mod-security-users — General discussion about mod_security

Re: [mod-security-users] Logging-Questions

[Ivan R. <iv...@we...>]

Jens Weibler wrote:
> Hi,
> 
> two questions about the logging in mod_Security :)
> 
> - how can I get an audit-logentry for "log,pass"-action? I only get an entry in
> the error_log

   That does not appear to work properly in 1.8.7. It is already fixed
   in 1.9, but I will check it once more before the final release (should
   be out by the end of July).


> is there a way to get two audit-logs? One relevant-only and the other
 > with all requests?

   At the moment, no. Why do you need that for? Audit logging is
   I/O intensive operation as it is, I imagine having multiple logs
   would bring a web server down to a crawl.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Logging-Questions

[Jens W. <jen...@je...>]

Hi,

two questions about the logging in mod_Security :)

- how can I get an audit-logentry for "log,pass"-action? I only get an entry in
the error_log
- is there a way to get two audit-logs? One relevant-only and the other with all
requests?


-- 
Jens

Re: [mod-security-users] Strange Logs

[Ivan R. <iv...@we...>]

Christian Martorella wrote:
> Ivan Ristic wrote:
> 
>> Christian Martorella wrote:
>>
>>> Hi i was trying some logs for the modsecurity Console, and i found 
>>> these entries (generated by Nikto):
>>> Why there is not Modsecurity_message?
>>> Why there is no Action?
>>
>>   modsecurity 1.9dev2 logs certain requests based only on the
>>   response status code (I will change this to be just an option before
>>   the final 1.9). So it is probably that Apache rejected
>>   those requests before they reached mod_security. You can verify
>>   this theory by looking at the debug log (at level 2 or more).
>>
> Fine, so why apache rejected those requests, before reaching the 
> modsecurity ? :)

   Because at the moment mod_security runs last, just before the
   handler is run. I am thinking about moving mod_security
   to run first, but only in v2. It's not really clear which
   option is better.

   For example, if we run very early we don't get to access Apache's
   per-context configuration (e.g. <Location>). So in order to
   retain the same functionality we have now the whole configuration
   mechanism would have to be replicated internal to modsecurity.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Strange Logs

[Christian M. <cma...@is...>]

Ivan Ristic wrote:

> Christian Martorella wrote:
>
>> Hi i was trying some logs for the modsecurity Console, and i found=20
>> these entries (generated by Nikto):
>> Why there is not Modsecurity_message?
>> Why there is no Action?
>
>
>   modsecurity 1.9dev2 logs certain requests based only on the
>   response status code (I will change this to be just an option before
>   the final 1.9). So it is probably that Apache rejected
>   those requests before they reached mod_security. You can verify
>   this theory by looking at the debug log (at level 2 or more).
>
Fine, so why apache rejected those requests, before reaching the=20
modsecurity ? :)


>
>> Why sometimes the Handler is proxy-server, and others null?
>
>
>   Sometimes a request can be rejected before Apache decides what
>   to do with it. In such cases, the handler is still unknown.
>
Ok.

Thanks!

--=20
_________________________________
Christian Martorella
e-Security Engineer
cma...@is...

Internet Security Auditors, S.L.
c. Santander, 101. Edif. A. 2=BA 1=AA.
08030 Barcelona
Tel: 93 305 13 18
Fax: 93 278 22 48
www.isecauditors.com
          ____________________________________
Este mensaje y los documentos que, en su caso lleve anexos, pueden
contener informaci=F3n confidencial. Por ello, se informa a quien lo
reciba por error que la informaci=F3n contenida en el mismo es reservada
y su uso no autorizado est=E1 prohibido legalmente, por lo que en tal
caso le rogamos que nos lo comunique por la misma v=EDa o por tel=E9fono
(93 305 13 18), se abstenga de realizar copias del mensaje o remitirlo
o entregarlo a otra persona y proceda a borrarlo de inmediato.

En cumplimiento de la Ley Org=E1nica 15/1999 de 13 de diciembre de
protecci=F3n de datos de car=E1cter personal, Internet Security Auditors
S.L., le informa de que sus datos personales se han incluido en
ficheros informatizados titularidad de Internet Security Auditors
S.L., que ser=E1 el =FAnico destinatario de dichos datos, y cuya finalida=
d
exclusiva es la gesti=F3n de clientes y acciones de comunicaci=F3n
comercial, y de que tiene la posibilidad de ejercer los derechos de
acceso, rectificaci=F3n, cancelaci=F3n y oposici=F3n previstos en la ley
mediante carta dirigida a Internet Security Auditors, c. Santander,
101. Edif. A. 2=BA 1=AA, 08030 Barcelona, o v=EDa e-mail a la siguiente
direcci=F3n de correo: le...@is...

Re: [mod-security-users] Strange Logs

[Ivan R. <iv...@we...>]

Christian Martorella wrote:
> Hi i was trying some logs for the modsecurity Console, and i found these 
> entries (generated by Nikto):
> Why there is not Modsecurity_message?
> Why there is no Action?

   modsecurity 1.9dev2 logs certain requests based only on the
   response status code (I will change this to be just an option before
   the final 1.9). So it is probably that Apache rejected
   those requests before they reached mod_security. You can verify
   this theory by looking at the debug log (at level 2 or more).


> Why sometimes the Handler is proxy-server, and others null?

   Sometimes a request can be rejected before Apache decides what
   to do with it. In such cases, the handler is still unknown.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Strange Logs

[Christian M. <cma...@is...>]

Hi i was trying some logs for the modsecurity Console, and i found these=20
entries (generated by Nikto):
Why there is not Modsecurity_message?
Why there is no Action?
Why sometimes the Handler is proxy-server, and others null?

Any ideas?

Btw im using a modsecurity 1.9 Dev2. + mod_proxy.

