mod-security-users — General discussion about mod_security

Re: [mod-security-users] How to block request that don't have a specific cookie

[Ryan B. <rcb...@gm...>]

You should be able to achieve this by creating the following filter -

SecFilterSelective HTTP_COOKIE "!cookietest"

If I then make the following request (without supplying a cookie
header at all) it will be denied -

# telnet localhost 80
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
GET / HTTP/1.0

HTTP/1.1 403 Forbidden

Here was the error message logged -

May 26 11:10:27 metacortex httpd[12206]: [error] [client 127.0.0.1]
mod_security: Access denied with code 403. Pattern match "!cookietest"
at HEADER(COOKIE) [uri "/"] [unique_id 0lNfrcCoAWYAAC@uB5MAAAAA]


--=20
Ryan C. Barnett
Web Application Security Consortium (WASC) Member
SANS Instructor: Securing Apache
GCIA, GCFA, GCIH, GSNA, GCUX, GSEC

On 6/4/05, FrzzMan <fr...@gm...> wrote:
> Hello,
>=20
> My site have been DDoSed for a month now :(
>=20
> I tried to set up a filter that block every request that don't have a
> specific cookie, but I can't find noway to
> set it up, it can check a existed cookie to match the value,
> but if that cookie is not existed, it allow the
> request.
>=20
> Please help... thank you in advance.
>=20
>=20
>=20
> -------------------------------------------------------
> This SF.Net email is sponsored by: NEC IT Guy Games.  How far can you sho=
tput
> a projector? How fast can you ride your desk chair down the office luge t=
rack?
> If you want to score the big prize, get to know the little guy.
> Play to win an NEC 61" plasma display: http://www.necitguy.com/?r=3D20
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>

[mod-security-users] How to block request that don't have a specific cookie

[FrzzMan <fr...@gm...>]

Hello,

My site have been DDoSed for a month now :(

I tried to set up a filter that block every request that don't have a
specific cookie, but I can't find noway to 
set it up, it can check a existed cookie to match the value,
but if that cookie is not existed, it allow the 
request.

Please help... thank you in advance.

[mod-security-users] SecChrootDir and uploading files

[peceka <pe...@gm...>]

Hi,


does anybody know about problems with uploading files when using SecChrootD=
ir?

<IfModule mod_security.c>

   SecChrootLock modsec_chroot.lock
   SecChrootDir /usr/chroot/apache

SecFilterEngine DynamicOnly
SecFilterDefaultAction "deny,log,status:403"

# Some sane defaults
SecFilterScanPOST On
SecFilterCheckURLEncoding On
SecFilterCheckCookieFormat Off
SecFilterCheckUnicodeEncoding Off

# Accept almost all byte values
SecFilterForceByteRange 1 255

SecUploadDir /tmp
SecUploadKeepFiles On

# Only record the interesting stuff
SecAuditEngine RelevantOnly
SecAuditLog /var/log/httpd/audit_log

# You normally won't need debug logging
SecFilterDebugLevel 9
SecFilterDebugLog /var/log/httpd/modsec_debug_log


# Accept only valid protocol versions, helps
# fight HTTP fingerprinting.
SecFilterSelective SERVER_PROTOCOL !^HTTP/(0\.9|1\.0|1\.1)$

# Require the Host header field to be present.
SecFilterSelective HTTP_Host ^$

# Allow supported request methods only.
SecFilterSelective REQUEST_METHOD !^(GET|HEAD|POST)$

# Only accept request encodings we know how to handle
# we exclude GET requests from this because some (automated)
# clients supply "text/html" as Content-Type
SecFilterSelective REQUEST_METHOD "!^(GET|HEAD)$" chain
SecFilterSelective HTTP_Content-Type \
"!(^application/x-www-form-urlencoded$|^multipart/form-data;)"

