mod-security-users — General discussion about mod_security

Re: [mod-security-users] 1.9b4 SecFilterRemove question

[Ivan R. <iv...@we...>]

Rude Yak wrote:
> Hi, folks.  I've been playing with the latest-and-greatest and trying to apply
> it to a situation I'm dealing with on one of my servers.  Specifically, I have
> a multi-purpose webserver, part of which hosts a weblog.  Whereas, for the
> majority of the web server, I can afford to have relatively tight input
> filtering, it would be nice to be less restrictive for the weblog.  To wit, I'm
> trying the following in my httpd.conf:
>
> ...
 >
> <Location ~ "^/blog/">
> SecFilterRemove 1001
> </Location>

   You are using the directive correctly. Unfortunately, I broke
   SecFilterImport and SecFilterRemove in 1.9dev4. They are fixed now
   and will correctly in the forthcoming Release Candidate 1 (today).


> Obviously I'm wrong :-)

   It was not obvious to me ;)

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Fedora, Mod-Security, PID issues

[Andras G. <an...@an...>]

Hi,

Some libs and the required directory must exists within the chroot. It wo=
uld be good to know if the=20
apache is chrooted with modsec when the pidfile and other files created o=
r checked. For instance=20
FreeBSD rc.sub system would search in /var/run not $chroot/var/run.


Frank =EDrta:

> Sorry if posted twice. Not sure if mailing from website posts here to.
>=20
> I am new to mod_security and trying to setup the chroot function in the=
=20
> module. Once I configure mod_security in Apache 2, I get cannot find=20
> httpd.pid error. I saw an earlier post for this which points to missing=
=20
> directories.
>=20
> Does anyone out there have setup info for fedora 4 or previous fedora=20
> versions? What directories I need and so forth. It is pretty urgent=20
> situation.
>=20
> Thanks
>=20
>=20
>=20
> -------------------------------------------------------
> This SF.Net email is sponsored by:
> Power Architecture Resource Center: Free content, downloads, discussion=
s,
> and more. http://solutions.newsforge.com/ibmarch.tmpl
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>=20

[mod-security-users] Fedora, Mod-Security, PID issues

[Frank <hum...@ho...>]

Sorry if posted twice. Not sure if mailing from website posts here to.

I am new to mod_security and trying to setup the chroot function in the 
module. Once I configure mod_security in Apache 2, I get cannot find 
httpd.pid error. I saw an earlier post for this which points to missing 
directories.

Does anyone out there have setup info for fedora 4 or previous fedora 
versions? What directories I need and so forth. It is pretty urgent 
situation.

Thanks

[mod-security-users] whitelisting XSS/HTML-injection defense

[Rude Y. <ru...@ya...>]

I've read the portion of the doc that covers XSS, i.e.

<Location /cms/article-update.php>
SecFilterInheritance Off
# other filters here ...
SecFilterSelective "ARGS|!ARG_body" "<.+>"
</Location>

What I would like to know is if anyone has gotten more sophisticated with XSS
defense and tried to whitelist certain tags.  I'm trying to set up a policy
that will allow a few harmless tags (let's say, for argument's sake, that <B>
and <PRE> are considered harmless) but not others.  This has proven to be quite
a challenge.  So far, I've come up with:

SecFilterSelective "ARGS|!ARG_blog-text" "<.+>" id:1501
SecFilterSelective "ARG_blog-text" "<" chain,id:1502
SecFilterSelective "ARG_blog-text" "!<([Bb]|[Pp][Rr][Ee])([ >])" id:1503
SecFilterForceByteRange 9 126

But this (needless to say) doesn't work because a QUERY_STRING that has

blog-text=Abc+def+<B>

will still find the "Abc+def" matching <([Bb]|[Pp][Rr][Ee])([ >]) and be
blocked by the filter.  Has anyone come up with a clever way to whitelist input
this way?  I'm going to keep trying but I'm feeling close-to-stumped right now
:-)

Erick.