Thanks in advance
Christian

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Request: 10.10.0.XXX - - [28/Jun/2005:17:11:31 +0200] "GET=20
/..\\..\\..\\..\\..\\..\\temp\\temp.class HTTP/1.0" 403 32
Handler: proxy-server
----------------------------------------
GET /..\\..\\..\\..\\..\\..\\temp\\temp.class HTTP/1.0
Content-Length: 0
User-Agent: Mozilla/4.75 (Nikto/1.34 )
Host: www.myhost.com
Max-Forwards: 10
X-Forwarded-For: 10.10.0.XXX
X-Forwarded-Host: www.myhost.com
X-Forwarded-Server: www.myhost.com

0


HTTP/1.0 403 Forbidden
Content-Type: text/html; charset=3DUTF-8
Content-Length: 32
Connection: close
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Request: 10.10.0.xxx - - [28/Jun/2005:17:11:30 +0200] "GET=20
/../webserver.ini HTTP/1.0" 400 302
Handler: (null)
----------------------------------------
GET /../webserver.ini HTTP/1.0
Connection: Keep-Alive
Content-Length: 0
User-Agent: Mozilla/4.75 (Nikto/1.34 )
Host: www.myhost.com


28
[POST payload not available]

HTTP/1.0 400 Bad Request
Content-Length: 302
Connection: close
Content-Type: text/html; charset=3Diso-8859-1

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Request: 10.10.0.xxx - - [28/Jun/2005:17:11:30 +0200] "GET=20
/../config.dat HTTP/1.0" 400 302
Handler: (null)
----------------------------------------
GET /../config.dat HTTP/1.0
Connection: Keep-Alive
Content-Length: 0
User-Agent: Mozilla/4.75 (Nikto/1.34 )
Host: www.myhost.com
28
[POST payload not available]

HTTP/1.0 400 Bad Request
Content-Length: 302
Connection: close
Content-Type: text/html; charset=3Diso-8859-1

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

--=20
______________________________
Christian Martorella
e-Security Engineer
cma...@is...

Internet Security Auditors, S.L.
c. Santander, 101. Edif. A. 2=BA 1=AA.
08030 Barcelona
Tel: 93 305 13 18
Fax: 93 278 22 48
www.isecauditors.com
____________________________________
Este mensaje y los documentos que, en su caso lleve anexos, pueden
contener informaci=F3n confidencial. Por ello, se informa a quien lo
reciba por error que la informaci=F3n contenida en el mismo es reservada
y su uso no autorizado est=E1 prohibido legalmente, por lo que en tal
caso le rogamos que nos lo comunique por la misma v=EDa o por tel=E9fono
(93 305 13 18), se abstenga de realizar copias del mensaje o remitirlo
o entregarlo a otra persona y proceda a borrarlo de inmediato.

En cumplimiento de la Ley Org=E1nica 15/1999 de 13 de diciembre de
protecci=F3n de datos de car=E1cter personal, Internet Security Auditors
S.L., le informa de que sus datos personales se han incluido en
ficheros informatizados titularidad de Internet Security Auditors
S.L., que ser=E1 el =FAnico destinatario de dichos datos, y cuya finalida=
d
exclusiva es la gesti=F3n de clientes y acciones de comunicaci=F3n
comercial, y de que tiene la posibilidad de ejercer los derechos de
acceso, rectificaci=F3n, cancelaci=F3n y oposici=F3n previstos en la ley
mediante carta dirigida a Internet Security Auditors, c. Santander,
101. Edif. A. 2=BA 1=AA, 08030 Barcelona, o v=EDa e-mail a la siguiente
direcci=F3n de correo: le...@is...

RE: [mod-security-users] SecChrootDir and SELinux

[Jeff T. <jt...@es...>]

Ivan,
Aha, thanks you gave me a good pointer...I'd overlooked the
SecChrootLock directive.  I installed the SELinux policy sources
(up2date selinux-policy-targeted-sources, good idea not to do this on a
production box) and did some digging. The sources for the default
targeted policy are installed to /etc/selinux/targeted/src -- I'll call
this $SELINUXSRC

Looks like the juicy part of the Apache-specific SELinux config is
located in $SELINUXSRC/policy/domains/program/apache.te.  Looking
through this, I can see the default policy is actually fairly generic.
One thing that looked promising was the following pair of lines:
# Creation of lock files for apache2
lock_domain(httpd)

This is a macro and is defined in
$SELINUXSRC/policy/macros/global_macros.te:
define(`lock_domain', `
type $1_lock_t, file_type, sysadmfile, lockfile;
file_type_auto_trans($1_t, var_lock_t, $1_lock_t, file)
')

Hence, I can see that Apache is being granted access to var_lock_t.
This file context is mapped in
$SELINUXSRC/policy/file_contexts/types.fc:
/var/lock(/.*)?                 system_u:object_r:var_lock_t

Aha...so Apache should have access to /var/lock.

So I added SecChrootLock /var/lock/modsecurity-chroot.lock and tested.
This works, but I still get the chroot audit entry:
Jun 25 13:18:02 wyrmfire kernel: audit(1119730682.770:0): avc:  denied
{ sys_chroot } for  pid=3D2325 comm=3Dhttpd capability=3D18
scontext=3Droot:system_r:httpd_t tcontext=3Droot:system_r:httpd_t
tclass=3Dcapability

So I need to grant Apache access to chroot itself.  This requires
customizing the SELinux policy.  A good reference to doing this voodoo
is
http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/selinux-guid
e/selg-section-0120.html

Basic cookbook steps:
1. Install latest selinux-policy-targeted-sources RPM.  Best to install
this on a separate box.  If you must install on a production system,
make sure to remove once you are done.
2. Backup existing policy
   cd /etc/selinux; tar cvfz /root/backuppolicy.tgz targeted/policy
targeted/contexts targeted/booleans
3. Add our customization
   echo 'allow httpd_t self:capability sys_chroot;' >>
$SELINUXSRC/policy/domains/misc/local.te
4. cd $SELINUXSRC; make load
   (note you will get an error if SELinux is not currently enabled on
the system you run this on.  If building on a separate system, this
error can be safely ignored)
5. If building on a separate system, package up the new policy
   cd /etc/selinux; tar cvfz /root/newpolicy.tgz targeted/policy
targeted/contexts targeted/booleans
   Copy newpolicy.tgz to your production system and extract to
/etc/selinux
6. In either case, reload the policy
   touch /.autorelabel; reboot
   (note this will take a while, depending on the number of files and
size of the filesystems.  Take this opportunity to enjoy your beverage
of choice :-)

After the reboot, I started Apache and confirmed that the chroot worked
as expected.  So this is solved.  I still think the default SELinux
Apache policy is too generic...I may try customizing further to tighten
everything down to only what is needed for this system to function as a
reverse proxy.

