mod-security-users — General discussion about mod_security

Re: [SPAM?]: Re: [mod-security-users] Anyone know how to get php's mail() to workwith mod_security chroot?

[Ivan R. <iv...@we...>]

m0nkey wrote:
> I've installed mini_sendmail and dropped it in my jail:
> 
> /var/chroot/apache/usr/sbin/mini_sendmail
> 
> I then changed the sendmail_path in /etc/php/apache2-php4/php.ini to either:
> /var/chroot/apache/usr/sbin/mini_sendmail
> or
> /usr/sbin/mini_sendmail
> 
> I get the exact same result.. which is no mail.. no error. Just to
> clarify, I restart the service with every change.
> 
> I also noticed in your box (Apache Security p.47).. that you mention
> adding SMTP=localhost for this case.. I also have that set with no luck.

   Unfortunatelly that's an error, which I failed to spot in time to
   correct. Delivery through SMTP only works on Windows (and Netware I
   think).


> Any ideas how to get this working is greatly appreciated.

   Use strace to figure out what PHP wants to do. My guess is that it
   tries to execute sendmail through a shell, so you'll probably
   need /bin/sh there as well.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Anyone know how to get php's mail() to workwith mod_security chroot?

[m0nkey <poo...@wa...>]

I've installed mini_sendmail and dropped it in my jail:

/var/chroot/apache/usr/sbin/mini_sendmail

I then changed the sendmail_path in /etc/php/apache2-php4/php.ini to either:
/var/chroot/apache/usr/sbin/mini_sendmail
or
/usr/sbin/mini_sendmail

I get the exact same result.. which is no mail.. no error. Just to
clarify, I restart the service with every change.

I also noticed in your box (Apache Security p.47).. that you mention
adding SMTP=localhost for this case.. I also have that set with no luck.

Any ideas how to get this working is greatly appreciated.

Thanks
pb



> m0nkey wrote:
>> Hello All
>>
>> I have a server using mod_security with chroot enabled. I have php/mysql
>> working fine.. except for one piece. the mail function. Anyone know how
>> to
>> get
>> around this? When this fails.. nothing is written to messages or
>> error_log.
>> Removing chroot option, mail() works again.
>
>    The problem is not related to mod_security. PHP uses sendmail to
>    send email on Unix. Since there is no sendmail in jail the mail()
>    function does not work. It's somewhat ironic that PHP knows how
>    to send email SMTP but only when it's running on Windows.
>
>    My suggestion is to install mini_sendmail:
>    http://www.acme.com/software/mini_sendmail/
>
>    (Installing sendmail would also work but that would defy the whole
>     point of having chroot in the first place.)
>
>
>> Current versions of packages I'm running:
>>
>> mod_security-1.8.6
>
>    Why not upgrade to 1.8.7? Have a look at the list of things
>    fixed:
>
>    http://www.modsecurity.org/documentation/known-issues.html
>
> --
> Ivan Ristic
> Apache Security (O'Reilly) - http://www.apachesecurity.net
> Open source web application firewall - http://www.modsecurity.org
>
>


______________________________________
Get your FREE 100MB email today at http://www.wapda.com

Re: [mod-security-users] Anyone know how to get php's mail() to work with mod_security chroot?

[Ivan R. <iv...@we...>]

m0nkey wrote:
> Hello All
> 
> I have a server using mod_security with chroot enabled. I have php/mysql
> working fine.. except for one piece. the mail function. Anyone know how to
> get
> around this? When this fails.. nothing is written to messages or error_log.
> Removing chroot option, mail() works again.

   The problem is not related to mod_security. PHP uses sendmail to
   send email on Unix. Since there is no sendmail in jail the mail()
   function does not work. It's somewhat ironic that PHP knows how
   to send email SMTP but only when it's running on Windows.

   My suggestion is to install mini_sendmail:
   http://www.acme.com/software/mini_sendmail/

   (Installing sendmail would also work but that would defy the whole
    point of having chroot in the first place.)


