quick response and help.
> > >  I am still not able to configure it properly.
> > > Just like u said i added
> > >
> > > SecFilterSelective REMOTE_HOST "^192\.168\.0\.94$" allow,pass
> > >
> > > I tried putting it right below the SecFilterEnging and other places t=
oo.
> > And i am getting this error in the log file. Maybe i am missing somethi=
ng.
> > >
> > >
> > > UNIQUE_ID: xv7hbIJKVE8AAFQjVXYAAAAE
> > > Request: 196.168.0.94 - - [25/Oct/2005:11:39:02 --0500] "GET
> > /study_abroad/TMPzad38oxcyx.htm HTTP/1.1" 403 232
> > > Handler: server-parsed
> > > ----------------------------------------
> > > GET /study_abroad/TMPzad38oxcyx.htm HTTP/1.1
> > > User-Agent: Contribute
> > > Host: www.outreach.olemiss.edu
> > > Cookie:
> > phpbb2mysql_data=3Da%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A0%3A%22%=
22%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%223%22%3B%7D;
> > PHPSESSID=3D59ded4be35990378545d942f2a11c0f9
> > > mod_security-message: Access denied with code 403. Pattern match "/tm=
p" at
> > THE_REQUEST
> > > mod_security-action: 403
> > >
> > > HTTP/1.1 403 Forbidden
> > > Content-Length: 232
> > >
> > > Could you help me?And Just for info i am trying to configure Macromed=
ia
> > Contribute.
> > >
> > > Thanks a lot,
> > >
> > > naveen
> > >
> > >
> > > On 10/25/05, Ryan Barnett <rcb...@gm... > wrote:
> > >
> > > >
> > > > Naveen,
> > > > Think of the mod_security directives (SecFilter|SecFilterSelective)=
 as
> > you would firewall rules in that the order in which they are specified =
in
> > the httpd.conf file does matter.  Again, like firewall rules, once a fi=
lter
> > matches the incoming HTTP request it will trigger the actions specified=
.
> > With this being said, if you want to "whitelist" an IP address to allow=
 this
> > client access, then add in a rule like this near the top of your
> > Mod_Security directives -
> > > >
> > > > SecFilterSelective REMOTE_HOST "^192\.168\.1\.100$" allow,pass
> > > >
> > > > Add this just below the mod_security general directives (such as
> > SecFilterEngine, etc....).
> > > >
> > > > That should do it.
> > > >
> > > > --
> > > > Ryan C. Barnett
> > > > Web Application Security Consortium (WASC) Member
> > > > CIS Apache Benchmark Project Lead
> > > > SANS Instructor: Securing Apache
> > > > GCIA, GCFA, GCIH, GSNA, GCUX, GSEC
> > > > Author: Preventing Web Attacks with Apache
> > > >
> > > >
> > > > On 10/25/05, Naveen Amradi <na...@gm... > wrote:
> > > > > HI All,
> > > > >
> > > > >   Newbie of ModSecurity. I was wondering is there a way to
> > > > > open up rules for certain ip addresses.
> > > > >
> > > > > Thanks a gazillion!
> > > > > Naveen
> > > >
> > > >
> > > >
> > > >
> > >
> > >
> >
> >
> >
> >
>

Re: [mod-security-users] Filter Rules by IP Address

[Naveen A. <na...@gm...>]

SecFilterSelective REMOTE_ADDR  ^196.168.0.94$ allow
worked.  I tried that before Ryan replied but with allow,pass.
So i guess wiht pass in it, it was allowing the IP address but still
applying the other rules.

I really appreciate your help guys.