Hope this helps others,
Jeff Tharp
System Administrator
ESRI - Redlands, CA, USA
http://www.esri.com
=20
> -----Original Message-----
> From: Ivan Ristic [mailto:iv...@we...]=20
> Sent: Monday, June 27, 2005 3:38 PM
> To: Jeff Tharp
> Cc: mod...@li...
> Subject: Re: [mod-security-users] SecChrootDir and SELinux
>=20
> Jeff Tharp wrote:
> > Hello, I'm working on building a reverse proxy configuration using
> > ModSecurity-1.8.7 and Apache 2.0.54 on Red Hat Enterprise=20
> Linux v.4 ES.
> > One of the items I would like to implement is to chroot=20
> Apache, and I'm
> > running into some hassles with the default targeted SELinux policy
> > (nothing like one security mechanism getting in the way of another).
>=20
>    Assuming the Apache targeted policy was created without chroot
>    in mind, do you think some of the problems you are experiencing
>    are there because e.g. the paths are different?
>=20
>=20
> > Jun 25 13:18:02 wyrmfire kernel: audit(1119730682.328:0):=20
> avc:  denied
> > { write } for  pid=3D2324 comm=3Dhttpd name=3Dmodsec_chroot.lock =
dev=3Dsda8
> > ino=3D55751 scontext=3Droot:system_r:httpd_t
> > tcontext=3Droot:object_r:httpd_log_t tclass=3Dfile
> > Jun 25 13:18:02 wyrmfire httpd: httpd startup succeeded
> > Jun 25 13:18:02 wyrmfire kernel: audit(1119730682.769:0):=20
> avc:  denied
> > { unlink } for  pid=3D2325 comm=3Dhttpd name=3Dmodsec_chroot.lock =
dev=3Dsda8
> > ino=3D55751 scontext=3Droot:system_r:httpd_t
> > tcontext=3Droot:object_r:httpd_log_t tclass=3Dfile
>=20
>    By default, mod_security 1.8.x creates a temporary file,
>    modsec_chroot.lock, in ${ServerRoot}/logs/. Could it be that your
>    Apache configuration is such that this falls where it shouldn't?
>=20
>    You can try using the SecChrootLock directive to explicitly tell
>    mod_security where to put the lock file.
>=20
>    FYI, I will probably remove the need to create the lock file in
>    mod_security 1.9.x. If you want I can do it sooner rather than
>    later.
>=20
>    But we may still try to figure out the problem, and learn something
>    about SELinux along the way ;)
>=20
>=20
> > allow httpd_t httpd_log_t:file { unlink write };
>  > ...
>  > it
>  > seems that Apache is being denied access to it's own log=20
> files, which
>  > was probably done for a good reason ;-)  Before I go off=20
> ignore said
>=20
>    Since unlink & write in the log folder are not allowed, what is
>    allowed? How will Apache create the logs if the operation is not
>    allowed? :)
>=20
> --=20
> Ivan Ristic
> Apache Security (O'Reilly) - http://www.apachesecurity.net
> Open source web application firewall - http://www.modsecurity.org
>=20

Re: [mod-security-users] SecChrootDir and SELinux

[Ivan R. <iv...@we...>]

Jeff Tharp wrote:
> Hello, I'm working on building a reverse proxy configuration using
> ModSecurity-1.8.7 and Apache 2.0.54 on Red Hat Enterprise Linux v.4 ES.
> One of the items I would like to implement is to chroot Apache, and I'm
> running into some hassles with the default targeted SELinux policy
> (nothing like one security mechanism getting in the way of another).

   Assuming the Apache targeted policy was created without chroot
   in mind, do you think some of the problems you are experiencing
   are there because e.g. the paths are different?


> Jun 25 13:18:02 wyrmfire kernel: audit(1119730682.328:0): avc:  denied
> { write } for  pid=2324 comm=httpd name=modsec_chroot.lock dev=sda8
> ino=55751 scontext=root:system_r:httpd_t
> tcontext=root:object_r:httpd_log_t tclass=file
> Jun 25 13:18:02 wyrmfire httpd: httpd startup succeeded
> Jun 25 13:18:02 wyrmfire kernel: audit(1119730682.769:0): avc:  denied
> { unlink } for  pid=2325 comm=httpd name=modsec_chroot.lock dev=sda8
> ino=55751 scontext=root:system_r:httpd_t
> tcontext=root:object_r:httpd_log_t tclass=file

   By default, mod_security 1.8.x creates a temporary file,
   modsec_chroot.lock, in ${ServerRoot}/logs/. Could it be that your
   Apache configuration is such that this falls where it shouldn't?

   You can try using the SecChrootLock directive to explicitly tell
   mod_security where to put the lock file.

   FYI, I will probably remove the need to create the lock file in
   mod_security 1.9.x. If you want I can do it sooner rather than
   later.

   But we may still try to figure out the problem, and learn something
   about SELinux along the way ;)


> allow httpd_t httpd_log_t:file { unlink write };
 > ...
 > it
 > seems that Apache is being denied access to it's own log files, which
 > was probably done for a good reason ;-)  Before I go off ignore said

   Since unlink & write in the log folder are not allowed, what is
   allowed? How will Apache create the logs if the operation is not
   allowed? :)

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] SecChrootDir and SELinux

[Jeff T. <jt...@es...>]

Hello, I'm working on building a reverse proxy configuration using
ModSecurity-1.8.7 and Apache 2.0.54 on Red Hat Enterprise Linux v.4 ES.
One of the items I would like to implement is to chroot Apache, and I'm
running into some hassles with the default targeted SELinux policy
(nothing like one security mechanism getting in the way of another).

First a few details:
1.	Apache is custom compiled with ModSecurity statically linked.
To do this, I copied the mod_security.c file to the modules/proxy folder
in the extracted source code for Apache, then added the following flags
to configure:
	  --enable-security --with-module=3Dproxy:mod_security.c

	(note I actually did this via a custom modification of the spec
file for the Apache RPM in Fedora Core 4.  So directories and so forth
will match the Fedora/Red Hat 'way' with /etc/httpd and /var/www, etc.
If anyone is interested in the spec file/SRPM I used for this, let me
know.)

2.	Using Red Hat Enterprise Linux v4, kernel 2.6.9-11.EL, but I
would expect a similar issue on Fedora Core 3 or 4, as I believe that
also has SELinux as an option.  SELinux versions are as follows:
[root@wyrmfire ~]# rpm -qa | grep selinux
libselinux-1.19.1-7
selinux-policy-targeted-1.17.30-2.88

3.	/etc/httpd/conf/httpd.conf contains the following directive:
	SecChrootDir	/var/www

The above configuration works perfectly if SELinux is disabled.  If I
enable SELinux, but set to permissive mode (setenforce 0), I get the
following audit entries in /var/log/messages from SELinux:

Jun 25 13:18:02 wyrmfire kernel: audit(1119730682.328:0): avc:  denied
{ write } for  pid=3D2324 comm=3Dhttpd name=3Dmodsec_chroot.lock =
dev=3Dsda8
ino=3D55751 scontext=3Droot:system_r:httpd_t
tcontext=3Droot:object_r:httpd_log_t tclass=3Dfile
Jun 25 13:18:02 wyrmfire httpd: httpd startup succeeded
Jun 25 13:18:02 wyrmfire kernel: audit(1119730682.769:0): avc:  denied
{ unlink } for  pid=3D2325 comm=3Dhttpd name=3Dmodsec_chroot.lock =
dev=3Dsda8
ino=3D55751 scontext=3Droot:system_r:httpd_t
tcontext=3Droot:object_r:httpd_log_t tclass=3Dfile
Jun 25 13:18:02 wyrmfire kernel: audit(1119730682.770:0): avc:  denied
{ sys_chroot } for  pid=3D2325 comm=3Dhttpd capability=3D18
scontext=3Droot:system_r:httpd_t tcontext=3Droot:system_r:httpd_t
tclass=3Dcapability

A ps -ef | grep httpd afterwards shows that Apache dies here right after
start up.

