mod-security-users — General discussion about mod_security

RE: [mod-security-users] Chroot and worker MPM?

[Jeff T. <jt...@es...>]

Ivan,
Great, Thanks. Let me know if you'd like my help in testing this.  I =
agree that the multi-threaded MPM and ModSecurity's internal chroot =
should make for a good combination.

Jeff

-----Original Message-----
From: Ivan Ristic [mailto:iv...@we...]=20
Sent: Monday, July 11, 2005 5:15 AM
To: Jeff Tharp
Cc: mod...@li...
Subject: Re: [mod-security-users] Chroot and worker MPM?

Jeff Tharp wrote:
> I'm getting a weird error when configuring chroot using SecChrootDir=20
> and using the worker MPM.  Hoping someone else has ran across this=20
> before and has some ideas.
>=20
> Versions are as follows: Red Hat Enterprise Linux v4, Apache 2.0.54,=20
> ModSecurity 1.8.7
 >
 > ...
 >
> libgcc_s.so.1 must be installed for pthread_cancel to work [Thu Jul 07 =

> 17:07:11 2005] [notice] child pid 3428 exit signal Aborted
> (6)

   I can confirm the same happens with stock 2.0.54 on Fedora Core 1,
   although my Apache does not segfault.

   It appears that the required library libgcc_s.so.1 is not loaded
   before chroot takes place (and it certainly cannot be loaded
   afterwards).

   Moving the library into jail worked for me. I placed it into
   ~/apache2/lib. What also worked is an attempt to load the library
   before chroot takes place, from mod_security itself (by creating
   a thread that does nothing.)

   I've made a TODO note for myself to see if this hack is portable at
   all, or whether it can be #ifdef-ed. Getting it to work would be
   really nice, because the internal chroot measure would work really
   well for a multithreaded Apache working as a reverse proxy only.

--
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net Open source =
web application firewall - http://www.modsecurity.org

--
No virus found in this incoming message.
Checked by AVG Anti-Virus.
Version: 7.0.323 / Virus Database: 267.8.12/46 - Release Date: 7/11/2005
=20

--=20
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.323 / Virus Database: 267.8.12/46 - Release Date: 7/11/2005
=20

Re: [mod-security-users] open source web medical records security

[Ivan R. <iv...@we...>]

Dr James G Brown wrote:
> Has anyone had experience with using mod security in a web based 
> electronic patient record application. I am co developing an open source 
> system to be used in the uk possibly the NHS and need advice and 
> previous expertise in the security relating to web based 3 tier 
> applications especially regarding security any advice would be appreciated

   If you are developing a brand-new system then my suggestion would be
   to focus on the security of the application. Since modsecurity is
   a deployment-level tool, you only need to be concerned with it if
   you are also developing an example-architecture for the
   application. In such cases there two big advantages to using
   mod_security:

   1) You can monitor and record the HTTP traffic.

   2) When application faults are discovered (and they usually are),
      mod_security can be used as a temporary measure until the problem
      is fixed in the application.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] SecChrootDir & Apache Debug Mode

[Ivan R. <iv...@we...>]

Dan wrote:
> 
> I have a Apache 2.0.54 compiled with mod_security 1.8.7 and I'm using 
> SecChrootDir.  I'm trying to figure out why my PHP exec() call is 
> failing by using strace.

   That's probably because you have no /bin/sh in the jail. PHP requires
   it. In general, the internal chroot mechanism is unlikely to be
   good enough if you have a need to execute external binaries. In such
   cases you are much better off creating a proper jail.


> To run strace I'm starting Apache in debug 
> mode (-X) like below:
> 
> strace /usr/local/apache2/bin/httpd -X
> 
> However, SecChrootDir seems to have a problem when I start Apache in 
> debug mode.  I get the following error in the log.
> 
> [emerg] mod_security: chroot requested but not completed! Exiting.
> 
> This makes it slightly difficult to check my PHP script's exec() with 
> strace while in jail.  Is this a known problem?  Is there any work 
> arounds or alternative methods to get the debugging information I'm after?

   You are right, strace breaks the way the internal chroot mechanism
   works. However, that is only true in 1.8.x. I have been planning to
   make some changes to the internal chroot mechanism in 1.9 and,
   prompted by your email, I made them today. As a side effect of these
   changes strace will work with 1.9.x.

   Try this (for testing only, *not* for production systems):
http://cvs.sourceforge.net/viewcvs.py/*checkout*/mod-security/mod_security/apache2/mod_security.c

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Chroot and worker MPM?