Thanks a lot,
Naveen

On 10/25/05, Ryan Barnett <rcb...@gm...> wrote:
> Sorry about that - I used the wrong env token.  Use this instead -
>
> SecFilterSelective REMOTE_ADDR "^192\.168\.0\.94$" allow
>
> Also, just use "allow" at the end.  This should tell mod_security to allo=
w
> the request and to not apply and other filters.
>
> If it is still getting blocked by another filter, check the debug log fil=
e
> Looking at your conf file, you need to turn this on (0 does no logging).
> Set this log level to 9 if you want the most verbose info. -
>
> # You normally won't need debug logging
>     SecFilterDebugLevel 9
>     SecFilterDebugLog logs/modsec_debug_log
>
> --
> Ryan C. Barnett
> Web Application Security Consortium (WASC) Member
> CIS Apache Benchmark Project Lead
> SANS Instructor: Securing Apache
> GCIA, GCFA, GCIH, GSNA, GCUX, GSEC
>
> Author: Preventing Web Attacks with Apache
>
> On 10/25/05, Naveen Amradi <na...@gm...> wrote:
> >
> > HI Ryan,
> >
> >   I appreciate your quick response and help.
> >  I am still not able to configure it properly.
> > Just like u said i added
> >
> > SecFilterSelective REMOTE_HOST "^192\.168\.0\.94$" allow,pass
> >
> > I tried putting it right below the SecFilterEnging and other places too=
.
> And i am getting this error in the log file. Maybe i am missing something=
.
> >
> >
> > UNIQUE_ID: xv7hbIJKVE8AAFQjVXYAAAAE
> > Request: 196.168.0.94 - - [25/Oct/2005:11:39:02 --0500] "GET
> /study_abroad/TMPzad38oxcyx.htm HTTP/1.1" 403 232
> > Handler: server-parsed
> > ----------------------------------------
> > GET /study_abroad/TMPzad38oxcyx.htm HTTP/1.1
> > User-Agent: Contribute
> > Host: www.outreach.olemiss.edu
> > Cookie:
> phpbb2mysql_data=3Da%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A0%3A%22%22=
%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%223%22%3B%7D;
> PHPSESSID=3D59ded4be35990378545d942f2a11c0f9
> > mod_security-message: Access denied with code 403. Pattern match "/tmp"=
 at
> THE_REQUEST
> > mod_security-action: 403
> >
> > HTTP/1.1 403 Forbidden
> > Content-Length: 232
> >
> > Could you help me?And Just for info i am trying to configure Macromedia
> Contribute.
> >
> > Thanks a lot,
> >
> > naveen
> >
> >
> > On 10/25/05, Ryan Barnett <rcb...@gm... > wrote:
> >
> > >
> > > Naveen,
> > > Think of the mod_security directives (SecFilter|SecFilterSelective) a=
s
> you would firewall rules in that the order in which they are specified in
> the httpd.conf file does matter.  Again, like firewall rules, once a filt=
er
> matches the incoming HTTP request it will trigger the actions specified.
> With this being said, if you want to "whitelist" an IP address to allow t=
his
> client access, then add in a rule like this near the top of your
> Mod_Security directives -
> > >
> > > SecFilterSelective REMOTE_HOST "^192\.168\.1\.100$" allow,pass
> > >
> > > Add this just below the mod_security general directives (such as
> SecFilterEngine, etc....).
> > >
> > > That should do it.
> > >
> > > --
> > > Ryan C. Barnett
> > > Web Application Security Consortium (WASC) Member
> > > CIS Apache Benchmark Project Lead
> > > SANS Instructor: Securing Apache
> > > GCIA, GCFA, GCIH, GSNA, GCUX, GSEC
> > > Author: Preventing Web Attacks with Apache
> > >
> > >
> > > On 10/25/05, Naveen Amradi <na...@gm... > wrote:
> > > > HI All,
> > > >
> > > >   Newbie of ModSecurity. I was wondering is there a way to
> > > > open up rules for certain ip addresses.
> > > >
> > > > Thanks a gazillion!
> > > > Naveen
> > >
> > >
> > >
> > >
> >
> >
>
>
>
>

Re: [mod-security-users] Filter Rules by IP Address

[Ryan B. <rcb...@gm...>]

Sorry about that - I used the wrong env token. Use this instead -
 SecFilterSelective REMOTE_ADDR "^192\.168\.0\.94$" allow
 Also, just use "allow" at the end. This should tell mod_security to allow
the request and to not apply and other filters.
 If it is still getting blocked by another filter, check the debug log file
Looking at your conf file, you need to turn this on (0 does no logging). Se=
t
this log level to 9 if you want the most verbose info. -
 # You normally won't need debug logging
SecFilterDebugLevel 9
SecFilterDebugLog logs/modsec_debug_log