		
__________________________________ 
Yahoo! Mail - PC Magazine Editors' Choice 2005 
http://mail.yahoo.com

[mod-security-users] 1.9b4 SecFilterRemove question

[Rude Y. <ru...@ya...>]

Hi, folks.  I've been playing with the latest-and-greatest and trying to apply
it to a situation I'm dealing with on one of my servers.  Specifically, I have
a multi-purpose webserver, part of which hosts a weblog.  Whereas, for the
majority of the web server, I can afford to have relatively tight input
filtering, it would be nice to be less restrictive for the weblog.  To wit, I'm
trying the following in my httpd.conf:

<IfModule mod_security.c>

# Defaults
SecFilterEngine DynamicOnly
SecFilterScanPOST On
SecFilterInheritance On
SecFilterCheckCookieFormat On
SecFilterNormalizeCookies On
SecFilterCheckURLEncoding On
SecFilterCheckUnicodeEncoding On
SecFilterForceByteRange 32 122
SecFilterSelective "ARGS" "!^[A-Za-z0-9.&/?@_%=:;, *+-]*$" id:1001
SecFilterSelective COOKIES_VALUES "!^[A-Za-z0-9&./?@_%=:;, !-]*$" id:1002

</IfModule>

Ideally, what I'd like to add is this:

<Location ~ "^/blog/">
SecFilterRemove 1001
</Location>

Now, ignoring for the moment the wisdom of turning off input validation
altogether (I'll have another post on that later ;-), I'm wondering if this
construct should work the way I expect.  Reason is, with this configuration, I
am stymied by the exact SecFilterSelective statement I'm trying to un-inherit:

[01/Oct/2005:22:23:35 --0500] [mysite/sid#2193f8][rid#40cb88][/blog/oncall/][1]
Access denied with code 406. Pattern match "!^[A-Za-z0-9.&/?@_%=:;, *+-]*$" at
POST_PAYLOAD [id "1001"]

I have read the note in the 1.9b4 docs about Apache contexts and how they're
merged, etc., but I'm thinking I have a simple enough configuration that what I
have above should work.  Obviously I'm wrong :-)  Can anyone on the list help
set me straight?

Much thanks in advance,

Erick.


		
__________________________________ 
Yahoo! Mail - PC Magazine Editors' Choice 2005 
http://mail.yahoo.com

[mod-security-users] mod_security stats

[Justin G. <web...@sw...>]

hi,

anyone has a script to parse the audit log in order to get stats like what 
are the highest blocking rules (detecting false alarms) and such.

It could be nice to see some summaries of what it's doing.

thanks,
	Justin

Re: [mod-security-users] Chroot and worker MPM?

[Ivan R. <iv...@we...>]

> Jeff Tharp wrote:
> 
>> I'm getting a weird error when configuring chroot using SecChrootDir and
>> using the worker MPM.  Hoping someone else has ran across this before
>> and has some ideas.
>>
>> Versions are as follows: Red Hat Enterprise Linux v4, Apache 2.0.54,
>> ModSecurity 1.8.7 
> 
>  >
>  > ...
>  >
> 
>> libgcc_s.so.1 must be installed for pthread_cancel to work
>> [Thu Jul 07 17:07:11 2005] [notice] child pid 3428 exit signal Aborted
>> (6)


Ivan Ristic wrote:
> I've made a TODO note for myself to see if this hack is portable at
> all, or whether it can be #ifdef-ed. Getting it to work would be
> really nice, because the internal chroot measure would work really
> well for a multithreaded Apache working as a reverse proxy only.

   I did add a hack to 1.9dev4. If you compile with -DWORKER_HACK it
   will work just fine. But just after I committed the change to the
   CVS I realised there is a much more elegant solution - LoadFile.