> Current versions of packages I'm running:
> 
> mod_security-1.8.6

   Why not upgrade to 1.8.7? Have a look at the list of things
   fixed:

   http://www.modsecurity.org/documentation/known-issues.html

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Anyone know how to get php's mail() to work with mod_security chroot?

[m0nkey <poo...@wa...>]

Hello All

I have a server using mod_security with chroot enabled. I have php/mysql
working fine.. except for one piece. the mail function. Anyone know how to
get
around this? When this fails.. nothing is written to messages or error_log.
Removing chroot option, mail() works again.

Any help is greatly appreciated.

Current versions of packages I'm running:

mod_security-1.8.6
apache-2.0.54-r7
mod_php-4.3.11


Thanks
pb

______________________________________
Get your FREE 100MB email today at http://www.wapda.com

RE: [mod-security-users] Where can i get mod_security.dll

[Basavaraj, U. <uma...@ci...>]

Thank you I got it

-----Original Message-----
From: Eli [mailto:eli...@ex...]
Sent: Thursday, June 16, 2005 11:28 AM
To: 'Ivan Ristic'; Basavaraj, Umakanth
Cc: mod...@li...
Subject: RE: [mod-security-users] Where can i get mod_security.dll


Ivan wrote:
>    I think you've done the right thing, but if you can't find nmake in
>    the installation that probably means Microsoft are not giving it =
away
>    with the free version of the compiler.

I seem to have a copy of nmake that apparently is included with
ActiveState's Perl installation.  If you download ActiveState Perl =
(free),
in the bin folder is nmake.exe and nmake.err which I assume are all you =
need
for nmake?  I haven't done a compile test though :)

Eli.

RE: [mod-security-users] Where can i get mod_security.dll

[Eli <eli...@ex...>]

Ivan wrote:
>    I think you've done the right thing, but if you can't find nmake in
>    the installation that probably means Microsoft are not giving it =
away
>    with the free version of the compiler.

I seem to have a copy of nmake that apparently is included with
ActiveState's Perl installation.  If you download ActiveState Perl =
(free),
in the bin folder is nmake.exe and nmake.err which I assume are all you =
need
for nmake?  I haven't done a compile test though :)

Eli.

Re: [mod-security-users] Where can i get mod_security.dll

[Ivan R. <iv...@we...>]

Basavaraj, Umakanth wrote:
> I am new to all this could you help me out here is what I did
> 
> Installed VC++ toolkit, Intalled apache 1.3.3 for windows on my local machine
> 
> tried to call nmake and it says unrecongized command, Am I doing anything wrong?
> 
> I did look for nmake file on my machine and none exists.

   I think you've done the right thing, but if you can't find nmake in
   the installation that probably means Microsoft are not giving it away
   with the free version of the compiler.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Positive security

[Ivan R. <iv...@we...>]

Terry Dooher wrote:
> 
> Just an aside about the above filters: I'm using a similar model to 
> protect a a small service that talks to a custom application. Only POST, 
> only one arg (m) and the parameter must at least _look_ like an md5 
> hash. My method uses just one regexp on the payload:
> 
> SecFilterSelective REQUEST_METHOD "!^(POST)$
> SecFilterSelective POST_PAYLOAD "!^m=[0-9a-f]{32}$"
> 
> This works, but am I losing something important by using this one regexp 
> instead of specific references to ARGS_NAMES and ARG_m?