--
Ryan C. Barnett
Web Application Security Consortium (WASC) Member
CIS Apache Benchmark Project Lead
SANS Instructor: Securing Apache
GCIA, GCFA, GCIH, GSNA, GCUX, GSEC
Author: Preventing Web Attacks with Apache
 On 10/25/05, Naveen Amradi <na...@gm...> wrote:
>
> HI Ryan,
>   I appreciate your quick response and help.
>  I am still not able to configure it properly.
> Just like u said i added
>
> SecFilterSelective REMOTE_HOST "^192\.168\.0\.94$" allow,pass
>  I tried putting it right below the SecFilterEnging and other places too.
> And i am getting this error in the log file. Maybe i am missing something=
.
>
> UNIQUE_ID: xv7hbIJKVE8AAFQjVXYAAAAE
> Request: 196.168.0.94 <http://196.168.0.94/> - - [25/Oct/2005:11:39:02
> --0500] "GET /study_abroad/TMPzad38oxcyx.htm HTTP/1.1" 403 232
> Handler: server-parsed
> ----------------------------------------
> GET /study_abroad/TMPzad38oxcyx.htm HTTP/1.1
> User-Agent: Contribute
> Host: www.outreach.olemiss.edu <http://www.outreach.olemiss.edu/>
> Cookie:
> phpbb2mysql_data=3Da%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A0%3A%22%22=
%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%223%22%3B%7D;
> PHPSESSID=3D59ded4be35990378545d942f2a11c0f9
> mod_security-message: Access denied with code 403. Pattern match "/tmp" a=
t
> THE_REQUEST
> mod_security-action: 403
>
> HTTP/1.1 403 Forbidden
> Content-Length: 232
>
> Could you help me?And Just for info i am trying to configure Macromedia
> Contribute.
>
> Thanks a lot,
>
> naveen
>
>  On 10/25/05, Ryan Barnett <rcb...@gm...> wrote:
> >
> > Naveen,
> > Think of the mod_security directives (SecFilter|SecFilterSelective) as
> > you would firewall rules in that the order in which they are specified =
in
> > the httpd.conf file does matter. Again, like firewall rules, once a
> > filter matches the incoming HTTP request it will trigger the actions
> > specified. With this being said, if you want to "whitelist" an IP addre=
ss to
> > allow this client access, then add in a rule like this near the top of =
your
> > Mod_Security directives -
> >  SecFilterSelective REMOTE_HOST "^192\.168\.1\.100$" allow,pass
> >  Add this just below the mod_security general directives (such as
> > SecFilterEngine, etc....).
> >  That should do it.
> >
> > --
> > Ryan C. Barnett
> > Web Application Security Consortium (WASC) Member
> > CIS Apache Benchmark Project Lead
> > SANS Instructor: Securing Apache
> > GCIA, GCFA, GCIH, GSNA, GCUX, GSEC
> > Author: Preventing Web Attacks with Apache
> >   On 10/25/05, Naveen Amradi <na...@gm... > wrote:
> > >
> > > HI All,
> > >
> > > Newbie of ModSecurity. I was wondering is there a way to
> > > open up rules for certain ip addresses.
> > >
> > > Thanks a gazillion!
> > > Naveen
> >
> >
> >
> >
> >
>

Re: [mod-security-users] Filter Rules by IP Address

[Christopher M. <mu...@to...>]

Move your IP rule sdown under:

SecFilterDebugLog logs/modsec_debug_log


At the very bottom of the module you have:


SecFilter "/tmp"


Thats looks be be getting you. Try moving your code down first.

-- 
Regards,

 -Chris

_______________________________________________
Christopher Murley
Network Administrator
TownNews.Com
800.293.9576

Naveen Amradi said:
> Forgot to attach file in the previous reply.
>  Thanks,
> naveen
>
>  On 10/25/05, Naveen Amradi <na...@gm...> wrote:
>>
>> Chris,
>>  I have attached my conf file. WOuld you please look at it. I have
>> placed
>> the rule right below the SecFilterEngine. In that case wont that rule be
>> higher than other ones. Maybe i am sounding dumb. I am trying to read
>> the
>> book and understand slowly.
>>  I would appreciate if you can look at the conf file.
>>  Everyone on this list is so active helpful.
>>  Thanks a lot,
>> naveen
>>
>>  On 10/25/05, Christopher Murley <mu...@to...> wrote:
>> >
>> > HI Naveen, your problem isn't with the IP rule you created. You error
>> > was:
>> >
>> > mod_security-message: Access denied with code 403. Pattern match
>> "/tmp"
>> > at
>> > THE_REQUEST
>> >
>> >
>> > The request you sent:
>> >
>> > GET /study_abroad/TMPzad38oxcyx.htm HTTP/1.1" 403 232
>> >
>> > has /TMP (lowercased) /tmp in it. You must have another rule higher in
>> > your chain thats disallowing URLS referencing /tmp.
>> >
>> > --
>> > Regards,
>> >
>> > -Chris
>> >
>> > _______________________________________________
>> > Christopher Murley
>> > Network Administrator
>> > TownNews.Com
>> > 800.293.9576
>> >
>> > Naveen Amradi said:
>> > > HI Ryan,
>> > > I appreciate your quick response and help.
>> > > I am still not able to configure it properly.
>> > > Just like u said i added
>> > >
>> > > SecFilterSelective REMOTE_HOST "^192\.168\.0\.94$" allow,pass
>> > > I tried putting it right below the SecFilterEnging and other places
>> > too.
>> > > And i am getting this error in the log file. Maybe i am missing
>> > something.
>> > >
>> > > UNIQUE_ID: xv7hbIJKVE8AAFQjVXYAAAAE
>> > > Request: 196.168.0.94 <http://196.168.0.94/> < http://196.168.0.94>
>> -
>> > - [25/Oct/2005:11:39:02
>> > > --0500] "GET /study_abroad/TMPzad38oxcyx.htm HTTP/1.1" 403 232
>> > > Handler: server-parsed
>> > > ----------------------------------------
>> > > GET /study_abroad/TMPzad38oxcyx.htm HTTP/1.1
>> > > User-Agent: Contribute
>> > > Host: www.outreach.olemiss.edu <http://www.outreach.olemiss.edu/> <
>> > http://www.outreach.olemiss.edu/>
>> > > Cookie:
>> > >
>> > phpbb2mysql_data=a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A0%3A%22%22%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%223%22%3B%7D;
>> > > PHPSESSID=59ded4be35990378545d942f2a11c0f9
>> > > mod_security-message: Access denied with code 403. Pattern match
>> > "/tmp" at
>> > > THE_REQUEST
>> > > mod_security-action: 403
>> > >
>> > > HTTP/1.1 403 Forbidden
>> > > Content-Length: 232
>> > >
>> > > Could you help me?And Just for info i am trying to configure
>> > Macromedia
>> > > Contribute.
>> > >
>> > > Thanks a lot,
>> > >
>> > > naveen
>> > >
>> > > On 10/25/05, Ryan Barnett <rcb...@gm...> wrote:
>> > >>
>> > >> Naveen,
>> > >> Think of the mod_security directives (SecFilter|SecFilterSelective)
>> > as
>> > >> you
>> > >> would firewall rules in that the order in which they are specified
>> in
>> > >> the
>> > >> httpd.conf file does matter. Again, like firewall rules, once a
>> > filter
>> > >> matches the incoming HTTP request it will trigger the actions
>> > specified.
>> > >> With this being said, if you want to "whitelist" an IP address to
>> > allow
>> > >> this
>> > >> client access, then add in a rule like this near the top of your
>> > >> Mod_Security directives -
>> > >> SecFilterSelective REMOTE_HOST "^192\.168\.1\.100$" allow,pass
>> > >> Add this just below the mod_security general directives (such as
>> > >> SecFilterEngine, etc....).
>> > >> That should do it.
>> > >>
>> > >> --
>> > >> Ryan C. Barnett
>> > >> Web Application Security Consortium (WASC) Member
>> > >> CIS Apache Benchmark Project Lead
>> > >> SANS Instructor: Securing Apache
>> > >> GCIA, GCFA, GCIH, GSNA, GCUX, GSEC
>> > >> Author: Preventing Web Attacks with Apache
>> > >> On 10/25/05, Naveen Amradi <na...@gm...> wrote:
>> > >> >
>> > >> > HI All,
>> > >> >
>> > >> > Newbie of ModSecurity. I was wondering is there a way to
>> > >> > open up rules for certain ip addresses.
>> > >> >
>> > >> > Thanks a gazillion!
>> > >> > Naveen
>> > >>
>> > >>
>> > >>
>> > >>
>> > >>
>> > >
>> >
>> >
>>
>