[Ivan R. <iv...@we...>]

Jeff Tharp wrote:
> I'm getting a weird error when configuring chroot using SecChrootDir and
> using the worker MPM.  Hoping someone else has ran across this before
> and has some ideas.
> 
> Versions are as follows: Red Hat Enterprise Linux v4, Apache 2.0.54,
> ModSecurity 1.8.7 
 >
 > ...
 >
> libgcc_s.so.1 must be installed for pthread_cancel to work
> [Thu Jul 07 17:07:11 2005] [notice] child pid 3428 exit signal Aborted
> (6)

   I can confirm the same happens with stock 2.0.54 on Fedora Core 1,
   although my Apache does not segfault.

   It appears that the required library libgcc_s.so.1 is not loaded
   before chroot takes place (and it certainly cannot be loaded
   afterwards).

   Moving the library into jail worked for me. I placed it into
   ~/apache2/lib. What also worked is an attempt to load the library
   before chroot takes place, from mod_security itself (by creating
   a thread that does nothing.)

   I've made a TODO note for myself to see if this hack is portable at
   all, or whether it can be #ifdef-ed. Getting it to work would be
   really nice, because the internal chroot measure would work really
   well for a multithreaded Apache working as a reverse proxy only.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] SecChrootDir & Apache Debug Mode

[Dan <dm...@op...>]

I have a Apache 2.0.54 compiled with mod_security 1.8.7 and I'm using 
SecChrootDir.  I'm trying to figure out why my PHP exec() call is failing 
by using strace.  To run strace I'm starting Apache in debug mode (-X) like 
below:

strace /usr/local/apache2/bin/httpd -X

However, SecChrootDir seems to have a problem when I start Apache in debug 
mode.  I get the following error in the log.

[emerg] mod_security: chroot requested but not completed! Exiting.


This makes it slightly difficult to check my PHP script's exec() with 
strace while in jail.  Is this a known problem?  Is there any work arounds 
or alternative methods to get the debugging information I'm after?

Thanks!

-Dan

[mod-security-users] open source web medical records security

[Dr J. G B. <ja...@sp...>]

Has anyone had experience with using mod security in a web based 
electronic patient record application. I am co developing an open source 
system to be used in the uk possibly the NHS and need advice and 
previous expertise in the security relating to web based 3 tier 
applications especially regarding security any advice would be appreciated

kind regards

Dr James Brown
Sport + Orthopaedic Physician
Wakefield UK

[mod-security-users] Chroot and worker MPM?

[Jeff T. <jt...@es...>]

I'm getting a weird error when configuring chroot using SecChrootDir and
using the worker MPM.  Hoping someone else has ran across this before
and has some ideas.

Versions are as follows: Red Hat Enterprise Linux v4, Apache 2.0.54,
ModSecurity 1.8.7=20
(Note, Apache was configured with all modules as static, including
ModSecurity)

Relevant configuration bits from /etc/httpd/conf/httpd.conf:

<IfModule worker.c>
ServerLimit          1
ThreadLimit        300
StartServers         0
MaxClients         256
MinSpareThreads      1
MaxSpareThreads    256
ThreadsPerChild    256
MaxRequestsPerChild  0
</IfModule>

# Mod_Security Directives
<IfModule mod_security.c>
        SecChrootDir /var/www
        SecChrootLock /var/lock/modsecurity-chroot.lock
</IfModule>

When I start the server, I get the following in
/var/log/httpd/error_log:
[Thu Jul 07 17:07:08 2005] [info] Init: Initializing OpenSSL library
[Thu Jul 07 17:07:08 2005] [info] Init: Seeding PRNG with 0 bytes of
entropy
[Thu Jul 07 17:07:08 2005] [info] Init: Generating temporary RSA private
keys (512/1024 bits)
[Thu Jul 07 17:07:08 2005] [info] Init: Generating temporary DH
parameters (512/1024 bits)
[Thu Jul 07 17:07:08 2005] [warn] Init: Session Cache is not configured
[hint: SSLSessionCache]
[Thu Jul 07 17:07:08 2005] [info] Init: Initializing (virtual) servers
for SSL
[Thu Jul 07 17:07:08 2005] [info] Server: Apache/2.0.54, Interface:
mod_ssl/2.0.54, Library: OpenSSL/0.9.7a
[Thu Jul 07 17:07:08 2005] [notice] mod_security: chroot checkpoint #1
(pid=3D3424 ppid=3D3423)
[Thu Jul 07 17:07:08 2005] [info] Init: Initializing OpenSSL library
[Thu Jul 07 17:07:08 2005] [info] Init: Seeding PRNG with 0 bytes of
entropy
[Thu Jul 07 17:07:08 2005] [info] Init: Generating temporary RSA private
keys (512/1024 bits)
[Thu Jul 07 17:07:09 2005] [info] Init: Generating temporary DH
parameters (512/1024 bits)
[Thu Jul 07 17:07:09 2005] [info] Init: Initializing (virtual) servers
for SSL
[Thu Jul 07 17:07:09 2005] [info] Server: Apache/2.0.54, Interface:
mod_ssl/2.0.54, Library: OpenSSL/0.9.7a
[Thu Jul 07 17:07:09 2005] [notice] mod_security: chroot checkpoint #2
(pid=3D3425 ppid=3D1)
[Thu Jul 07 17:07:09 2005] [notice] mod_security: chroot successful,
path=3D/var/www
[Thu Jul 07 17:07:09 2005] [notice] Apache/2.0.54 configured -- resuming
normal operations
[Thu Jul 07 17:07:09 2005] [info] Server built: Jul  7 2005 01:21:09
[Thu Jul 07 17:07:09 2005] [debug] worker.c(1681): AcceptMutex: sysvsem
(default: sysvsem)
libgcc_s.so.1 must be installed for pthread_cancel to work
[Thu Jul 07 17:07:11 2005] [notice] child pid 3428 exit signal Aborted
(6)