   Simply add:

   LoadFile /lib/libgcc_s.so.1

   to the configuration file. If this works for you I will remove the
   WORKER_HACK stuff from the code. Let me know.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] deflate

[Philippe B. <pbo...@ci...>]

Re,

>   SecFilterOutputMimeTypes "(null) text/plain text/html"
>
>   would make sure images are untouched. In fact, this is the default
>   value in 1.9.

All right, got it, nice feature indeed.

Still on my reverse proxy, if I "SetInputFilter DEFLATE", will 
mod_security filter things after the html is ungzipped or does the 
mod_security filtering happen before...

Since I don't control the webservers that are behind the reverse 
proxy and that I filter their output...


Sincerely,

Philippe Bourcier

Re: [mod-security-users] sec_filter_out: Invalid Content-Length: 0

[Ivan R. <iv...@we...>]

Philippe Bourcier wrote:
> 
>>   But, mod_security should look at the bodies of GIF images, shouldn't
>>   it?
> 
> I don't think so... and why would that change the content-length anyway ?

   It wouldn't, read on...


>>  Are you using SecFilterOutputMimeTypes to restrict output
>>   filtering by MIME type?
> 
> No, I don't need this, especially while filtering the output.

   If you are not using it your proxy is wasting CPU cycles working
   through every image you serve. And you may encounter false positives
   too.

   Something like:

   SecFilterOutputMimeTypes "(null) text/plain text/html"

   would make sure images are untouched. In fact, this is the default
   value in 1.9.


>>  If you want to try something from the 1.9 branch, 1.9 Release
>>   Candidate will be ready on Monday.
> 
> 
> Nice, I'll install it when it's released.

   Great. You'll see a message on this list when it is released.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] sec_filter_out: Invalid Content-Length: 0

[Philippe B. <pbo...@ci...>]

Re,

>>HTTP/1.1 200 OK
>>Server: Microsoft-IIS/5.0
>>Date: Tue, 27 Sep 2005 09:15:47 GMT
>>Content-Type: image/gif
>>Accept-Ranges: bytes
>>Last-Modified: Sun, 27 Mar 2005 00:01:15 GMT
>>ETag: "d0cf6f186c32c51:905"
>>Content-Length: 76
>>GIF89 [ gif_content... ]=C7=F2L=D7=B6\;HTTP/1.1 400 Bad Request
>>Server: Microsoft-IIS/5.0
>>Date: Tue, 27 Sep 2005 09:15:47 GMT
>>Content-Type: text/html
>>Content-Length: 80
>
>   This looks like the bug I just fixed a few days ago. In fact, I am
>   still waiting for the confirmation on that one. I can include the
>   fix for this in the version I wrap for you to test and you'll let
>   me know.
>
>   But, mod_security should look at the bodies of GIF images, shouldn't
>   it?

I don't think so... and why would that change the content-length anyway ?

>  Are you using SecFilterOutputMimeTypes to restrict output
>   filtering by MIME type?

No, I don't need this, especially while filtering the output.

>>Why does it say "content-length: 0" while none=20
>>of these content-length are equal to 0.
>   It's a bug in mod_security. It is legal (according to the HTTP spec)
>   to have a Content-Length of zero.

OK

>>Is there a way to disable this warning other than by modifying the code ?
>
>   No, there isn't. But that's not the problem because I will modify
>   the code. You did not mention the version you are using: is it
>   1.8.7?

Yes, stable.

>  If you want to try something from the 1.9 branch, 1.9 Release
>   Candidate will be ready on Monday.

Nice, I'll install it when it's released.