Re: [mod-security-users] Filter Rules by IP Address

[Naveen A. <na...@gm...>]

<IfModule mod_security.c>
    # Only inspect dynamic requests
    # (YOU MUST TEST TO MAKE SURE IT WORKS AS EXPECTED)
    SecFilterEngine DynamicOnly

    # Naveen
    SecFilterSelective REMOTE_HOST "^192\.168\.0\.94$" allow,pass

    # Reject requests with status 403
    SecFilterDefaultAction "deny,log,status:403"

    # Some sane defaults
    SecFilterScanPOST On
    SecFilterCheckURLEncoding On
    SecFilterCheckCookieFormat On
    SecFilterCheckUnicodeEncoding Off

    # Accept almost all byte values
    SecFilterForceByteRange 1 255


    # Server masking is optional
    # SecServerSignature "Microsoft-IIS/5.0"

    SecUploadDir /tmp
    SecUploadKeepFiles Off
 
    # Only record the interesting stuff
    SecAuditEngine RelevantOnly
    SecAuditLog logs/audit_log
 
    # You normally won't need debug logging
    SecFilterDebugLevel 0
    SecFilterDebugLog logs/modsec_debug_log


    # Only accept request encodings we know how to handle
    # we exclude GET requests from this because some (automated)
    # clients supply "text/html" as Content-Type
    SecFilterSelective REQUEST_METHOD "!^GET$" chain
    SecFilterSelective HTTP_Content-Type "!(^$|^application/x-www-form-urlencoded$|^multipart/form-data)"
 
    # Require Content-Length to be provided with
    # every POST request
    SecFilterSelective REQUEST_METHOD "^POST$" chain
    SecFilterSelective HTTP_Content-Length "^$"

    # Don't accept transfer encodings we know we don't handle
    # (and you don't need it anyway)
    SecFilterSelective HTTP_Transfer-Encoding "!^$"