A ps -ef shows that the child server process is not running:
[root@wyrmfire conf]# ps -ef | grep http
root      3425     1  7 17:07 ?        00:00:00 /usr/sbin/httpd
root      4725  2588  0 17:07 pts/0    00:00:00 grep http

Requests to the system (i.e. http://wyrmfire.esri.com/) also fail at
this point.

Commenting out the SecChrootDir directive or switching to the prefork
MPM both work fine.  So the trouble seems specific to running the worker
MPM with the SecChrootDir directive.  I tried copying the missing
libgcc_s.so.1 library (not the symbolic link :-) to inside my chroot
(i.e. /var/www/lib) but no dice.  It looks like Apache is trying to
spawn the child after the chroot instead of before--odd that the prefork
MPM does not show the same behavior.

Seems from my reading that there should a performance benefit from using
the worker MPM, so I'd appreciate any ideas on how to fix this.

Thanks,
Jeff Tharp
System Administrator
ESRI - Redlands, CA
http://www.esri.com

Re: [mod-security-users] toggle logging of post payload

[Ivan R. <iv...@we...>]

Thomas Berton wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hello,
> I'm trying to toggle the logging of the post data of a certain page.
> I'm using mod_security 1.8.7 with Apache 2.0.54. Config is below:
> 
> ~    AddHandler application/x-httpd-php .php
> ~    SecAuditEngine On
> ~    SecAuditLog logs/audit_log
> ~    SecFilterEngine On
> ~    SecFilterDefaultAction "allow,nolog"
> ~    SecFilterScanPOST On
> ~    SecFilterSelective SCRIPT_FILENAME "!(/index.php)$" "allow,log"
> 
> It appears the 'nolog' option does not function the way I had it in mind.
> I hope some of you can give me some pointers how to handle this. The
> actual problem is that certain post data contains high sensitive
> information that I wish to ban from the audit_log file.

   Try using "SecAuditEngine RelevantOnly" instead.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Modifying output buffers "on the fly"

[Ivan R. <iv...@we...>]

Daniel Fdez. Bleda wrote:
> Hello,
> 
> I'm trying to modify the content of the buffer send to the user during
> the sec_filter_out() function after having in the context the
> output_ptr and sizelen of data.
> 
> I've done it but when I write in the new allocated out_ptr using the
> apr_palloc function and write the new value in len field the user
> receives the HTML with the old length, so the page is not complete.
> 
> I'm doing this, at first stage, to strip comment code in HTML (libxml2
> adds some tabs, spaces and rets that make HTML occupy more space, but
> more readable) and later to have signatures to http request to the
> site in the HTML to avoid alterations in que request to the server.

   That's probably because there's an old Content-Length header
   present. Try to remove it from r->headers_out as you change the
   output.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Modifying output buffers "on the fly"

[Daniel F. B. <dfe...@is...>]

Hello,

I'm trying to modify the content of the buffer send to the user during
the sec_filter_out() function after having in the context the
output_ptr and sizelen of data.

I've done it but when I write in the new allocated out_ptr using the
apr_palloc function and write the new value in len field the user
receives the HTML with the old length, so the page is not complete.

I'm doing this, at first stage, to strip comment code in HTML (libxml2
adds some tabs, spaces and rets that make HTML occupy more space, but
more readable) and later to have signatures to http request to the
site in the HTML to avoid alterations in que request to the server.

Thanks,
--=20
_________________________________
Daniel Fern=E1ndez Bleda
Gerente de cuentas
e-Security Engineer
OPSA/OPST Trainer, CISSP
dfe...@is...

Internet Security Auditors, S.L.
c. Santander, 101. Edif. A. 2=BA 1=AA.
08030 Barcelona
Tel: 93 305 13 18
Fax: 93 278 22 48
www.isecauditors.com
          ____________________________________
Este mensaje y los documentos que, en su caso lleve anexos, pueden
contener informaci=F3n confidencial. Por ello, se informa a quien lo
reciba por error que la informaci=F3n contenida en el mismo es reservada
y su uso no autorizado est=E1 prohibido legalmente, por lo que en tal
caso le rogamos que nos lo comunique por la misma v=EDa o por tel=E9fono
(93 305 13 18), se abstenga de realizar copias del mensaje o remitirlo
o entregarlo a otra persona y proceda a borrarlo de inmediato.