I ran these audit entries through the very helpful audit2allow program
(see http://www.nsa.gov/selinux) and got the following SELinux suggested
policy additions:

allow httpd_t httpd_log_t:file { unlink write };
allow httpd_t self:capability sys_chroot;

The second line seems straight up, but I'm wondering about the first--it
seems that Apache is being denied access to it's own log files, which
was probably done for a good reason ;-)  Before I go off ignore said
good reason, I wanted to run this by everyone and get some feedback.
Alternatives I see would be to create a new domain just for the
modsec_chroot.lock file in SELinux (non-trivial, requires some dark
SELinux voodoo) or alter the code to write this file to a different
directory that Apache does have access to (not sure if this is feasible
or if such a directory exists).

For completeness, here is the security contexts for the files in
/var/log/httpd:
[root@wyrmfire ~]# ls -laZ /var/log/httpd
drwx------  root     root     system_u:object_r:httpd_log_t    .
drwxr-xr-x  root     root     system_u:object_r:var_log_t      ..
-rw-r-----  root     root     root:object_r:httpd_log_t
access_log
-rw-r-----  root     root     root:object_r:httpd_log_t        error_log
-rw-r-----  root     root     root:object_r:httpd_log_t
rewrite_log

And /etc/httpd:
[root@wyrmfire ~]# ls -laRZ /etc/httpd
/etc/httpd:
drwxr-xr-x  root     root     system_u:object_r:httpd_config_t .
drwxr-xr-x  root     root     system_u:object_r:etc_t          ..
drwxr-xr-x  root     root     system_u:object_r:httpd_config_t conf
drwxr-xr-x  root     root     system_u:object_r:httpd_config_t conf.d
lrwxrwxrwx  root     root     system_u:object_r:httpd_log_t    logs ->
../../var/log/httpd
lrwxrwxrwx  root     root     system_u:object_r:httpd_modules_t modules
-> ../../usr/lib/httpd/modules
lrwxrwxrwx  root     root     system_u:object_r:etc_t          run ->
../../var/run

/etc/httpd/conf:
drwxr-xr-x  root     root     system_u:object_r:httpd_config_t .
drwxr-xr-x  root     root     system_u:object_r:httpd_config_t ..
-rw-------  root     root     root:object_r:httpd_config_t
httpd.conf
-rw-r--r--  root     root     system_u:object_r:httpd_config_t
httpd.conf.dist
-rw-r--r--  root     root     system_u:object_r:httpd_config_t magic
-rw-r--r--  root     root     system_u:object_r:httpd_config_t
ssl.conf.dist

/etc/httpd/conf.d:
drwxr-xr-x  root     root     system_u:object_r:httpd_config_t .
drwxr-xr-x  root     root     system_u:object_r:httpd_config_t ..
-rw-r--r--  root     root     system_u:object_r:httpd_config_t README

Appreciate thoughts/feedback on this.  Once I get this working, I'll be
happy to post a much shorter list of the steps needed to workaround the
default SELinux policy so that can be added to a FAQ somewhere :-)

Thanks,
Jeff Tharp
System Administrator
ESRI - Redlands, CA, USA
http://www.esri.com

=20

Re: [mod-security-users] anyone saw this dos-ish attack + how to block

[Tom A. <tan...@oa...>]

Those IPs are all listed in URIBLs.  I run a script which identifies
such URLs in my email and inserts the tokens you see below.  Click on
the "rulesemporium.com" link to see which block lists these are
contained in.  (Oops, that site looks like it's down at the moment...
try spamhaus.org, opm.blitzed.org, or cbl.abuseat.org).  Looks like
those IPs are open proxies.  This is probably a worm attack on your
system.

Tom



On Fri, 2005-06-24 at 18:23, Hugh Beaumont wrote:
> I've been getting a lot of lines like this in my logs:
> 
> - 
>  
>  SPAM-ADDRESS: 200.39.103.224 
>  http://www.rulesemporium.com/cgi-bin/uribl.cgi?domain0=200.39.103.224&bl0=0
> 
>    - - [24/Jun/2005:02:45:22 -0400] "-" 408 - "-" "-"
> - 
>  
>  SPAM-ADDRESS: 148.244.150.58 
>  http://www.rulesemporium.com/cgi-bin/uribl.cgi?domain0=148.244.150.58&bl0=0
> 
>    - - [24/Jun/2005:02:45:23 -0400] "-" 408 - "-" "-"
> - 
>  
>  SPAM-ADDRESS: 148.244.150.58 
>  http://www.rulesemporium.com/cgi-bin/uribl.cgi?domain0=148.244.150.58&bl0=0
> 
>    - - [24/Jun/2005:02:45:31 -0400] "-" 408 - "-" "-"
> - 
>  
>  SPAM-ADDRESS: 168.212.79.8 
>  http://www.rulesemporium.com/cgi-bin/uribl.cgi?domain0=168.212.79.8&bl0=0
> 
>    - - [24/Jun/2005:02:45:58 -0400] "-" 408 - "-" "-"
> 
> Anyone know a quick mod_security method to block these. I hate to just ask without any
> research on my part but its causing some big problems on this particular server so I thought I
> would fire off a quick message in case anyone has saw this before and has a solution.
> 
> Thanks!
> 
> 
> 
> 		
> ____________________________________________________ 
> Yahoo! Sports 
> Rekindle the Rivalries. Sign up for Fantasy Football 
> http://football.fantasysports.yahoo.com
> 
> 
> -------------------------------------------------------
> SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
> from IBM. Find simple to follow Roadmaps, straightforward articles,
> informative Webcasts and more! Get everything you need to get up to
> speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users

Re: [mod-security-users] anyone saw this dos-ish attack + how to block

[Troy A. <tr...@ze...>]

On Fri, Jun 24, 2005 at 03:23:59PM -0700, Hugh Beaumont wrote:
> I've been getting a lot of lines like this in my logs:
> 
> - 200.39.103.224 - - [24/Jun/2005:02:45:22 -0400] "-" 408 - "-" "-"
> - 148.244.150.58 - - [24/Jun/2005:02:45:23 -0400] "-" 408 - "-" "-"
> - 148.244.150.58 - - [24/Jun/2005:02:45:31 -0400] "-" 408 - "-" "-"
> - 168.212.79.8 - - [24/Jun/2005:02:45:58 -0400] "-" 408 - "-" "-"
> 
> Anyone know a quick mod_security method to block these. I hate to just
> ask without any
> research on my part but its causing some big problems on this
> particular server so I thought I
> would fire off a quick message in case anyone has saw this before and
> has a solution.

status code 408 is a request timeout.  The log entries above don't look
like a DOS attack, but rather the symptom of another problem with your
web server.  Perhaps the the server is overloaded?  You have some poorly
written script that makes the server work too hard ?  Just guesses, but
that's where I'd start looking.