# Require Content-Length to be provided with
# every POST request
SecFilterSelective REQUEST_METHOD "^POST$" chain
SecFilterSelective HTTP_Content-Length "^$"

# Don't accept transfer encodings we know we don't handle
# (and you don't need it anyway)
SecFilterSelective HTTP_Transfer-Encoding "!^$"

</IfModule>





web3d# pwd
/usr/chroot/apache
web3d# ls -al
total 10
drwxr-xr-x  5 root  wheel  512 Jun  2 10:18 .
drwxr-xr-x  3 root  wheel  512 Jun  1 11:29 ..
drwxrwxrwt  2 root  wheel  512 Jun  3 17:26 tmp
drwxr-xr-x  3 root  wheel  512 Jun  2 10:18 usr
drwxr-xr-x  5 root  wheel  512 Jun  3 17:21 var
web3d# ls -lR var
total 6
drwxr-xr-x  3 root  wheel  512 Jun  3 15:46 log
drwxr-xr-x  2 root  wheel  512 Jun  3 17:55 run
drwxrwxrwt  2 root  wheel  512 Jun  3 17:21 tmp

var/log:
total 2
drwxrwxrwt  2 root  wheel  512 Jun  3 15:46 httpd

var/log/httpd:
total 0

var/run:
total 0
-rw-------  1 root  wheel  0 Jun  3 17:55 httpd.lock.1236

var/tmp:
total 0
web3d#





script which uploads files on server:
web3d# cat temp.php


<form action=3D'temp.php' method=3D"post">
<input type=3Dfile name=3Df >
<br>
<?
print_r($HTTP_POST_FILES );
?>
<br>
<input type=3Dhidden value=3D'hid'>
<input type=3Dsubmit>
web3d#


and all the time $HTTP_POST_FILES  shows me:
Array ( )


TIA,
p.

[mod-security-users] SecChrootDir and uploading files

[peceka <pe...@gm...>]

Hi,


does anybody know about problems with uploading files when using 
SecChrootDir?

<IfModule mod_security.c>

    SecChrootLock modsec_chroot.lock
    SecChrootDir /usr/chroot/apache

SecFilterEngine DynamicOnly
SecFilterDefaultAction "deny,log,status:403"

# Some sane defaults
SecFilterScanPOST On
SecFilterCheckURLEncoding On
SecFilterCheckCookieFormat Off
SecFilterCheckUnicodeEncoding Off

# Accept almost all byte values
SecFilterForceByteRange 1 255

SecUploadDir /tmp
SecUploadKeepFiles On

# Only record the interesting stuff
SecAuditEngine RelevantOnly
SecAuditLog /var/log/httpd/audit_log

# You normally won't need debug logging
SecFilterDebugLevel 9
SecFilterDebugLog /var/log/httpd/modsec_debug_log


# Accept only valid protocol versions, helps
# fight HTTP fingerprinting.
SecFilterSelective SERVER_PROTOCOL !^HTTP/(0\.9|1\.0|1\.1)$

# Require the Host header field to be present.
SecFilterSelective HTTP_Host ^$

# Allow supported request methods only.
SecFilterSelective REQUEST_METHOD !^(GET|HEAD|POST)$

# Only accept request encodings we know how to handle
# we exclude GET requests from this because some (automated)
# clients supply "text/html" as Content-Type
SecFilterSelective REQUEST_METHOD "!^(GET|HEAD)$" chain
SecFilterSelective HTTP_Content-Type \
"!(^application/x-www-form-urlencoded$|^multipart/form-data;)"

# Require Content-Length to be provided with
# every POST request
SecFilterSelective REQUEST_METHOD "^POST$" chain
SecFilterSelective HTTP_Content-Length "^$"

# Don't accept transfer encodings we know we don't handle
# (and you don't need it anyway)
SecFilterSelective HTTP_Transfer-Encoding "!^$"