En cumplimiento de la Ley Org=E1nica 15/1999 de 13 de diciembre de
protecci=F3n de datos de car=E1cter personal, Internet Security Auditors
S.L., le informa de que sus datos personales se han incluido en
ficheros informatizados titularidad de Internet Security Auditors
S.L., que ser=E1 el =FAnico destinatario de dichos datos, y cuya finalida=
d
exclusiva es la gesti=F3n de clientes y acciones de comunicaci=F3n
comercial, y de que tiene la posibilidad de ejercer los derechos de
acceso, rectificaci=F3n, cancelaci=F3n y oposici=F3n previstos en la ley
mediante carta dirigida a Internet Security Auditors, c. Santander,
101. Edif. A. 2=BA 1=AA, 08030 Barcelona, o v=EDa e-mail a la siguiente
direcci=F3n de correo: le...@is...

Re: [mod-security-users] freebsd apache 2.0 w/mod_sec sig11

[Ivan R. <iv...@we...>]

Andras Got wrote:
> Hi,
> 
> I got sig11 apache dies with mod_security, whenever a SecFilter rule is 
> matched. Is this normal?

   Andras and I exchanged a couple of emails privately. The segfault is
   harmless. It occurs if the audit log is enabled but the path to the
   log file is not defined. Disabling the audit engine, or defining the
   path fixes the issue.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] freebsd apache 2.0 w/mod_sec sig11

[Andras G. <an...@an...>]

Hi,

I got sig11 apache dies with mod_security, whenever a SecFilter rule is matched. Is this normal?

Apache 2.0.54 + mod_vhs + mod_security + mod_ssl installed (sig11 occurs both ssl and non-ssl 
requests). The operating system is FreeBSD 5.4-p2, the machine is a brand new Intel Xeon server.

[Fri Jul 01 18:55:53 2005] [error] [client $myip] mod_security: Access denied with code 404. Pattern 
match "(phpbb|awstats|pma|phpmyadmin)" at THE_REQUEST [hostname "myhost"] [uri 
"/sqladmin/css/phpmyadmin.css.php?lang=hu-iso-8859-2&js_frame=right&js_isDOM=1"] [unique_id 
fbAyT38AAAUAALwqmOMAAAAE]
[Fri Jul 01 18:55:54 2005] [notice] child pid 48170 exit signal Segmentation fault (11)

So it works normally but does a segfault at every match.

Thank you for help,
Andrej

Re: [mod-security-users] MSG and ID Actions

[Ivan R. <iv...@we...>]

Christian Martorella wrote:
>
>> Warning. Pattern match "111" at REQUEST_URI [id 1] [msg 2] [hostname 
>> "192.168.2.101"] [uri "/111"]
>>
> I was expecting the results in the auditlog, not in the debug log.  :)   
> i was never going to get them.

   You are right. The information should be present in the audit log
   too. I'll fix that.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] MSG and ID Actions

[Christian M. <cma...@is...>]

Ivan Ristic wrote:

> Christian Martorella wrote:
>
>> I'm trying to add more info to the logs, but it doesn't add anything,=20
>> here is my line:
>>
>> Modsecurity 1.9dev2:
>>
>> SecFilterSelective SCRIPT_FILENAME ".+\.inc"=20
>
>
>   You should use $ at the end of the regex ^
>
Right.. :)

>
> > "log,msg Includes,id 666"
>
>   And here you should really write "log,msg:Includes,id:666". The
>   syntax you used works for now, but I am planning to tighthen
>   the parser in one of the subsequent releases.
>
>
Fine, i changed that

>> I'm using RelevantOnly audit.
>>
>> Someone tried this feature?
>
>   I did, and this is=20

> what I get:
>
> Warning. Pattern match "111" at REQUEST_URI [id 1] [msg 2] [hostname=20
> "192.168.2.101"] [uri "/111"]
>

I was expecting the results in the auditlog, not in the debug log.  :)  =20
i was never going to get them.

Thanks again



--=20
_________________________________
Christian Martorella
e-Security Engineer
cma...@is...

Internet Security Auditors, S.L.
c. Santander, 101. Edif. A. 2=BA 1=AA.
08030 Barcelona
Tel: 93 305 13 18
Fax: 93 278 22 48
www.isecauditors.com
          ____________________________________
Este mensaje y los documentos que, en su caso lleve anexos, pueden
contener informaci=F3n confidencial. Por ello, se informa a quien lo
reciba por error que la informaci=F3n contenida en el mismo es reservada
y su uso no autorizado est=E1 prohibido legalmente, por lo que en tal
caso le rogamos que nos lo comunique por la misma v=EDa o por tel=E9fono
(93 305 13 18), se abstenga de realizar copias del mensaje o remitirlo
o entregarlo a otra persona y proceda a borrarlo de inmediato.