Sincerely,

Philippe Bourcier

Re: [mod-security-users] sec_filter_out: Invalid Content-Length: 0

[Ivan R. <iv...@we...>]

Philippe Bourcier wrote:
> 
> Hi folks,
> 
> On a reverse proxy I've setup, I'm getting tons (like 10/sec) of :
> mod_security: sec_filter_out: Invalid Content-Length: 0
> ...errors in my logs.
 >
 > ...
> 
> OK... but also, a bit more strange (this is the output of a GET 
> /image/thing.gif) :
> (yes, there are 2 answers at the same time and the image is displayed)
> 
> HTTP/1.1 200 OK
> Server: Microsoft-IIS/5.0
> Date: Tue, 27 Sep 2005 09:15:47 GMT
> Content-Type: image/gif
> Accept-Ranges: bytes
> Last-Modified: Sun, 27 Mar 2005 00:01:15 GMT
> ETag: "d0cf6f186c32c51:905"
> Content-Length: 76
> 
> GIF89 [ gif_content... ]ÇòL׶\;HTTP/1.1 400 Bad Request
> Server: Microsoft-IIS/5.0
> Date: Tue, 27 Sep 2005 09:15:47 GMT
> Content-Type: text/html
> Content-Length: 80

   This looks like the bug I just fixed a few days ago. In fact, I am
   still waiting for the confirmation on that one. I can include the
   fix for this in the version I wrap for you to test and you'll let
   me know.

   But, mod_security should look at the bodies of GIF images, shouldn't
   it? Are you using SecFilterOutputMimeTypes to restrict output
   filtering by MIME type?


> Why does it say "content-length: 0" while none of these content-length 
> are equal to 0.

   It is, the first one:

 > HTTP/1.0 302 Moved Temporarily
 > Server: Microsoft-IIS/5.0
 > [...]
 > Location: http://blah/expired.htm
 > Content-Length: 0
 > [...]
 > Connection: close

   It's a bug in mod_security. It is legal (according to the HTTP spec)
   to have a Content-Length of zero.


> Is there a way to disable this warning other than by modifying the code ?

   No, there isn't. But that's not the problem because I will modify
   the code. You did not mention the version you are using: is it
   1.8.7? If you want to try something from the 1.9 branch, 1.9 Release
   Candidate will be ready on Monday.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] sec_filter_out: Invalid Content-Length: 0

[Philippe B. <pbo...@ci...>]

Hi folks,

On a reverse proxy I've setup, I'm getting tons (like 10/sec) of :
mod_security: sec_filter_out: Invalid Content-Length: 0
...errors in my logs.

Here is the only interesting parts in my=20
configuration that cause is causing these messages :
SecFilterScanOutput On (yes, I scan output for ADODB errors (for=
 example)...)

Here is the kind of headers that cause this :

HTTP/1.0 302 Moved Temporarily
Server: Microsoft-IIS/5.0
[...]
Location: http://blah/expired.htm
Content-Length: 0
[...]
Connection: close

OK... but also, a bit more strange (this is the=20
output of a GET /image/thing.gif) :
(yes, there are 2 answers at the same time and the image is displayed)

HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Date: Tue, 27 Sep 2005 09:15:47 GMT
Content-Type: image/gif
Accept-Ranges: bytes
Last-Modified: Sun, 27 Mar 2005 00:01:15 GMT
ETag: "d0cf6f186c32c51:905"
Content-Length: 76

GIF89 [ gif_content... ]=C7=F2L=D7=B6\;HTTP/1.1 400 Bad Request
Server: Microsoft-IIS/5.0
Date: Tue, 27 Sep 2005 09:15:47 GMT
Content-Type: text/html
Content-Length: 80

<html><head><title>Error</title></head><body>Incorrect=20
Parameter. </body></html>

Why does it say "content-length: 0" while none of=20
these content-length are equal to 0.

Is there a way to disable this warning other than by modifying the code ?


Sincerely,

Philippe Bourcier

Re: [mod-security-users] Another error installing mod_security (snapshot) on Apache 2.1.7 beta

[Ivan R. <iv...@we...>]

ro so wrote:
 >

   Your first attempt was probably with 1.9dev3 earlier?