   No, you're fine.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Positive security

[Terry D. <tdo...@na...>]

Ivan Ristic wrote:

 >
 >
 > <Location /user_view.php>
 > # This script only accepts GET
 > SecFilterSelective REQUEST_METHOD !^GET$
 > # Accept only one parameter: id
 > SecFilterSelective ARGS_NAMES !^id$
 > # Parameter id is mandatory, and it must be
 > # a number, 4-14 digits long
 > SecFilterSelective ARG_id !^[[:digit:]]{4,14}$
 > </Location>


Just an aside about the above filters: I'm using a similar model to protect a 
a small service that talks to a custom application. Only POST, only one arg 
(m) and the parameter must at least _look_ like an md5 hash. My method uses 
just one regexp on the payload:

SecFilterSelective REQUEST_METHOD "!^(POST)$
SecFilterSelective POST_PAYLOAD "!^m=[0-9a-f]{32}$"

This works, but am I losing something important by using this one regexp 
instead of specific references to ARGS_NAMES and ARG_m?

Cheers,

Terry.

Re: [mod-security-users] Where can i get mod_security.dll

[Ivan R. <iv...@we...>]

Basavaraj, Umakanth wrote:
> Can we skip step 2 in your process and have a compiler installed on local machine
> and unzip the source and do the nmake

   I am not sure I follow. You don't have to have a compiler on the
   server. Compiling on a local machine is fine. You can then copy the
   DLL wherever you need it. But you can't skip step two. To compile
   you'll need the header files that come with Apache.


-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Positive security

[Ivan R. <iv...@we...>]

David ROBERT wrote:
> Hi,
> 
> I'm interested in mod_security concept. I would like to use a positive security model.
> I've heard about mod_eaccess and mod_parmguard for this model (anyone has experience with this two modules ?). 

   This is a provocation, right?
   (I am just kidding :)

   I've never used either in production. I did inspect the source code of
   mod_parmguard when I was researching this module for my book and I
   wasn't convinced it would work in production. (I informed the author
   about my findings.)

   mod_security can be used for a positive security model as well. For
   example:

<Location /user_view.php>
# This script only accepts GET
SecFilterSelective REQUEST_METHOD !^GET$
# Accept only one parameter: id
SecFilterSelective ARGS_NAMES !^id$
# Parameter id is mandatory, and it must be
# a number, 4-14 digits long
SecFilterSelective ARG_id !^[[:digit:]]{4,14}$
</Location>
<Location /user_add.php>
# This script only accepts POST
SecFilterSelective REQUEST_METHOD !^POST$
# Accept three parameters: firstname, lastname, and email
SecFilterSelective ARGS_NAMES !^(firstname|lastname|email)$
# Parameter firstname is mandatory, and it must
# contain text 1-64 characters long
SecFilterSelective ARG_firstname !^[[:alnum:][:space:]]{1,64}$
# Parameter lastname is mandatory, and it must
# contain text 1-64 characters long
SecFilterSelective ARG_lastname !^[ [:alnum:][:space:]]{1,64}$
# Parameter email is optional, but if it is present
# it must consist only of characters that are
# allowed in an email address
SecFilterSelective ARG_email !(^$|^[[:alnum:].@]{1,64}$)
</Location>

   If the product you want to protect is not changing much then you may
   be able to write a set of rules once and use them for ever. But it is
   very difficult to maintain a set of positive security rules for
   a changing product. Some sort of real-time engine is needed to make
   this task easier.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Positive security

[David R. <da...@om...>]

Hi,

I'm interested in mod_security concept. I would like to use a positive security model.
I've heard about mod_eaccess and mod_parmguard for this model (anyone has experience with this two modules ?). 

I don't find a lot of information about using mod_security denied all by default. It look's like it can be done, but I'd like to have user experience return ?
Anyone here use mod_security with positive security ?