En cumplimiento de la Ley Org=E1nica 15/1999 de 13 de diciembre de
protecci=F3n de datos de car=E1cter personal, Internet Security Auditors
S.L., le informa de que sus datos personales se han incluido en
ficheros informatizados titularidad de Internet Security Auditors
S.L., que ser=E1 el =FAnico destinatario de dichos datos, y cuya finalida=
d
exclusiva es la gesti=F3n de clientes y acciones de comunicaci=F3n
comercial, y de que tiene la posibilidad de ejercer los derechos de
acceso, rectificaci=F3n, cancelaci=F3n y oposici=F3n previstos en la ley
mediante carta dirigida a Internet Security Auditors, c. Santander,
101. Edif. A. 2=BA 1=AA, 08030 Barcelona, o v=EDa e-mail a la siguiente
direcci=F3n de correo: le...@is...

Re: [mod-security-users] MSG and ID Actions

[Ivan R. <iv...@we...>]

Christian Martorella wrote:
> I'm trying to add more info to the logs, but it doesn't add anything, 
> here is my line:
> 
> Modsecurity 1.9dev2:
> 
> SecFilterSelective SCRIPT_FILENAME ".+\.inc" 

   You should use $ at the end of the regex ^


 > "log,msg Includes,id 666"

   And here you should really write "log,msg:Includes,id:666". The
   syntax you used works for now, but I am planning to tighthen
   the parser in one of the subsequent releases.


> I'm using RelevantOnly audit.
> 
> Someone tried this feature?

   I did, and this is what I get:

Warning. Pattern match "111" at REQUEST_URI [id 1] [msg 2] [hostname 
"192.168.2.101"] [uri "/111"]

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] MSG and ID Actions

[Christian M. <cma...@is...>]

I'm trying to add more info to the logs, but it doesn't add anything,=20
here is my line:

Modsecurity 1.9dev2:

SecFilterSelective SCRIPT_FILENAME ".+\.inc" "log,msg Includes,id 666"

I'm using RelevantOnly audit.

Someone tried this feature?

Thanks in advance

--=20
_________________________________
Christian Martorella
e-Security Engineer
cma...@is...

Internet Security Auditors, S.L.
c. Santander, 101. Edif. A. 2=BA 1=AA.
08030 Barcelona
Tel: 93 305 13 18
Fax: 93 278 22 48
www.isecauditors.com
          ____________________________________
Este mensaje y los documentos que, en su caso lleve anexos, pueden
contener informaci=F3n confidencial. Por ello, se informa a quien lo
reciba por error que la informaci=F3n contenida en el mismo es reservada
y su uso no autorizado est=E1 prohibido legalmente, por lo que en tal
caso le rogamos que nos lo comunique por la misma v=EDa o por tel=E9fono
(93 305 13 18), se abstenga de realizar copias del mensaje o remitirlo
o entregarlo a otra persona y proceda a borrarlo de inmediato.

En cumplimiento de la Ley Org=E1nica 15/1999 de 13 de diciembre de
protecci=F3n de datos de car=E1cter personal, Internet Security Auditors
S.L., le informa de que sus datos personales se han incluido en
ficheros informatizados titularidad de Internet Security Auditors
S.L., que ser=E1 el =FAnico destinatario de dichos datos, y cuya finalida=
d
exclusiva es la gesti=F3n de clientes y acciones de comunicaci=F3n
comercial, y de que tiene la posibilidad de ejercer los derechos de
acceso, rectificaci=F3n, cancelaci=F3n y oposici=F3n previstos en la ley
mediante carta dirigida a Internet Security Auditors, c. Santander,
101. Edif. A. 2=BA 1=AA, 08030 Barcelona, o v=EDa e-mail a la siguiente
direcci=F3n de correo: le...@is...

Re: [mod-security-users] Setenv and checking ENV_

[Christian M. <cma...@is...>]

Ivan Ristic wrote:

> Christian Martorella wrote:
>
>>
>> I tried that and it works for same request, but if then i do another=20
>> request to other page ex. toprotect.asp
>> it doesn't match the second signature :
>>
>> Checking signature "1" at ENV(test)
>>
>> The env variable dissapeared between request??
>
>
>   Oh yes, they do :) Those are per-request environment variables.
>
oops,  that explain everything :)

Thanks!

--=20
_________________________________
Christian Martorella
e-Security Engineer
cma...@is...