> /usr/local/apache2/bin/apxs -cia mod_security.c
> /usr/local/apache2/build/libtool --silent --mode=compile gcc 
> -prefer-pic   -DLINUX=2 -D_REENTRANT -D_GNU_SOURCE -D_LARGEFILE64_SOURCE 
> -g -O2 -pthread -I/usr/local/apache2/include  
> -I/usr/local/apache2/include   -I/usr/local/apache2/include 
> -I/usr/local/include  -c -o mod_security.lo mod_security.c && touch 
> mod_security.slo
> mod_security.c: In function `is_response_status_relevant':
> mod_security.c:4905: error: `REG_NOMATCH' undeclared (first use in this 
> function)
> mod_security.c:4905: error: (Each undeclared identifier is reported only 
> once
> mod_security.c:4905: error: for each function it appears in.)
> apxs:Error: Command failed with rc=65536

   Use this against 1.9dev4, or the snapshot you have (they are
   the same anyway).

--- mod_security.c      19 Sep 2005 09:22:16 -0000      1.269
+++ mod_security.c      22 Sep 2005 07:39:43 -0000
@@ -43,6 +43,7 @@
  #define REG_EXTENDED AP_REG_EXTENDED
  #define REG_NOSUB AP_REG_NOSUB
  #define REG_ICASE AP_REG_ICASE
+#define REG_NOMATCH AP_REG_NOMATCH
  #endif

  #include "ap_config.h"

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Another error installing mod_security (snapshot) on Apache 2.1.7 beta

[ro so <apa...@gm...>]

/usr/local/apache2/bin/apxs -cia mod_security.c
/usr/local/apache2/build/libtool --silent --mode=3Dcompile gcc -prefer-pic
-DLINUX=3D2 -D_REENTRANT -D_GNU_SOURCE -D_LARGEFILE64_SOURCE -g -O2 -pthrea=
d
-I/usr/local/apache2/include -I/usr/local/apache2/include
-I/usr/local/apache2/include -I/usr/local/include -c -o mod_security.lo
mod_security.c && touch mod_security.slo
mod_security.c: In function `is_response_status_relevant':
mod_security.c:4905: error: `REG_NOMATCH' undeclared (first use in this
function)
mod_security.c:4905: error: (Each undeclared identifier is reported only
once
mod_security.c:4905: error: for each function it appears in.)
apxs:Error: Command failed with rc=3D65536

[mod-security-users] mod_security fails to compile with Apache 2.1.7 beta

[ro so <apa...@gm...>]