-troy

Re: [mod-security-users] anyone saw this dos-ish attack + how to block

[Ivan R. <iv...@we...>]

Hugh Beaumont wrote:
> I've been getting a lot of lines like this in my logs:
> 
> - 200.39.103.224 - - [24/Jun/2005:02:45:22 -0400] "-" 408 - "-" "-"
> - 148.244.150.58 - - [24/Jun/2005:02:45:23 -0400] "-" 408 - "-" "-"
> - 148.244.150.58 - - [24/Jun/2005:02:45:31 -0400] "-" 408 - "-" "-"
> - 168.212.79.8 - - [24/Jun/2005:02:45:58 -0400] "-" 408 - "-" "-"
> 
> Anyone know a quick mod_security method to block these. I hate to just ask without any
> research on my part but its causing some big problems on this particular server so I thought I
> would fire off a quick message in case anyone has saw this before and has a solution.

   How many such requests per minute do you get?

   You won't be able to use mod_security for this purpose. But you could
   use blacklist: http://www.apachesecurity.net/tools/ You'll only need
   to write a Perl script that watches the access log and counts the
   number of 408 responses per IP address. Be careful, though, timeouts
   can happen during normal operation as well.


 > but its causing some big problems on this particular server

   You should also look into reducing the timeout value of the server.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] anyone saw this dos-ish attack + how to block

[Hugh B. <hbe...@ya...>]

I've been getting a lot of lines like this in my logs:

- 200.39.103.224 - - [24/Jun/2005:02:45:22 -0400] "-" 408 - "-" "-"
- 148.244.150.58 - - [24/Jun/2005:02:45:23 -0400] "-" 408 - "-" "-"
- 148.244.150.58 - - [24/Jun/2005:02:45:31 -0400] "-" 408 - "-" "-"
- 168.212.79.8 - - [24/Jun/2005:02:45:58 -0400] "-" 408 - "-" "-"

Anyone know a quick mod_security method to block these. I hate to just ask without any
research on my part but its causing some big problems on this particular server so I thought I
would fire off a quick message in case anyone has saw this before and has a solution.

Thanks!



		
____________________________________________________ 
Yahoo! Sports 
Rekindle the Rivalries. Sign up for Fantasy Football 
http://football.fantasysports.yahoo.com

Re: [mod-security-users] Log and Redirect

[Ryan B. <rcb...@gm...>]

Those directive should work.  What version of Mod_Security are you
using?  Also, give it a try after removing the double-quotes from the
action flags -

SecFilterSelective ARG_login ".{12,}" log,redirect:http://www.mypage.com/

Did you specify any SecDefaultAction settings?

--=20
Ryan C. Barnett
Web Application Security Consortium (WASC) Member
CIS Apache Benchmark Project Lead
SANS Instructor: Securing Apache
GCIA, GCFA, GCIH, GSNA, GCUX, GSEC

On 6/22/05, Christian Martorella <cma...@is...> wrote:
> Hi all, somebody knows if it is possible for a rule to redirect and log?
> I was trying but i could'nt  my rules where like these:
>=20
>  SecFilterSelective ARG_login ".{12,}" "log,redirect:http://www.mypage.co=
m/"
>=20
> or
>=20
> SecFilterSelective ARG_login ".{12,}" "redirect:http://www.mypage.com/,lo=
g"
>=20
> Thanks in advance
>=20
> --
> _________________________________
> Christian Martorella
> e-Security Engineer
> cma...@is...
>=20
> Internet Security Auditors, S.L.
> c. Santander, 101. Edif. A. 2=BA 1=AA.
> 08030 Barcelona
> Tel: 93 305 13 18
> Fax: 93 278 22 48
> www.isecauditors.com
>          ____________________________________
> Este mensaje y los documentos que, en su caso lleve anexos, pueden
> contener informaci=F3n confidencial. Por ello, se informa a quien lo
> reciba por error que la informaci=F3n contenida en el mismo es reservada
> y su uso no autorizado est=E1 prohibido legalmente, por lo que en tal
> caso le rogamos que nos lo comunique por la misma v=EDa o por tel=E9fono
> (93 305 13 18), se abstenga de realizar copias del mensaje o remitirlo
> o entregarlo a otra persona y proceda a borrarlo de inmediato.
>=20
> En cumplimiento de la Ley Org=E1nica 15/1999 de 13 de diciembre de
> protecci=F3n de datos de car=E1cter personal, Internet Security Auditors
> S.L., le informa de que sus datos personales se han incluido en
> ficheros informatizados titularidad de Internet Security Auditors
> S.L., que ser=E1 el =FAnico destinatario de dichos datos, y cuya finalida=
d
> exclusiva es la gesti=F3n de clientes y acciones de comunicaci=F3n
> comercial, y de que tiene la posibilidad de ejercer los derechos de
> acceso, rectificaci=F3n, cancelaci=F3n y oposici=F3n previstos en la ley
> mediante carta dirigida a Internet Security Auditors, c. Santander,
> 101. Edif. A. 2=BA 1=AA, 08030 Barcelona, o v=EDa e-mail a la siguiente
> direcci=F3n de correo: le...@is...
>=20
>=20
>=20
> -------------------------------------------------------
> SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
> from IBM. Find simple to follow Roadmaps, straightforward articles,
> informative Webcasts and more! Get everything you need to get up to
> speed, fast. http://ads.osdn.com/?ad_idt77&alloc_id=16492&opclick
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>

Re: [mod-security-users] Log and Redirect

[Ivan R. <iv...@we...>]

Christian Martorella wrote:
> Hi all, somebody knows if it is possible for a rule to redirect and log?
> I was trying but i could'nt  my rules where like these:
> 
> SecFilterSelective ARG_login ".{12,}" "log,redirect:http://www.mypage.com/"
> 
> or
> 
> SecFilterSelective ARG_login ".{12,}" "redirect:http://www.mypage.com/,log"

   Which Apache + mod_security are you using?