Internet Security Auditors, S.L.
c. Santander, 101. Edif. A. 2=BA 1=AA.
08030 Barcelona
Tel: 93 305 13 18
Fax: 93 278 22 48
www.isecauditors.com
          ____________________________________
Este mensaje y los documentos que, en su caso lleve anexos, pueden
contener informaci=F3n confidencial. Por ello, se informa a quien lo
reciba por error que la informaci=F3n contenida en el mismo es reservada
y su uso no autorizado est=E1 prohibido legalmente, por lo que en tal
caso le rogamos que nos lo comunique por la misma v=EDa o por tel=E9fono
(93 305 13 18), se abstenga de realizar copias del mensaje o remitirlo
o entregarlo a otra persona y proceda a borrarlo de inmediato.

En cumplimiento de la Ley Org=E1nica 15/1999 de 13 de diciembre de
protecci=F3n de datos de car=E1cter personal, Internet Security Auditors
S.L., le informa de que sus datos personales se han incluido en
ficheros informatizados titularidad de Internet Security Auditors
S.L., que ser=E1 el =FAnico destinatario de dichos datos, y cuya finalida=
d
exclusiva es la gesti=F3n de clientes y acciones de comunicaci=F3n
comercial, y de que tiene la posibilidad de ejercer los derechos de
acceso, rectificaci=F3n, cancelaci=F3n y oposici=F3n previstos en la ley
mediante carta dirigida a Internet Security Auditors, c. Santander,
101. Edif. A. 2=BA 1=AA, 08030 Barcelona, o v=EDa e-mail a la siguiente
direcci=F3n de correo: le...@is...

Re: [mod-security-users] Setenv and checking ENV_

[Ivan R. <iv...@we...>]

Christian Martorella wrote:
> 
> I tried that and it works for same request, but if then i do another 
> request to other page ex. toprotect.asp
> it doesn't match the second signature :
> 
> Checking signature "1" at ENV(test)
> 
> The env variable dissapeared between request??

   Oh yes, they do :) Those are per-request environment variables.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Setenv and checking ENV_

[Christian M. <cma...@is...>]

>   I tried this:
>
> SecfilterSelective REQUEST_URI "example" "setenv:test=3D1,log,pass"
> SecFilterSelective ENV_test "1" "log,pass"
>
>   And it works, like this:
>
> Checking signature "example" at REQUEST_URI
> Checking against "/example"
> Warning. Pattern match "example" at REQUEST_URI
> Signature check returned 0 (337 usec)
> Checking signature "1" at ENV(test)
> Checking against "1"
> Warning. Pattern match "1" at ENV(test)
> Signature check returned 0 (373 usec)
>
>   Now you try the same :)
>
I tried that and it works for same request, but if then i do another=20
request to other page ex. toprotect.asp
it doesn't match the second signature :

Checking signature "1" at ENV(test)

The env variable dissapeared between request??

Cheers


--=20
_________________________________
Christian Martorella
e-Security Engineer
cma...@is...

Internet Security Auditors, S.L.
c. Santander, 101. Edif. A. 2=BA 1=AA.
08030 Barcelona
Tel: 93 305 13 18
Fax: 93 278 22 48
www.isecauditors.com
          ____________________________________
Este mensaje y los documentos que, en su caso lleve anexos, pueden
contener informaci=F3n confidencial. Por ello, se informa a quien lo
reciba por error que la informaci=F3n contenida en el mismo es reservada
y su uso no autorizado est=E1 prohibido legalmente, por lo que en tal
caso le rogamos que nos lo comunique por la misma v=EDa o por tel=E9fono
(93 305 13 18), se abstenga de realizar copias del mensaje o remitirlo
o entregarlo a otra persona y proceda a borrarlo de inmediato.

En cumplimiento de la Ley Org=E1nica 15/1999 de 13 de diciembre de
protecci=F3n de datos de car=E1cter personal, Internet Security Auditors
S.L., le informa de que sus datos personales se han incluido en
ficheros informatizados titularidad de Internet Security Auditors
S.L., que ser=E1 el =FAnico destinatario de dichos datos, y cuya finalida=
d
exclusiva es la gesti=F3n de clientes y acciones de comunicaci=F3n
comercial, y de que tiene la posibilidad de ejercer los derechos de
acceso, rectificaci=F3n, cancelaci=F3n y oposici=F3n previstos en la ley
mediante carta dirigida a Internet Security Auditors, c. Santander,
101. Edif. A. 2=BA 1=AA, 08030 Barcelona, o v=EDa e-mail a la siguiente
direcci=F3n de correo: le...@is...