Trying to compile mod_security (both versions) with Apache 2.1.7 beta fails
with this:
 /usr/local/apache2/bin/apxs -cia mod_security.c
/usr/local/apache2/build/libtool --silent --mode=3Dcompile gcc -prefer-pic
-DLINUX=3D2 -D_REENTRANT -D_GNU_SOURCE -D_LARGEFILE64_SOURCE -g -O2 -pthrea=
d
-I/usr/local/apache2/include -I/usr/local/apache2/include
-I/usr/local/apache2/include -I/usr/local/include -c -o mod_security.lo
mod_security.c && touch mod_security.slo
mod_security.c:284: error: syntax error before "regex_t"
mod_security.c:284: warning: no semicolon at end of struct or union
mod_security.c:291: error: syntax error before '}' token
mod_security.c:291: warning: data definition has no type or storage class
mod_security.c:450: error: syntax error before "signature"
mod_security.c:461: error: syntax error before "signature"
mod_security.c: In function `sec_create_dir_config':
mod_security.c:1375: error: syntax error before ')' token
mod_security.c: At top level:
mod_security.c:2274: error: syntax error before "signature"
mod_security.c: In function `check_single_signature':
mod_security.c:2283: error: `sig' undeclared (first use in this function)
mod_security.c:2283: error: (Each undeclared identifier is reported only
once
mod_security.c:2283: error: for each function it appears in.)
mod_security.c:2284: error: `msr' undeclared (first use in this function)
mod_security.c: In function `sec_check_all_signatures':
mod_security.c:2576: error: `signatures' undeclared (first use in this
function)
mod_security.c:2583: error: syntax error before ')' token
mod_security.c: At top level:
mod_security.c:2838: error: syntax error before "signature"
mod_security.c: In function `check_sig_against_string':
mod_security.c:2839: error: `msr' undeclared (first use in this function)
mod_security.c:2843: error: `_sig' undeclared (first use in this function)
mod_security.c:2848: error: `s' undeclared (first use in this function)
mod_security.c:2859: error: `var_type' undeclared (first use in this
function)
mod_security.c: In function `cmd_filter':
mod_security.c:3234: error: `sig' undeclared (first use in this function)
mod_security.c:3243: error: `REG_EXTENDED' undeclared (first use in this
function)
mod_security.c:3243: error: `REG_ICASE' undeclared (first use in this
function)
mod_security.c:3243: error: `REG_NOSUB' undeclared (first use in this
function)
mod_security.c:3264: error: syntax error before ')' token
mod_security.c: In function `cmd_filter_selective':
mod_security.c:3295: error: `sig' undeclared (first use in this function)
mod_security.c:3310: error: `REG_EXTENDED' undeclared (first use in this
function)
mod_security.c:3310: error: `REG_ICASE' undeclared (first use in this
function)
mod_security.c:3310: error: `REG_NOSUB' undeclared (first use in this
function)
mod_security.c:3435: error: syntax error before ')' token
mod_security.c: In function `sec_filter_out':
mod_security.c:4877: error: `signatures' undeclared (first use in this
function)
mod_security.c:4880: error: syntax error before ')' token
apxs:Error: Command failed with rc=3D65536

[mod-security-users] [ANNOUNCE] ModSecurity 1.9dev4 has been released

[Ivan R. <iv...@we...>]

ModSecurity 1.9dev3 has been released. It is available for immediate
download from:

     http://www.modsecurity.org/download/

This is an intermediary release on the road to a stable 1.9.x.

It is now possible to enable or disable ModSecurity dynamically, on a
per-request basis. Action rev (short for revision) was added to allow
you to differentiate between versions of the same rule. Directive
SecFilterActionsRestricted was added to restrict what can appear in
the per-rule action lists (useful for adding third-party rules to the
configuration in a controlled manner). The SecFilterDefaultActions
directive can now appear more than once in the same configuration
context, making it easy to group rules according to how they react to
attacks. Many smaller bug fixes were made.


About ModSecurity
-----------------
ModSecurity is a web application firewall, designed to protect
vulnerable applications and reject manual and automated attacks.
It is an open source intrusion detection and prevention system. It
can work embedded in Apache, or as a standalone security device when
configured to work as part of an Apache-based reverse proxy.

Optionally, ModSecurity creates application audit logs, which contain
the full request body in addition to all other details. Requests are
filtered using regular expressions. Some of the things possible are:

   * Apply filters against any part of the request (URI,
     headers, either GET or POST)
   * Apply filters against individual parameters
   * Reject SQL injection attacks
   * Reject Cross site scripting attacks
   * Store the files uploaded through the web server, and have them
     checked by external scripts

With few general rules ModSecurity can protect from both known
and unknown vulnerabilities. A Java version is also available, which
works with any Servlet 2.3 compatible web server.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Re: mod_security in .htaccess files opinions?

[Ivan R. <iv...@we...>]

Chris wrote:
>  <harry_b <at> mm.st> writes:
> 
> 
>>
>>Hi,
>>
>>I think its a good thing to be able to configure it in .htaccess files. 
>>This comes in handy if you have to disable it for certain apps, e.g. 
>>phpMySQL or some documentation system where I e.g. want to document 
>>administration steps which contain SQL statements and other such kinda 
>>admin tools.
>>
>>Just my 2 cents.
>>
>>Harry
>>
>>--On Monday, September 27, 2004 19:34:20 +0100 Ivan Ristic 
>><ivanr <at> webkreator.com> wrote:
> 
> Well it should be made so it cant overide, what happens if someone signs up to a 
> webhost that runs mod_security and decides to overide it to help them break into 
> the server, kind of defeats the purpose if a normal user can just disable it.