 
# WEB-ATTACKS /bin/sh command attempt
SecFilter "/bin/sh"
 
# WEB-ATTACKS ps command attempt
SecFilterSelective THE_REQUEST "/bin/ps"
 
# WEB-ATTACKS /bin/ps command attempt
# SecFilterSelective THE_REQUEST "ps\x20"
 
# WEB-ATTACKS wget command attempt
SecFilter "wget\x20"
 
# WEB-ATTACKS uname -a command attempt
SecFilter "uname\x20-a"
 
# WEB-ATTACKS /usr/bin/id command attempt
SecFilter "/usr/bin/id"
 
# WEB-ATTACKS id command attempt
SecFilter "\;id"
 
# WEB-ATTACKS echo command attempt
SecFilter "/bin/echo"
 
# WEB-ATTACKS kill command attempt
SecFilter "/bin/kill"
 
# WEB-ATTACKS chmod command attempt
SecFilter "/bin/chmod"
 
# WEB-ATTACKS chgrp command attempt
SecFilter "/chgrp"
 
# WEB-ATTACKS chown command attempt
SecFilter "/chown"
 
# WEB-ATTACKS chsh command attempt
SecFilter "/usr/bin/chsh"
 
# WEB-ATTACKS tftp command attempt
SecFilter "tftp\x20"
 
# WEB-ATTACKS gcc command attempt
SecFilter "gcc\x20-o"
 
# WEB-ATTACKS cc command attempt
#SecFilter "cc\x20"
 
# WEB-ATTACKS /usr/bin/cpp command attempt
SecFilter "/usr/bin/cpp"
 
# WEB-ATTACKS cpp command attempt
SecFilter "cpp\x20"
 
# WEB-ATTACKS /usr/bin/g++ command attempt
SecFilter "/usr/bin/g\+\+"
 
# WEB-ATTACKS g++ command attempt
SecFilter "g\+\+\x20"
 
# WEB-ATTACKS bin/python access attempt
SecFilter "bin/python"
 
# WEB-ATTACKS python access attempt
SecFilter "python\x20"
 
# WEB-ATTACKS bin/tclsh execution attempt
SecFilter "bin/tclsh"
 
# WEB-ATTACKS tclsh execution attempt
SecFilter "tclsh8\x20"
 
# WEB-ATTACKS bin/nasm command attempt
SecFilter "bin/nasm"
 
# WEB-ATTACKS nasm command attempt
SecFilter "nasm\x20"
 
# WEB-ATTACKS /usr/bin/perl execution attempt
SecFilter "/usr/bin/perl"
 
# WEB-ATTACKS perl execution attempt
SecFilter "perl\x20"
 
# WEB-ATTACKS traceroute command attempt
SecFilter "traceroute\x20"

# WEB-ATTACKS ping command attempt
SecFilter "/bin/ping"
 
# WEB-ATTACKS netcat command attempt
#SecFilter "nc\x20"
 
# WEB-ATTACKS nmap command attempt
SecFilter "nmap\x20"

# WEB-ATTACKS xterm command attempt
SecFilter "/usr/X11R6/bin/xterm"
 
# WEB-ATTACKS X application to remote host attempt
SecFilter "\x20-display\x20"
 
# WEB-ATTACKS lsof command attempt
SecFilter "lsof\x20"
 
# WEB-ATTACKS rm command attempt
#SecFilter "rm\x20"
 
# WEB-ATTACKS mail command attempt
SecFilter "/bin/mail"
 
# WEB-ATTACKS /bin/ls command attempt
SecFilterSelective THE_REQUEST "/bin/ls"
 
# WEB-ATTACKS /etc/inetd.conf access
SecFilter "/etc/inetd\.conf" log,pass
 
# WEB-ATTACKS /etc/motd access
SecFilter "/etc/motd" log,pass
 
# WEB-ATTACKS /etc/shadow access
SecFilter "/etc/shadow" log,pass
 
# WEB-ATTACKS conf/httpd.conf attempt
SecFilter "conf/httpd\.conf" log,pass
 
# WEB-ATTACKS .htgroup access
SecFilterSelective THE_REQUEST "\.htgroup" log,pass

# WEB-CGI rksh access
SecFilterSelective THE_REQUEST "/rksh"
 
# WEB-CGI bash access
SecFilterSelective THE_REQUEST "/bash" log,pass
 
# WEB-CGI perl command attempt
SecFilterSelective THE_REQUEST "/perl\?"
 
# WEB-CGI zsh access
SecFilterSelective THE_REQUEST "/zsh"
 
# WEB-CGI csh access
SecFilterSelective THE_REQUEST "/csh"
 
# WEB-CGI tcsh access
SecFilterSelective THE_REQUEST "/tcsh"
 
# WEB-CGI rsh access
SecFilterSelective THE_REQUEST "/rsh"
 
# WEB-CGI ksh access
SecFilterSelective THE_REQUEST "/ksh"
 
# WEB-CGI icat access
SecFilterSelective THE_REQUEST "/icat" log,pass
 
# WEB-CGI /cgi-bin/ls access
SecFilterSelective THE_REQUEST "/cgi-bin/ls" log,pass
 
# WEB-CLIENT Javascript document.domain attempt
SecFilter "document\.domain\("
 
# WEB-CLIENT Javascript URL host spoofing attempt
SecFilter "javascript\://"
 