   This is what I get with Apache 2.x and 1.8.7:

SecFilter 111 log,redirect:http://www.modsecurity.org

[Wed Jun 22 17:37:20 2005] [error] [client 192.168.2.11] mod_security: 
Access denied with redirect to [http://www.modsecurity.org]. Pattern 
match "111" at THE_REQUEST [hostname "192.168.2.101"] [uri "/111"]

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Log and Redirect

[Christian M. <cma...@is...>]

Hi all, somebody knows if it is possible for a rule to redirect and log?
I was trying but i could'nt  my rules where like these:

 SecFilterSelective ARG_login ".{12,}" "log,redirect:http://www.mypage.co=
m/"

or

SecFilterSelective ARG_login ".{12,}" "redirect:http://www.mypage.com/,lo=
g"

Thanks in advance

--=20
_________________________________
Christian Martorella
e-Security Engineer
cma...@is...

Internet Security Auditors, S.L.
c. Santander, 101. Edif. A. 2=BA 1=AA.
08030 Barcelona
Tel: 93 305 13 18
Fax: 93 278 22 48
www.isecauditors.com
          ____________________________________
Este mensaje y los documentos que, en su caso lleve anexos, pueden
contener informaci=F3n confidencial. Por ello, se informa a quien lo
reciba por error que la informaci=F3n contenida en el mismo es reservada
y su uso no autorizado est=E1 prohibido legalmente, por lo que en tal
caso le rogamos que nos lo comunique por la misma v=EDa o por tel=E9fono
(93 305 13 18), se abstenga de realizar copias del mensaje o remitirlo
o entregarlo a otra persona y proceda a borrarlo de inmediato.

En cumplimiento de la Ley Org=E1nica 15/1999 de 13 de diciembre de
protecci=F3n de datos de car=E1cter personal, Internet Security Auditors
S.L., le informa de que sus datos personales se han incluido en
ficheros informatizados titularidad de Internet Security Auditors
S.L., que ser=E1 el =FAnico destinatario de dichos datos, y cuya finalida=
d
exclusiva es la gesti=F3n de clientes y acciones de comunicaci=F3n
comercial, y de que tiene la posibilidad de ejercer los derechos de
acceso, rectificaci=F3n, cancelaci=F3n y oposici=F3n previstos en la ley
mediante carta dirigida a Internet Security Auditors, c. Santander,
101. Edif. A. 2=BA 1=AA, 08030 Barcelona, o v=EDa e-mail a la siguiente
direcci=F3n de correo: le...@is...

Re: [mod-security-users] Need help understanding rule activity

[Ivan R. <iv...@we...>]

Peter Loron wrote:
> Hi! I've got mod_security 1.8.7 installed against Apache 2.0.46,  CentOS 
> 3.4. I've got some rules (mostly gotroot.com) installed. I  noted after 
> installation that the audit log shows mod_security  catching an attack 
> (see below for log snippet). The attempt in  question was against a 
> phpBB site which was currently not set up: a  non-attack request to the 
> same viewtopic.php would yield a 404.
> 
> When the same attack is run against an active phpBB site (non-attack  
> request would show the proper topic), I get the properly displayed  
> topic and no record in the audit log.
> 
> It seems very odd to me that the presence or absence of a target for  
> the request (viewtopic.php in this case) would matter...I was under  the 
> impression that mod_security processed requests before it ever  made it 
> down to the page serving part of Apache.

   It does. But there are modules that run before mod_security, they
   may interfere by changing the request in some way.


> Can anybody point me to some documentation so I can straighten myself  
> out? Thanks.

   The best way to proceed is to set the debug log to 9, and perform
   an attack in both cases, with and without PHPBB installed.


> Handler: type-map

   This may be a clue. For what purpose are you using mod_negotiate? Try
   turning it off.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Need help understanding rule activity

[Peter L. <pe...@st...>]

Hi! I've got mod_security 1.8.7 installed against Apache 2.0.46,  
CentOS 3.4. I've got some rules (mostly gotroot.com) installed. I  
noted after installation that the audit log shows mod_security  
catching an attack (see below for log snippet). The attempt in  
question was against a phpBB site which was currently not set up: a  
non-attack request to the same viewtopic.php would yield a 404.

When the same attack is run against an active phpBB site (non-attack  
request would show the proper topic), I get the properly displayed  
topic and no record in the audit log.

It seems very odd to me that the presence or absence of a target for  
the request (viewtopic.php in this case) would matter...I was under  
the impression that mod_security processed requests before it ever  
made it down to the page serving part of Apache.

Can anybody point me to some documentation so I can straighten myself  
out? Thanks.

-Pete

========================================
UNIQUE_ID: qpuNOX8AAAEAACdDPfIAAAAH
Request: 66.45.252.82 - - [17/Jun/2005:22:49:31 --0700] "GET / 
viewtopic.php?t=20
746&highlight=%2527%252Esystem(chr(112)%252Echr(101)%252Echr(114)% 
252Echr(108)%2
52Echr(32)%252Echr(45)%252Echr(101)%252Echr(32)%252Echr(34)%252Echr 
(112)%252Echr
(114)%252Echr(105)%252Echr(110)%252Echr(116)%252Echr(32)%252Echr(113)% 
252Echr(40
)%252Echr(106)%252Echr(83)%252Echr(86)%252Echr(111)%252Echr(119)% 
252Echr(77)%252
Echr(115)%252Echr(100)%252Echr(41)%252Echr(34))%252E%2527 HTTP/1.0"  
403 0
Handler: type-map
----------------------------------------
GET /viewtopic.php?t=20746&highlight=%2527%252Esystem(chr(112)%252Echr 
(101)%252E
chr(114)%252Echr(108)%252Echr(32)%252Echr(45)%252Echr(101)%252Echr 
(32)%252Echr(3
4)%252Echr(112)%252Echr(114)%252Echr(105)%252Echr(110)%252Echr(116)% 
252Echr(32)%
252Echr(113)%252Echr(40)%252Echr(106)%252Echr(83)%252Echr(86)%252Echr 
(111)%252Ec
hr(119)%252Echr(77)%252Echr(115)%252Echr(100)%252Echr(41)%252Echr(34)) 
%252E%2527
HTTP/1.0
Host: <withheld>
Accept: */*
User-Agent: Mozilla/4.0
mod_security-message: Access denied with code 403. Pattern match  
"(system|exec|p
assthru|cmd|fopen|exit|fwrite)" at THE_REQUEST
mod_security-action: 403

HTTP/1.0
Content-Length: 412
Connection: close
Content-Type: text/html; charset=iso-8859-1
========================================

Re: [mod-security-users] Anyone know how to get php'smail()to workwith mod_security chroot?

[m0nkey <poo...@wa...>]

Okay..