   There is plenty you can do if you are concerned about that kind of
   thing. Personally I don't think a non-admin should get to use
   mod_security, mostly because there is a possibility to significantly
   slow down the web server through misuse. From a security point of
   view, if someone is in a position to control the .htacces files then
   he probably already has more privileges than mod_security could give
   him.

   Having said that, here are your options:

   1. Disable usage of mod_security in .htaccess files altogether
      (by compiling it with -DDISABLE_HTACCESS_CONFIG)

   2. mod_security won't work in .htaccess files unless the user has
      "AllowOverride Options".

   3. In 1.9 it is possible to mark rules as mandatory (either all
      rules in a context or individual rules via the "mandatory"
      action) so that they cannot be removed from the child contexts.

      But this was not meant as a security feature, it was meant only
      to guard against accidental rule override.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Re: =?utf-8?b?bW9kX3NlY3VyaXR5?= in .htaccess files opinions?

[Chris <chr...@ms...>]

 <harry_b <at> mm.st> writes:

> 
> 
> Hi,
> 
> I think its a good thing to be able to configure it in .htaccess files. 
> This comes in handy if you have to disable it for certain apps, e.g. 
> phpMySQL or some documentation system where I e.g. want to document 
> administration steps which contain SQL statements and other such kinda 
> admin tools.
> 
> Just my 2 cents.
> 
> Harry
> 
> --On Monday, September 27, 2004 19:34:20 +0100 Ivan Ristic 
> <ivanr <at> webkreator.com> wrote:



Well it should be made so it cant overide, what happens if someone signs up to a 
webhost that runs mod_security and decides to overide it to help them break into 
the server, kind of defeats the purpose if a normal user can just disable it.

RE: [mod-security-users] Modsecurity Static Build

[Jeff T. <jt...@es...>]

I used the proxy folder because it seemed logical, since I was building
Apache to use as a reverse proxy, which of course is a great place to
add in mod_security. :-)=20

> -----Original Message-----
> From: Ivan Ristic [mailto:iv...@we...]=20
> Sent: Friday, September 09, 2005 12:46 PM
> To: Jeff Tharp
> Cc: mod...@li...; d.b...@ge...
> Subject: Re: [mod-security-users] Modsecurity Static Build
>=20
> Jeff Tharp wrote:
> > Not sure if this is the best way, but here's what I found works for
> > compiling mod_security in statically for Apache 2 (I was=20
> building Apache
> > 2.0.54 in this case):
> >=20
> >>Apache is custom compiled with ModSecurity statically=20
> >>linked.  To do this, I copied the mod_security.c file to the=20
> >>modules/proxy folder in the extracted source code for Apache,=20
> >>then added the following flags to configure (for Apache):
> >>	  --enable-security --with-module=3Dproxy:mod_security.c
>=20
>    Thanks for that Jeff,
>=20
>    I knew someone wrote about an easy way to compile mod_security
>    statically with Apache 2 but I couldn't find the email. By
>    placing mod_security into an existing module directory you
>    are taking advantage of the existing config.m4 and Makefile.in
>    files. Much better than what I did :)
>=20
> --=20
> Ivan Ristic
> Apache Security (O'Reilly) - http://www.apachesecurity.net
> Open source web application firewall - http://www.modsecurity.org
>=20

Re: [mod-security-users] Modsecurity Static Build

[Ivan R. <iv...@we...>]

Jeff Tharp wrote:
> Not sure if this is the best way, but here's what I found works for
> compiling mod_security in statically for Apache 2 (I was building Apache
> 2.0.54 in this case):
> 
>>Apache is custom compiled with ModSecurity statically 
>>linked.  To do this, I copied the mod_security.c file to the 
>>modules/proxy folder in the extracted source code for Apache, 
>>then added the following flags to configure (for Apache):
>>	  --enable-security --with-module=proxy:mod_security.c