-- 
David ROBERT
http://www.ombrepixel.com/drobert/

[mod-security-users] Re: =?utf-8?b?bW9kX3NzbDo=?= Child could not open SSLMutex lockfile

[K V. <kva...@se...>]

Thai Duong <thaidn <at> gmail.com> writes:

> 
> Hi guys,
> When I chroot my Apache 1.3.x with mod_security, it kept reporting that
> error. I have searched through this list and found that this error had
> been reported one but still there is no solution rite? 
> It seems that this problem only occurs in Apache 1.3, I have
> sucessfully chroot Apache 2.0 with mod_ssl without any problem before.
> Here is my modsec.conf which is included at the end of httpd.conf
> -----------snip-------------
> # Yes, we want to use mod_security
> ClearModuleList
> AddModule mod_security.c
> AddModule ...
> SecFilterEngine On
>  
> SecServerSignature "Microsoft IIS/5.0"
>  
> SecChrootDir /chroot/jail
> ---snip------------
> Any suggestion?
> TIA,
> -T

Our local guru solved this by creating a symbolic link in the chroot jail 
directory, to itself, called the same (magic, don't ask me). So, chroot jail 
directory is /XXX, so we

cd /XXX
ln -s . XXX

It works.

Re: [mod-security-users] Where can i get mod_security.dll

[Ivan R. <iv...@we...>]

Basavaraj, Umakanth wrote:
> I do not have a compiler, is there a website where I can get one and are there any steps 
> listed on the net to do this installation.

   I've used Visual Studio in the past. There is a free compiler
   from Microsoft available here:

   http://msdn.microsoft.com/visualc/vctoolkit2003/

   But I never tried it.

   To compile mod_security on Windows you need to:

   1) Have a compiler installed

   2) Install the Apache branch you want to compile for (just the
      binary version, the source code is not necessary). Make
      sure you use the default path. (If you change the installation
      path you will need to edit the file makefile.win, see below.)

   3) Unpack the mod_security source code, open the
      command prompt, go to the folder where the source
      code is and type:

      nmake -f makefile.win

   That's it.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Book Review: "Apache Security" By O'Reilly

[<bu...@cg...>]

I have published a book review for "Apache Security" By O'Reilly that may be of interest to the list. 

"This book was written by Ivan Ristic, the author of the popular Apache web application firewall 
module mod_security. Naturally this book does discuss how to use mod_security to harden your system, 
but I'm happy to report it isn't his main area of focus. One of the first things that I do while 
reviewing a book is to find all the things that the text doesn't cover that it *really* should have 
and point them out in my review. Simply put this book has everything, and I do mean everything. H
ere's the low down on a per chapter basis."

http://www.cgisecurity.com/articles/apachesecurity.shtml 

- ad...@cg...

Re: [mod-security-users] Where can i get mod_security.dll

[Ivan R. <iv...@we...>]

Basavaraj, Umakanth wrote:
> 

   Nowhere, as far I know. Guenter used to have a version at
   http://www.gknw.com/development/apache/httpd-2.0/ but I can't
   access his web site right now.

   If you have a compiler it's trivial to compile.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] mod_security-message: Invalid multipart/form-data

[Ivan R. <iv...@we...>]

Thai Duong wrote:
> Hi guys,
> 
> When I turned SecFilterScanPOST on and tried to send an email with 
> SquirrelMail, mod-sec reported that error.

   Just that? What is the exact error message you get? Make a test
   with debug logging enabled on level 9 - there may be additional
   messages in the debug log. However, fatal errors are all logged
   to the Apache error log.


> As fas as I know, this error 
> occured due to the fact that SquirrelMail (and many other webmail apps) 
> compose-form has "multipart/form-data" as request encoding even if you 
> dont attach files with your email. When mod-sec sees 
> "multipart/form-data", it expects to see the long POST_PAYLOAD 
> containing the attachments, and ends up with that error when there is no 
> attachment.

   No, that's not the problem. It's something else. Are you using
   a recent version of mod_security?