# WEB-MISC cross site scripting \(img src=javascript\) attempt
SecFilter "img src=javascript"
 
# WEB-MISC .htpasswd access
SecFilter "\.htpasswd"
 
# WEB-MISC http directory traversal
SecFilter "\.\.\\"
 
# WEB-MISC http directory traversal
SecFilter "\.\./"
 
# WEB-MISC ls%20-l
SecFilter "ls\x20-l"
 
# WEB-MISC /etc/passwd
SecFilter "/etc/passwd"
 
# WEB-MISC .htaccess access
SecFilter "\.htaccess"
 
# WEB-MISC cd..
SecFilter "cd\.\."
 
# WEB-MISC /.... access
SecFilter "/\.\.\.\."
 
# WEB-MISC cat%20 access
SecFilter "cat\x20"
 
# WEB-MISC long basic authorization string
SecFilter "Authorization\: Basic "
 
# WEB-MISC .history access
SecFilterSelective THE_REQUEST "/\.history"
 
# WEB-MISC .bash_history access
SecFilterSelective THE_REQUEST "/\.bash_history"
 
# WEB-MISC *%0a.pl access
SecFilterSelective THE_REQUEST "/*\x0a\.pl"
 
# WEB-MISC apache ?M=D directory list attempt
SecFilterSelective THE_REQUEST "/\?M=D" log,pass
 
# WEB-MISC server-status access
SecFilterSelective THE_REQUEST "/server-status" log,pass
 
# WEB-MISC Transfer-Encoding\: chunked

SecFilter "chunked"
 
# WEB-MISC perl post attempt
SecFilterSelective THE_REQUEST "/perl/" chain
SecFilter "POST"
 
# WEB-MISC mod_gzip_status access
SecFilterSelective THE_REQUEST "/mod_gzip_status" log,pass
 
# WEB-PHP squirrel mail spell-check arbitrary command attempt
SecFilterSelective THE_REQUEST "/squirrelspell/modules/check_me\.mod\.php" chain
SecFilter "SQSPELL_APP\["
 
# WEB-PHP squirrel mail theme arbitrary command attempt
SecFilterSelective THE_REQUEST "/left_main\.php" chain
SecFilter "cmdd="
 
# WEB-PHP phpbb quick-reply.php arbitrary command attempt
SecFilterSelective THE_REQUEST "/quick-reply\.php" chain
SecFilter "phpbb_root_path="
 
# WEB-PHP phpbb quick-reply.php access
SecFilterSelective THE_REQUEST "/quick-reply\.php" log,pass
SecFilterSelective THE_REQUEST "\.php" chain
SecFilter "path=http\://"
 
# WEB-PHP Mambo uploadimage.php upload php file attempt
SecFilterSelective THE_REQUEST "/uploadimage\.php" chain
SecFilter "\.php"
 
# WEB-PHP Mambo upload.php upload php file attempt
SecFilterSelective THE_REQUEST "/upload\.php" chain
SecFilter "\.php"
 
# WEB-PHP Mambo uploadimage.php access
SecFilterSelective THE_REQUEST "/uploadimage\.php" log,pass
 
# WEB-PHP Mambo upload.php access
SecFilterSelective THE_REQUEST "/upload\.php" log,pass
 
# WEB-PHP phpBB privmsg.php access
SecFilterSelective THE_REQUEST "/privmsg\.php" log,pass

# WEB-PHP test.php access
SecFilterSelective THE_REQUEST "/test\.php" log,pass

# WEB-PHP phpBB viewtopic.php
SecFilterSelective THE_REQUEST "viewtopic.php" chain 
SecFilterSelective "THE_REQUEST|ARG_VALUES" "(system|exec|passthru|cmd|fopen|exit|fwrite)" deny,log

# EXTRAS

SecFilter "/boot"
SecFilter "/dev"
SecFilter "/etc"
SecFilter "/initrd"
SecFilter "/lost+found"
SecFilter "/mnt"
SecFilter "/proc"
SecFilter "/root"
SecFilter "/sbin"
SecFilter "/tmp"
SecFilter "/usr/local/apache"
SecFilter "/var/spool"
SecFilter "/bin/cc"
SecFilter "/bin/gcc"
SecFilter "<[[:space:]]*script"
SecFilter "<( |\n)*script"
#SecFilter "<(.|\n)+>"
#SecFilter "delete[[:space:]]+from"
#SecFilter "insert[[:space:]]+into"
#SecFilter "select.+from"

</IfModule>

Re: [mod-security-users] Filter Rules by IP Address

[Naveen A. <na...@gm...>]

Chris,
 I have attached my conf file. WOuld you please look at it. I have placed
the rule right below the SecFilterEngine. In that case wont that rule be
higher than other ones. Maybe i am sounding dumb. I am trying to read the
book and understand slowly.
 I would appreciate if you can look at the conf file.
 Everyone on this list is so active helpful.
 Thanks a lot,
naveen