I got it to work. Wow ldd and strace are rawkin my world. Great tools! I
was able to use ldd on /bin/sh to get the libraries.. but was still not
working. Then with strace on apache I was able to see the files that it
needed after that point. After a few copies.. everything is working great!

Thanks for the help.. much appreciated
pb



> m0nkey wrote:
>> Hello
>>
>> Thanks for the reply... i just got it working:
>>
>> strace -fF apache2 -D SSL -D PHP4 -D SECURITY
>>
>> Here is the output.. during the mail command. I also added a symlink in
>> jail to /bin/sh.. but that didn't fix anything:
>>
>  > ...
>  >
>> 14356 execve("/bin/sh", ["sh", "-c", "/usr/sbin/mini_sendmail -t -i"],
>> [/* 25
>> vars */]) = -1 ELOOP (Too many levels of symbolic links)
>> 14356 exit_group(127)
>>
>>
>> I'm guessing it's related to the symbolic links (of /bin/sh) maybe.
>> Should
>> I just copy over the binary?
>
>    Yes, and whatever the binary needs (see page 43 of Chapter 2 of Apache
>    Security for how to use ldd for that).
>
> --
> Ivan Ristic
> Apache Security (O'Reilly) - http://www.apachesecurity.net
> Open source web application firewall - http://www.modsecurity.org
>
>


______________________________________
Get your FREE 100MB email today at http://www.wapda.com

Re: [SPAM?]: Re: [mod-security-users] Anyone know how to get php'smail() to workwith mod_security chroot?

[Ivan R. <iv...@we...>]

m0nkey wrote:
> Hello
> 
> Thanks for the reply... i just got it working:
> 
> strace -fF apache2 -D SSL -D PHP4 -D SECURITY
> 
> Here is the output.. during the mail command. I also added a symlink in
> jail to /bin/sh.. but that didn't fix anything:
> 
 > ...
 >
> 14356 execve("/bin/sh", ["sh", "-c", "/usr/sbin/mini_sendmail -t -i"], [/* 25
> vars */]) = -1 ELOOP (Too many levels of symbolic links)
> 14356 exit_group(127)
> 
> 
> I'm guessing it's related to the symbolic links (of /bin/sh) maybe. Should
> I just copy over the binary?

   Yes, and whatever the binary needs (see page 43 of Chapter 2 of Apache
   Security for how to use ldd for that).

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Anyone know how to get php'smail() to workwith mod_security chroot?

[m0nkey <poo...@wa...>]

Hello

Thanks for the reply... i just got it working:

strace -fF apache2 -D SSL -D PHP4 -D SECURITY

Here is the output.. during the mail command. I also added a symlink in
jail to /bin/sh.. but that didn't fix anything:

14340 open("/var/www/www.billybob.com/htdocs/m0nkey/mailtest.php",
O_RDONLY) =
26
14340 fstat64(26, {st_mode=S_IFREG|0644, st_size=292, ...}) = 0
14340 fstat64(26, {st_mode=S_IFREG|0644, st_size=292, ...}) = 0
14340 lseek(26, 0, SEEK_CUR)            = 0
14340 lseek(26, 0, SEEK_SET)            = 0
14340 read(26, "<?\n\n$to                     = \"h"..., 8192) = 292
14340 read(26, "", 8192)                = 0
14340 close(26)                         = 0
14340 pipe([26, 27])                    = 0
14340 fork()                            = 14356
14340 close(26)                         = 0
14340 fstat64(27, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
14340 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
0) = 0xb7fe7000
14340 write(27, "To: bi...@bo...\nSub"..., 125) = 125
14340 close(27)                         = 0
14340 waitpid(14356,  <unfinished ...>
14356 getpid()                          = 14356
14356 close(27)                         = 0
14356 dup2(26, 0)                       = 0
14356 close(26)                         = 0
14356 getpid()                          = 14356
14356 rt_sigaction(SIGRTMIN, {SIG_DFL}, NULL, 8) = 0
14356 rt_sigaction(SIGRT_1, {SIG_DFL}, NULL, 8) = 0
14356 rt_sigaction(SIGRT_2, {SIG_DFL}, NULL, 8) = 0
14356 execve("/bin/sh", ["sh", "-c", "/usr/sbin/mini_sendmail -t -i"], [/* 25
vars */]) = -1 ELOOP (Too many levels of symbolic links)
14356 exit_group(127)


I'm guessing it's related to the symbolic links (of /bin/sh) maybe. Should
I just copy over the binary?

Thanks
pb

> m0nkey wrote:
>> Hello Ivan
>>
>> Thanks for replying again. I'm not too familiar with strace. I'm not
>> able
>> to follow the trace when I try to get mail.. Can someone point me in the
>> right direction. Here is what I've been tring to do:
>>
>>
>> strace -fF -p `pidof -s apache2`
>>
>> When I run this.. it just sits on:
>>
>> Process 9862 attached - interrupt to quit
>> semop(9633795, 0xb7d9eb4c, 1 <unfinished ...>
>>
>
> The command you're running will only attach strace to the first pid
> produced
> by `pidof apache2`. -fF will make it attempt to trace any subsequently
> forked
> processes, but it's likely that your apache2 has already spawned a number
> of
> children if you're attaching to a running server.
>
> I think the trick is to run a single worker in debug mode. The following
> should work, though you'll not be able to do this on a working server:
>
> strace -f apache2 -X
>
> It will also produce bucket-loads of output. Consider adding '-e open' to
> your
> strace. Looking for unfound files is probably a good place to start.
>
>
>
>> Thanks much
>> pb
>>
>>
>>>m0nkey wrote:
>>>
>>>>I've installed mini_sendmail and dropped it in my jail:
>>>>
>>>>/var/chroot/apache/usr/sbin/mini_sendmail
>>>>
>>>>I then changed the sendmail_path in /etc/php/apache2-php4/php.ini to
>>>>either:
>>>>/var/chroot/apache/usr/sbin/mini_sendmail
>>>>or
>>>>/usr/sbin/mini_sendmail
>>>>
>>>>I get the exact same result.. which is no mail.. no error. Just to
>>>>clarify, I restart the service with every change.
>>>>
>>>>I also noticed in your box (Apache Security p.47).. that you mention
>>>>adding SMTP=localhost for this case.. I also have that set with no
>>>> luck.
>>>
>>>   Unfortunatelly that's an error, which I failed to spot in time to
>>>   correct. Delivery through SMTP only works on Windows (and Netware I
>>>   think).
>>>
>>>
>>>
>>>>Any ideas how to get this working is greatly appreciated.
>>>
>>>   Use strace to figure out what PHP wants to do. My guess is that it
>>>   tries to execute sendmail through a shell, so you'll probably
>>>   need /bin/sh there as well.
>>>
>>>--
>>>Ivan Ristic
>>>Apache Security (O'Reilly) - http://www.apachesecurity.net
>>>Open source web application firewall - http://www.modsecurity.org
>>>
>>>
>>
>>
>>
>> ______________________________________
>> Get your FREE 100MB email today at http://www.wapda.com
>>
>>
>>
>>
>> -------------------------------------------------------
>> SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
>> from IBM. Find simple to follow Roadmaps, straightforward articles,
>> informative Webcasts and more! Get everything you need to get up to
>> speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>>
>>
>
>
>
> -------------------------------------------------------
> SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
> from IBM. Find simple to follow Roadmaps, straightforward articles,
> informative Webcasts and more! Get everything you need to get up to
> speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>
>


______________________________________
Get your FREE 100MB email today at http://www.wapda.com

Re: [mod-security-users] Anyone know how to get php'smail() to workwith mod_security chroot?