   I suspect file permissions, but you should find out for sure from
   the debug log.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Logs Console

[Christian M. <cma...@is...>]

>   Hi Christian,
>
>   Sorry for not responding earlier - I've been swamped with work.
>
>   I think it's very functional. Let me know when you have something
>   others can download and use, and I'll post it on the home page.
>
Hi all,

I will send the first version during this week, im polishing some=20
details. :)

Cheers

--=20

_________________________________
Christian Martorella
e-Security Engineer
cma...@is...

Internet Security Auditors, S.L.
c. Santander, 101. Edif. A. 2=BA 1=AA.
08030 Barcelona
Tel: 93 305 13 18
Fax: 93 278 22 48
www.isecauditors.com
          ____________________________________
Este mensaje y los documentos que, en su caso lleve anexos, pueden
contener informaci=F3n confidencial. Por ello, se informa a quien lo
reciba por error que la informaci=F3n contenida en el mismo es reservada
y su uso no autorizado est=E1 prohibido legalmente, por lo que en tal
caso le rogamos que nos lo comunique por la misma v=EDa o por tel=E9fono
(93 305 13 18), se abstenga de realizar copias del mensaje o remitirlo
o entregarlo a otra persona y proceda a borrarlo de inmediato.

En cumplimiento de la Ley Org=E1nica 15/1999 de 13 de diciembre de
protecci=F3n de datos de car=E1cter personal, Internet Security Auditors
S.L., le informa de que sus datos personales se han incluido en
ficheros informatizados titularidad de Internet Security Auditors
S.L., que ser=E1 el =FAnico destinatario de dichos datos, y cuya finalida=
d
exclusiva es la gesti=F3n de clientes y acciones de comunicaci=F3n
comercial, y de que tiene la posibilidad de ejercer los derechos de
acceso, rectificaci=F3n, cancelaci=F3n y oposici=F3n previstos en la ley
mediante carta dirigida a Internet Security Auditors, c. Santander,
101. Edif. A. 2=BA 1=AA, 08030 Barcelona, o v=EDa e-mail a la siguiente
direcci=F3n de correo: le...@is...

[mod-security-users] mod_security-message: Invalid multipart/form-data

[Thai D. <th...@gm...>]

Hi guys,

When I turned SecFilterScanPOST on and tried to send an email with=20
SquirrelMail, mod-sec reported that error. As fas as I know, this error=20
occured due to the fact that SquirrelMail (and many other webmail apps)=20
compose-form has "multipart/form-data" as request encoding even if you dont=
=20
attach files with your email. When mod-sec sees "multipart/form-data", it=
=20
expects to see the long POST_PAYLOAD containing the attachments, and ends u=
p=20
with that error when there is no attachment. The quick solution is...to tur=
n=20
SecFilterScanPOST off :). How about a real solution? Any suggestion?=20

Regards,

Thai Duong.

[mod-security-users] Where can i get mod_security.dll

[Basavaraj, U. <uma...@ci...>]

Re: [mod-security-users] Logs Console

[Ivan R. <iv...@we...>]

Christian Martorella wrote:
> Hi all, i saw Modseclogwatch ,and i thought it was ok, but i wanted 
> something more like
> ACID or BASE, so I used the code of Evert Daman as a base for a console 
> like those.
> I did some work this weekend here is a demo:
> 
> http://laramies.no-ip.org/mod_sec_test/
> 
> My Todo list have:
> 
> -A Search form
> -A delete field in the table
> -Some graphics bars/pies with GD
> -Configuration screen for the install/setup
> -Multiple language version
> -Use css for everything
> -Beautify some outputs
> -Session control
> 
> I will work in the frontend and Evert will keep working on the parser
> 
> The code will be available as soon as i finish the first version, and Evert
> correct a problem with the parsing of some headers.
> 
> Tell me what you think..

   Hi Christian,

   Sorry for not responding earlier - I've been swamped with work.

   I think it's very functional. Let me know when you have something
   others can download and use, and I'll post it on the home page.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Mod Security issue

[Ivan R. <iv...@we...>]

Yair wrote:
> Hi!
> 
> I'm using FC2 (apache 1.3) with mod_security, I wanted to ask if there 
> is a way to "block" words via mod_security.