   Thanks for that Jeff,

   I knew someone wrote about an easy way to compile mod_security
   statically with Apache 2 but I couldn't find the email. By
   placing mod_security into an existing module directory you
   are taking advantage of the existing config.m4 and Makefile.in
   files. Much better than what I did :)

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Modsecurity Static Build

[Jeff T. <jt...@es...>]

Not sure if this is the best way, but here's what I found works for
compiling mod_security in statically for Apache 2 (I was building Apache
2.0.54 in this case):

> Apache is custom compiled with ModSecurity statically=20
> linked.  To do this, I copied the mod_security.c file to the=20
> modules/proxy folder in the extracted source code for Apache,=20
> then added the following flags to configure (for Apache):
> 	  --enable-security --with-module=3Dproxy:mod_security.c

Hope that helps,
Jeff

Re: [mod-security-users] Apache2 Mod Sec Static

[Ivan R. <iv...@we...>]

Brümmer wrote:
> Hello,
> Is there a change to build Mod Security Staticaly to Apache 2 or will 
> this work only for Apache 2

   Or will static compilation work only for Apache 1?

   To integrate mod_security into Apache 2 build system:

   $ cd <apache-source>
   $ mkdir -p modules/security
   $ cd modules/security
   $ cp <modsecurity-source>/apache2/mod_security.c .
   $ echo "include \$(top_srcdir)/build/special.mk" > Makefile.in
   $ echo -e "APACHE_MODPATH_INIT(security)\nAPACHE_MODULE(security, 
HTTP Security, , , no)\nAPACHE_MODPATH_FINISH\n" > config.m4
   $ cd <apache-source>

   From here you can integrate mod_security with Apache using
   buildconf:

   $ ./buildconf

   Then configure Apache and enable mod_security as any other
   module:

   $ ./configure --enable-security

   Even if you don't have buildconf you can still use

   $ ./configure --with-module=security

   P.S. I will make config.m4 and Makefile.in a part of 1.9.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] xmlrpc.php

[<mi...@go...>]

Yes.  I have rules to just block the xmlrpc attacks.

http://www.gotroot.com/modsecurity+rules


-----Original Message-----

From:  Hugh Beaumont <hbe...@ya...>
Subj:  [mod-security-users] xmlrpc.php
Date:  Thu Sep 8, 2005 5:17 pm
Size:  1K
To:  mod...@li...

Has anyone came up with a good rule for blocking xmlprc.php (used by drupal and wordpress I
believe among others). It has some exploits for it.

I am trying to get a good ruleset to block the file but still allow access for users who have
updated their file to a good/patched version.

Any ideas? I'm curious if anyone else has put an effective block on it. 


	
		
______________________________________________________
Click here to donate to the Hurricane Katrina relief effort.
http://store.yahoo.com/redcross-donate3/


-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
_______________________________________________
mod-security-users mailing list
mod...@li...
https://lists.sourceforge.net/lists/listinfo/mod-security-users

[mod-security-users] xmlrpc.php

[Hugh B. <hbe...@ya...>]

Has anyone came up with a good rule for blocking xmlprc.php (used by drupal and wordpress I
believe among others). It has some exploits for it.

I am trying to get a good ruleset to block the file but still allow access for users who have
updated their file to a good/patched version.

Any ideas? I'm curious if anyone else has put an effective block on it. 


	
		
______________________________________________________
Click here to donate to the Hurricane Katrina relief effort.
http://store.yahoo.com/redcross-donate3/

[mod-security-users] Modsecurity Static Build

[<d.b...@ge...>]

Hello,
Is there a change to build Mod Security Staticaly to Apache 2 or will =
this work only for Apache 2
=20
Much thanks for your Help
Dirk