[Terry D. <tdo...@na...>]

m0nkey wrote:
> Hello Ivan
> 
> Thanks for replying again. I'm not too familiar with strace. I'm not able
> to follow the trace when I try to get mail.. Can someone point me in the
> right direction. Here is what I've been tring to do:
> 
> 
> strace -fF -p `pidof -s apache2`
> 
> When I run this.. it just sits on:
> 
> Process 9862 attached - interrupt to quit
> semop(9633795, 0xb7d9eb4c, 1 <unfinished ...>
> 

The command you're running will only attach strace to the first pid produced 
by `pidof apache2`. -fF will make it attempt to trace any subsequently forked 
processes, but it's likely that your apache2 has already spawned a number of 
children if you're attaching to a running server.

I think the trick is to run a single worker in debug mode. The following 
should work, though you'll not be able to do this on a working server:

strace -f apache2 -X

It will also produce bucket-loads of output. Consider adding '-e open' to your 
strace. Looking for unfound files is probably a good place to start.



> Thanks much
> pb
> 
> 
>>m0nkey wrote:
>>
>>>I've installed mini_sendmail and dropped it in my jail:
>>>
>>>/var/chroot/apache/usr/sbin/mini_sendmail
>>>
>>>I then changed the sendmail_path in /etc/php/apache2-php4/php.ini to
>>>either:
>>>/var/chroot/apache/usr/sbin/mini_sendmail
>>>or
>>>/usr/sbin/mini_sendmail
>>>
>>>I get the exact same result.. which is no mail.. no error. Just to
>>>clarify, I restart the service with every change.
>>>
>>>I also noticed in your box (Apache Security p.47).. that you mention
>>>adding SMTP=localhost for this case.. I also have that set with no luck.
>>
>>   Unfortunatelly that's an error, which I failed to spot in time to
>>   correct. Delivery through SMTP only works on Windows (and Netware I
>>   think).
>>
>>
>>
>>>Any ideas how to get this working is greatly appreciated.
>>
>>   Use strace to figure out what PHP wants to do. My guess is that it
>>   tries to execute sendmail through a shell, so you'll probably
>>   need /bin/sh there as well.
>>
>>--
>>Ivan Ristic
>>Apache Security (O'Reilly) - http://www.apachesecurity.net
>>Open source web application firewall - http://www.modsecurity.org
>>
>>
> 
> 
> 
> ______________________________________
> Get your FREE 100MB email today at http://www.wapda.com
> 
> 
> 
> 
> -------------------------------------------------------
> SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
> from IBM. Find simple to follow Roadmaps, straightforward articles,
> informative Webcasts and more! Get everything you need to get up to
> speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> 
> 

Re: [mod-security-users] Anyone know how to get php'smail() to workwith mod_security chroot?

[m0nkey <poo...@wa...>]

Hello Ivan

Thanks for replying again. I'm not too familiar with strace. I'm not able
to follow the trace when I try to get mail.. Can someone point me in the
right direction. Here is what I've been tring to do:


strace -fF -p `pidof -s apache2`

When I run this.. it just sits on:

Process 9862 attached - interrupt to quit
semop(9633795, 0xb7d9eb4c, 1 <unfinished ...>


Thanks much
pb

> m0nkey wrote:
>> I've installed mini_sendmail and dropped it in my jail:
>>
>> /var/chroot/apache/usr/sbin/mini_sendmail
>>
>> I then changed the sendmail_path in /etc/php/apache2-php4/php.ini to
>> either:
>> /var/chroot/apache/usr/sbin/mini_sendmail
>> or
>> /usr/sbin/mini_sendmail
>>
>> I get the exact same result.. which is no mail.. no error. Just to
>> clarify, I restart the service with every change.
>>
>> I also noticed in your box (Apache Security p.47).. that you mention
>> adding SMTP=localhost for this case.. I also have that set with no luck.
>
>    Unfortunatelly that's an error, which I failed to spot in time to
>    correct. Delivery through SMTP only works on Windows (and Netware I
>    think).
>
>
>> Any ideas how to get this working is greatly appreciated.
>
>    Use strace to figure out what PHP wants to do. My guess is that it
>    tries to execute sendmail through a shell, so you'll probably
>    need /bin/sh there as well.
>
> --
> Ivan Ristic
> Apache Security (O'Reilly) - http://www.apachesecurity.net
> Open source web application firewall - http://www.modsecurity.org
>
>


______________________________________
Get your FREE 100MB email today at http://www.wapda.com

[mod-security-users] Re: chroot() and mail

[David F. <Da...@me...>]

Hi,

I find the PHPMailer class is useful to get round this problem. It can
connect to an smtp server outside the chroot (which can still be on the
same machine) even on machines were PHP won't do this directly. It has
loads of other features for sending emails and formatting the headers
etc.

http://phpmailer.sourceforge.net/

Also useful was the Nail mail user agent, not in a chroot, but as an
interface between commands expecting sendmail binaries to be present and
my mail server which is actually qmail. It's very lightweight, and
seems to "just work" without causing trouble.

http://nail.sourceforge.net/

Hope this helps,

David.

>m0nkey wrote:
>> Hello All
>>
>> I have a server using mod_security with chroot enabled. I have php/mysql
>> working fine.. except for one piece. the mail function. Anyone know how to
>> get
>> around this? When this fails.. nothing is written to messages or error_log=
.
>> Removing chroot option, mail() works again.
>

Re: [SPAM?]: Re: [mod-security-users] Anyone know how to get php's mail() to workwith mod_security chroot?

[Sebastian W. <seb...@wo...>]

Hi,

I used qmail in a chroot and it did work fine but I never actually used it 
inside a mod_security chroot. Ivan is right, SMTP delivery only works on 
Win32 as far as I know. Maybe you should give qmail a try?
Bye,
Sebastian