[mod-security-users] toggle logging of post payload

[Thomas B. <tho...@ug...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,
I'm trying to toggle the logging of the post data of a certain page.
I'm using mod_security 1.8.7 with Apache 2.0.54. Config is below:

~    AddHandler application/x-httpd-php .php
~    SecAuditEngine On
~    SecAuditLog logs/audit_log
~    SecFilterEngine On
~    SecFilterDefaultAction "allow,nolog"
~    SecFilterScanPOST On
~    SecFilterSelective SCRIPT_FILENAME "!(/index.php)$" "allow,log"

It appears the 'nolog' option does not function the way I had it in mind.
I hope some of you can give me some pointers how to handle this. The
actual problem is that certain post data contains high sensitive
information that I wish to ban from the audit_log file.

Greetings,
Thomas.

- --
Name: Thomas Berton (ICT&O)
Email: tho...@ug...
URL: http://icto.ugent.be
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFCw/ORZlbH+9NO2V0RAu36AJ9z7ZftCzCqlDFk/j3xisGOcVk+vQCfTeaM
G9qZm2/DdPeQML5l2v9U1E8=
=GW4X
-----END PGP SIGNATURE-----

Re: [mod-security-users] Setenv and checking ENV_

[Ivan R. <iv...@we...>]

Christian Martorella wrote:
> I'm using a 1.9dev2
> 
> In the logs i have the warning of the example.asp:

   Please send the complete log fragments with configuration.
   Otherwise I won't be able to recreate the same environment.

   I tried this:

SecfilterSelective REQUEST_URI "example" "setenv:test=1,log,pass"
SecFilterSelective ENV_test "1" "log,pass"

   And it works, like this:

Checking signature "example" at REQUEST_URI
Checking against "/example"
Warning. Pattern match "example" at REQUEST_URI
Signature check returned 0 (337 usec)
Checking signature "1" at ENV(test)
Checking against "1"
Warning. Pattern match "1" at ENV(test)
Signature check returned 0 (373 usec)

   Now you try the same :)

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Setenv and checking ENV_

[Christian M. <cma...@is...>]

I'm using a 1.9dev2

In the logs i have the warning of the example.asp:

Warning. Pattern match "example.asp" at REQUEST_URI

and then for toprotect.asp:

Checking signature "1" at ENV(test)
Checking against ""

And just for test purposes i tried the following:

SecfilterSelective REQUEST_URI "example" "setenv:test=3D1,log,pass"
SecFilterSelective REQUEST_URI "toprotect.asp" chain
SecFilterSelective ENV_test "1" "log,pass"

and it doesn't work either....


Any other clue?

Cheers!



Ivan Ristic wrote:

> Christian Martorella wrote:
>
>> Hi, i'm having problems with the Setenv action, i want to set an=20
>> enviroment variable like test=3D1, and then in another rule check if i=
t=20
>> is set, but can't get it done, here is what i do:
>
>
>   Just use the debug log to figure out.
>
>
>> SecFilterSelective REQUEST_URI "example.asp"  setenv:test=3D1,pass
>>
>> And then
>>
>> <Location /admin/toprotect.asp>
>> SecFilterSelective ENV_test  "1"  log,pass
>> </Location>
>>
>> I first access my example.asp, and then  /admin/toprotect.asp, but=20
>> doesn't work..
>>
>> Any ideas?
>
>
>   I suspect this is what happens after inheritance takes place:
>
>   SecFilterSelective ENV_test  "1"  log,pass
>   SecFilterSelective REQUEST_URI "example.asp"  setenv:test=3D1,pass
>
>   In 1.9.x the following should happen:
>
>   SecFilterSelective REQUEST_URI "example.asp"  setenv:test=3D1,pass
>   SecFilterSelective ENV_test  "1"  log,pass
>
>   ...
>
>   As a temporary workaround in 1.8.x you may want to use SetEnvIf
>   to set the variable.
>


--=20
_________________________________
Christian Martorella
e-Security Engineer
cma...@is...

Internet Security Auditors, S.L.
c. Santander, 101. Edif. A. 2=BA 1=AA.
08030 Barcelona
Tel: 93 305 13 18
Fax: 93 278 22 48
www.isecauditors.com
          ____________________________________
Este mensaje y los documentos que, en su caso lleve anexos, pueden
contener informaci=F3n confidencial. Por ello, se informa a quien lo
reciba por error que la informaci=F3n contenida en el mismo es reservada
y su uso no autorizado est=E1 prohibido legalmente, por lo que en tal
caso le rogamos que nos lo comunique por la misma v=EDa o por tel=E9fono
(93 305 13 18), se abstenga de realizar copias del mensaje o remitirlo
o entregarlo a otra persona y proceda a borrarlo de inmediato.

En cumplimiento de la Ley Org=E1nica 15/1999 de 13 de diciembre de
protecci=F3n de datos de car=E1cter personal, Internet Security Auditors
S.L., le informa de que sus datos personales se han incluido en
ficheros informatizados titularidad de Internet Security Auditors
S.L., que ser=E1 el =FAnico destinatario de dichos datos, y cuya finalida=
d
exclusiva es la gesti=F3n de clientes y acciones de comunicaci=F3n
comercial, y de que tiene la posibilidad de ejercer los derechos de
acceso, rectificaci=F3n, cancelaci=F3n y oposici=F3n previstos en la ley
mediante carta dirigida a Internet Security Auditors, c. Santander,
101. Edif. A. 2=BA 1=AA, 08030 Barcelona, o v=EDa e-mail a la siguiente
direcci=F3n de correo: le...@is...