 On 10/25/05, Christopher Murley <mu...@to...> wrote:
>
> HI Naveen, your problem isn't with the IP rule you created. You error was=
:
>
> mod_security-message: Access denied with code 403. Pattern match "/tmp" a=
t
> THE_REQUEST
>
>
> The request you sent:
>
> GET /study_abroad/TMPzad38oxcyx.htm HTTP/1.1" 403 232
>
> has /TMP (lowercased) /tmp in it. You must have another rule higher in
> your chain thats disallowing URLS referencing /tmp.
>
> --
> Regards,
>
> -Chris
>
> _______________________________________________
> Christopher Murley
> Network Administrator
> TownNews.Com
> 800.293.9576
>
> Naveen Amradi said:
> > HI Ryan,
> > I appreciate your quick response and help.
> > I am still not able to configure it properly.
> > Just like u said i added
> >
> > SecFilterSelective REMOTE_HOST "^192\.168\.0\.94$" allow,pass
> > I tried putting it right below the SecFilterEnging and other places too=
.
> > And i am getting this error in the log file. Maybe i am missing
> something.
> >
> > UNIQUE_ID: xv7hbIJKVE8AAFQjVXYAAAAE
> > Request: 196.168.0.94 <http://196.168.0.94> <http://196.168.0.94> - -
> [25/Oct/2005:11:39:02
> > --0500] "GET /study_abroad/TMPzad38oxcyx.htm HTTP/1.1" 403 232
> > Handler: server-parsed
> > ----------------------------------------
> > GET /study_abroad/TMPzad38oxcyx.htm HTTP/1.1
> > User-Agent: Contribute
> > Host: www.outreach.olemiss.edu <http://www.outreach.olemiss.edu> <
> http://www.outreach.olemiss.edu/>
> > Cookie:
> >
> phpbb2mysql_data=3Da%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A0%3A%22%22=
%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%223%22%3B%7D;
> > PHPSESSID=3D59ded4be35990378545d942f2a11c0f9
> > mod_security-message: Access denied with code 403. Pattern match "/tmp"
> at
> > THE_REQUEST
> > mod_security-action: 403
> >
> > HTTP/1.1 403 Forbidden
> > Content-Length: 232
> >
> > Could you help me?And Just for info i am trying to configure Macromedia
> > Contribute.
> >
> > Thanks a lot,
> >
> > naveen
> >
> > On 10/25/05, Ryan Barnett <rcb...@gm...> wrote:
> >>
> >> Naveen,
> >> Think of the mod_security directives (SecFilter|SecFilterSelective) as
> >> you
> >> would firewall rules in that the order in which they are specified in
> >> the
> >> httpd.conf file does matter. Again, like firewall rules, once a filter
> >> matches the incoming HTTP request it will trigger the actions
> specified.
> >> With this being said, if you want to "whitelist" an IP address to allo=
w
> >> this
> >> client access, then add in a rule like this near the top of your
> >> Mod_Security directives -
> >> SecFilterSelective REMOTE_HOST "^192\.168\.1\.100$" allow,pass
> >> Add this just below the mod_security general directives (such as
> >> SecFilterEngine, etc....).
> >> That should do it.
> >>
> >> --
> >> Ryan C. Barnett
> >> Web Application Security Consortium (WASC) Member
> >> CIS Apache Benchmark Project Lead
> >> SANS Instructor: Securing Apache
> >> GCIA, GCFA, GCIH, GSNA, GCUX, GSEC
> >> Author: Preventing Web Attacks with Apache
> >> On 10/25/05, Naveen Amradi <na...@gm...> wrote:
> >> >
> >> > HI All,
> >> >
> >> > Newbie of ModSecurity. I was wondering is there a way to
> >> > open up rules for certain ip addresses.
> >> >
> >> > Thanks a gazillion!
> >> > Naveen
> >>
> >>
> >>
> >>
> >>
> >
>
>

Re: [mod-security-users] Filter Rules by IP Address

[Christopher M. <mu...@to...>]

HI Naveen, your problem isn't with the IP rule you created.  You error was:

mod_security-message: Access denied with code 403. Pattern match "/tmp" at
THE_REQUEST


The request you sent:

GET /study_abroad/TMPzad38oxcyx.htm HTTP/1.1" 403 232

has /TMP (lowercased) /tmp in it. You must have another rule higher in
your chain thats disallowing URLS referencing /tmp.