   Yes, there is. You'll find more information in the manual. Also,
   you can look at the example rules distributed with mod_security,
   the converted Snort rules, or the rules available elsewhere:

   http://www.gotroot.com/mod_security+rules
   http://www.infiltrated.net/modsecrules

   mod_security rule generator:
   http://leavesrustle.com/tools/modsecurity/


> For example:
> 
> If somebody make a post with a board that is hosted on my server with 
> the word "wget" or "su root" then it will redirect the page to abuse.*my 
> domain*.com (but for every site, html / php ).

   Sure, but FYI if you are running a forum of some kind it is usually
   difficult to distinguish such attacks from people discussing Unix
   tools.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Tomcat

[Ivan R. <iv...@we...>]

Adrian Wilford wrote:
> Hi,
> Anyone know if there is any effort to get mod_security to work with Tomcat?

   It already does, provided you are using Apache as a frontend.


> If not, does anyone know  where I can get the source code of mod_security for 
> java?

   On the download page? :)

   http://www.modsecurity.org/download/

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Tomcat

[Adrian W. <ad...@pe...>]

Hi,
Anyone know if there is any effort to get mod_security to work with Tomcat?
If not, does anyone know  where I can get the source code of mod_security for 
java?

thanks,
Adrian
 
----------------------------------------------------------------
Adrian Wilford
Email (Home): awi...@gm...
Email (Work): ad...@pe...

Work: +27 11 722 7498
Cell: +27 83 260 4034
----------------------------------------------------------------

[mod-security-users] Logs Console

[Christian M. <cma...@is...>]

Hi all, i saw Modseclogwatch ,and i thought it was ok, but i wanted somet=
hing more like
ACID or BASE, so I used the code of Evert Daman as a base for a console l=
ike those.
I did some work this weekend here is a demo:

http://laramies.no-ip.org/mod_sec_test/

 My Todo list have:

 -A Search form
 -A delete field in the table
 -Some graphics bars/pies with GD
 -Configuration screen for the install/setup
 -Multiple language version
 -Use css for everything
 -Beautify some outputs
 -Session control

I will work in the frontend and Evert will keep working on the parser

The code will be available as soon as i finish the first version, and Eve=
rt
correct a problem with the parsing of some headers.
=20
Tell me what you think..


--=20
_________________________________
Christian Martorella
e-Security Engineer
cma...@is...

Internet Security Auditors, S.L.
c. Santander, 101. Edif. A. 2=BA 1=AA.
08030 Barcelona
Tel: 93 305 13 18
Fax: 93 278 22 48
www.isecauditors.com
____________________________________
Este mensaje y los documentos que, en su caso lleve anexos, pueden
contener informaci=F3n confidencial. Por ello, se informa a quien lo
reciba por error que la informaci=F3n contenida en el mismo es reservada
y su uso no autorizado est=E1 prohibido legalmente, por lo que en tal
caso le rogamos que nos lo comunique por la misma v=EDa o por tel=E9fono
(93 305 13 18), se abstenga de realizar copias del mensaje o remitirlo
o entregarlo a otra persona y proceda a borrarlo de inmediato.

En cumplimiento de la Ley Org=E1nica 15/1999 de 13 de diciembre de
protecci=F3n de datos de car=E1cter personal, Internet Security Auditors
S.L., le informa de que sus datos personales se han incluido en
ficheros informatizados titularidad de Internet Security Auditors
S.L., que ser=E1 el =FAnico destinatario de dichos datos, y cuya finalida=
d
exclusiva es la gesti=F3n de clientes y acciones de comunicaci=F3n
comercial, y de que tiene la posibilidad de ejercer los derechos de
acceso, rectificaci=F3n, cancelaci=F3n y oposici=F3n previstos en la ley
mediante carta dirigida a Internet Security Auditors, c. Santander,
101. Edif. A. 2=BA 1=AA, 08030 Barcelona, o v=EDa e-mail a la siguiente
direcci=F3n de correo: le...@is...