Re: [mod-security-users] Setenv and checking ENV_

[Ivan R. <iv...@we...>]

Christian Martorella wrote:
> Hi, i'm having problems with the Setenv action, i want to set an 
> enviroment variable like test=1, and then in another rule check if it is 
> set, but can't get it done, here is what i do:

   Just use the debug log to figure out.


> SecFilterSelective REQUEST_URI "example.asp"  setenv:test=1,pass
> 
> And then
> 
> <Location /admin/toprotect.asp>
> SecFilterSelective ENV_test  "1"  log,pass
> </Location>
> 
> I first access my example.asp, and then  /admin/toprotect.asp, but 
> doesn't work..
> 
> Any ideas?

   I suspect this is what happens after inheritance takes place:

   SecFilterSelective ENV_test  "1"  log,pass
   SecFilterSelective REQUEST_URI "example.asp"  setenv:test=1,pass

   In 1.9.x the following should happen:

   SecFilterSelective REQUEST_URI "example.asp"  setenv:test=1,pass
   SecFilterSelective ENV_test  "1"  log,pass

   ...

   As a temporary workaround in 1.8.x you may want to use SetEnvIf
   to set the variable.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Setenv and checking ENV_

[Christian M. <cma...@is...>]

Hi, i'm having problems with the Setenv action, i want to set an=20
enviroment variable like test=3D1, and then in another rule check if it i=
s=20
set, but can't get it done, here is what i do:


SecFilterSelective REQUEST_URI "example.asp"  setenv:test=3D1,pass

And then

<Location /admin/toprotect.asp>
SecFilterSelective ENV_test  "1"  log,pass
</Location>


I first access my example.asp, and then  /admin/toprotect.asp, but=20
doesn't work..

Any ideas?

Thanks in advance


--=20
_________________________________
Christian Martorella
e-Security Engineer
cma...@is...

Internet Security Auditors, S.L.
c. Santander, 101. Edif. A. 2=BA 1=AA.
08030 Barcelona
Tel: 93 305 13 18
Fax: 93 278 22 48
www.isecauditors.com
          ____________________________________
Este mensaje y los documentos que, en su caso lleve anexos, pueden
contener informaci=F3n confidencial. Por ello, se informa a quien lo
reciba por error que la informaci=F3n contenida en el mismo es reservada
y su uso no autorizado est=E1 prohibido legalmente, por lo que en tal
caso le rogamos que nos lo comunique por la misma v=EDa o por tel=E9fono
(93 305 13 18), se abstenga de realizar copias del mensaje o remitirlo
o entregarlo a otra persona y proceda a borrarlo de inmediato.

En cumplimiento de la Ley Org=E1nica 15/1999 de 13 de diciembre de
protecci=F3n de datos de car=E1cter personal, Internet Security Auditors
S.L., le informa de que sus datos personales se han incluido en
ficheros informatizados titularidad de Internet Security Auditors
S.L., que ser=E1 el =FAnico destinatario de dichos datos, y cuya finalida=
d
exclusiva es la gesti=F3n de clientes y acciones de comunicaci=F3n
comercial, y de que tiene la posibilidad de ejercer los derechos de
acceso, rectificaci=F3n, cancelaci=F3n y oposici=F3n previstos en la ley
mediante carta dirigida a Internet Security Auditors, c. Santander,
101. Edif. A. 2=BA 1=AA, 08030 Barcelona, o v=EDa e-mail a la siguiente
direcci=F3n de correo: le...@is...

Re: [mod-security-users] Logging-Questions

[Jens W. <sha...@no...>]

Quoting Ivan Ristic <iv...@we...>:

> Jens Weibler wrote:

>> is there a way to get two audit-logs? One relevant-only and the other
> > with all requests?
>
>   At the moment, no. Why do you need that for? Audit logging is
>   I/O intensive operation as it is, I imagine having multiple logs
>   would bring a web server down to a crawl.

I'm using modSecurity for an application-layer hacking-contest (CTF) [1] as an
audit- and blocking-tool.
I want to have a complete audit-log for later inspection/analysis but also an
attack-only log which I read while the contest is running.


btw: modSecurity was a great help at the last contest and helped us to get in
the TOP3 :)

[1] http://www.cs.ucsb.edu/~vigna/CTF/ and in a few weeks
http://www-i4.informatik.rwth-aachen.de/~lexi/cipher.php?edit=0

-- 
Jens