-- 
Regards,

 -Chris

_______________________________________________
Christopher Murley
Network Administrator
TownNews.Com
800.293.9576

Naveen Amradi said:
> HI Ryan,
>   I appreciate your quick response and help.
>  I am still not able to configure it properly.
> Just like u said i added
>
> SecFilterSelective REMOTE_HOST "^192\.168\.0\.94$" allow,pass
>  I tried putting it right below the SecFilterEnging and other places too.
> And i am getting this error in the log file. Maybe i am missing something.
>
> UNIQUE_ID: xv7hbIJKVE8AAFQjVXYAAAAE
> Request: 196.168.0.94 <http://196.168.0.94> - - [25/Oct/2005:11:39:02
> --0500] "GET /study_abroad/TMPzad38oxcyx.htm HTTP/1.1" 403 232
> Handler: server-parsed
> ----------------------------------------
> GET /study_abroad/TMPzad38oxcyx.htm HTTP/1.1
> User-Agent: Contribute
> Host: www.outreach.olemiss.edu <http://www.outreach.olemiss.edu/>
> Cookie:
> phpbb2mysql_data=a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A0%3A%22%22%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%223%22%3B%7D;
> PHPSESSID=59ded4be35990378545d942f2a11c0f9
> mod_security-message: Access denied with code 403. Pattern match "/tmp" at
> THE_REQUEST
> mod_security-action: 403
>
> HTTP/1.1 403 Forbidden
> Content-Length: 232
>
> Could you help me?And Just for info i am trying to configure Macromedia
> Contribute.
>
> Thanks a lot,
>
> naveen
>
>  On 10/25/05, Ryan Barnett <rcb...@gm...> wrote:
>>
>> Naveen,
>> Think of the mod_security directives (SecFilter|SecFilterSelective) as
>> you
>> would firewall rules in that the order in which they are specified in
>> the
>> httpd.conf file does matter. Again, like firewall rules, once a filter
>> matches the incoming HTTP request it will trigger the actions specified.
>> With this being said, if you want to "whitelist" an IP address to allow
>> this
>> client access, then add in a rule like this near the top of your
>> Mod_Security directives -
>>  SecFilterSelective REMOTE_HOST "^192\.168\.1\.100$" allow,pass
>>  Add this just below the mod_security general directives (such as
>> SecFilterEngine, etc....).
>>  That should do it.
>>
>> --
>> Ryan C. Barnett
>> Web Application Security Consortium (WASC) Member
>> CIS Apache Benchmark Project Lead
>> SANS Instructor: Securing Apache
>> GCIA, GCFA, GCIH, GSNA, GCUX, GSEC
>> Author: Preventing Web Attacks with Apache
>>   On 10/25/05, Naveen Amradi <na...@gm...> wrote:
>> >
>> > HI All,
>> >
>> > Newbie of ModSecurity. I was wondering is there a way to
>> > open up rules for certain ip addresses.
>> >
>> > Thanks a gazillion!
>> > Naveen
>>
>>
>>
>>
>>
>

Re: [mod-security-users] Filter Rules by IP Address

[Naveen A. <na...@gm...>]

HI Ryan,
  I appreciate your quick response and help.
 I am still not able to configure it properly.
Just like u said i added

SecFilterSelective REMOTE_HOST "^192\.168\.0\.94$" allow,pass
 I tried putting it right below the SecFilterEnging and other places too.
And i am getting this error in the log file. Maybe i am missing something.

UNIQUE_ID: xv7hbIJKVE8AAFQjVXYAAAAE
Request: 196.168.0.94 <http://196.168.0.94> - - [25/Oct/2005:11:39:02
--0500] "GET /study_abroad/TMPzad38oxcyx.htm HTTP/1.1" 403 232
Handler: server-parsed
----------------------------------------
GET /study_abroad/TMPzad38oxcyx.htm HTTP/1.1
User-Agent: Contribute
Host: www.outreach.olemiss.edu <http://www.outreach.olemiss.edu/>
Cookie:
phpbb2mysql_data=3Da%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bs%3A0%3A%22%22%3=
Bs%3A6%3A%22userid%22%3Bs%3A1%3A%223%22%3B%7D;
PHPSESSID=3D59ded4be35990378545d942f2a11c0f9
mod_security-message: Access denied with code 403. Pattern match "/tmp" at
THE_REQUEST
mod_security-action: 403

HTTP/1.1 403 Forbidden
Content-Length: 232

Could you help me?And Just for info i am trying to configure Macromedia
Contribute.

Thanks a lot,

naveen

 On 10/25/05, Ryan Barnett <rcb...@gm...> wrote:
>
> Naveen,
> Think of the mod_security directives (SecFilter|SecFilterSelective) as yo=
u
> would firewall rules in that the order in which they are specified in the
> httpd.conf file does matter. Again, like firewall rules, once a filter
> matches the incoming HTTP request it will trigger the actions specified.
> With this being said, if you want to "whitelist" an IP address to allow t=
his
> client access, then add in a rule like this near the top of your
> Mod_Security directives -
>  SecFilterSelective REMOTE_HOST "^192\.168\.1\.100$" allow,pass
>  Add this just below the mod_security general directives (such as
> SecFilterEngine, etc....).
>  That should do it.
>
> --
> Ryan C. Barnett
> Web Application Security Consortium (WASC) Member
> CIS Apache Benchmark Project Lead
> SANS Instructor: Securing Apache
> GCIA, GCFA, GCIH, GSNA, GCUX, GSEC
> Author: Preventing Web Attacks with Apache
>   On 10/25/05, Naveen Amradi <na...@gm...> wrote:
> >
> > HI All,
> >
> > Newbie of ModSecurity. I was wondering is there a way to
> > open up rules for certain ip addresses.
> >
> > Thanks a gazillion!
> > Naveen
>
>
>
>
>