</IfModule>





web3d# pwd
/usr/chroot/apache
web3d# ls -al
total 10
drwxr-xr-x  5 root  wheel  512 Jun  2 10:18 .
drwxr-xr-x  3 root  wheel  512 Jun  1 11:29 ..
drwxrwxrwt  2 root  wheel  512 Jun  3 17:26 tmp
drwxr-xr-x  3 root  wheel  512 Jun  2 10:18 usr
drwxr-xr-x  5 root  wheel  512 Jun  3 17:21 var
web3d# ls -lR var
total 6
drwxr-xr-x  3 root  wheel  512 Jun  3 15:46 log
drwxr-xr-x  2 root  wheel  512 Jun  3 17:55 run
drwxrwxrwt  2 root  wheel  512 Jun  3 17:21 tmp

var/log:
total 2
drwxrwxrwt  2 root  wheel  512 Jun  3 15:46 httpd

var/log/httpd:
total 0

var/run:
total 0
-rw-------  1 root  wheel  0 Jun  3 17:55 httpd.lock.1236

var/tmp:
total 0
web3d#





script which uploads files on server:
web3d# cat temp.php


<form action='temp.php' method="post">
<input type=file name=f >
<br>
<?
print_r($HTTP_POST_FILES );
?>
<br>
<input type=hidden value='hid'>
<input type=submit>
web3d#


and all the time $HTTP_POST_FILES  shows me:
Array ( )


TIA,
p.

[mod-security-users] Mod Security issue

[Yair <hac...@gm...>]

Hi!

I'm using FC2 (apache 1.3) with mod_security, I wanted to ask if there is a
way to "block" words via mod_security.

For example:

If somebody make a post with a board that is hosted on my server with the
word "wget" or "su root" then it will redirect the page to abuse.*my
domain*.com (but for every site, html / php ).

 

Thanks, Yair

 

Re: [mod-security-users] Re: Using SecChrootDir Directive

[Ryan B. <rcb...@gm...>]

The error message in the logs most likely indicates that the apache
process is reading the chrooted httpd.conf file (which has the 'User
nobody' directive set) and is checking this against the chrooted
/etc/passwd file (which most likely does not not have an entry for the
'nobody' account).

Try and trace/strace your apachectl command to verify which files it
is accessing -

# strace -f -e trace=3Dopen /usr/local/sbin/apachectl graceful

--=20
Ryan C. Barnett
Web Application Security Consortium (WASC) Member
SANS Instructor: Securing Apache
GCIA, GCFA, GCIH, GCUX, GSEC


On 6/2/05, peceka <pe...@gm...> wrote:
> Hi Ivan,
>=20
> >
> >   Everything else can remain outside jail but there are consequences
> >   (e.g. you won't be able to restart Apache, just stop-start it).
> >
>=20
> Why i'm not able to restart Apache?
> When using /usr/local/sbin/apachectl graceful
>=20
> All httpd processes die and in logs i've got:
> httpd: bad user name nobody
>=20
>=20
> But in httpd.conf:
> User www
> Group www
>=20
>=20
> TIA
>=20
> p.
>=20
>=20
>=20
> -------------------------------------------------------
> This SF.Net email is sponsored by Yahoo.
> Introducing Yahoo! Search Developer Network - Create apps using Yahoo!
> Search APIs Find out how you can build Yahoo! directly into your own
> Applications - visit http://developer.yahoo.net/?fr=3Doffad-ysdn-ostg-q22=
005
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>

Re: [mod-security-users] Re: Using SecChrootDir Directive

[Ivan R. <iv...@we...>]

peceka wrote:
> Hi Ivan,
> 
>>
>>   Everything else can remain outside jail but there are consequences
>>   (e.g. you won't be able to restart Apache, just stop-start it).
>>
> 
> Why i'm not able to restart Apache?

   For a restart to take place the main Apache process must be able
   to re-read the configuration. If the httpd.conf if outside jail
   it won't be able to access it.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Re: Using SecChrootDir Directive

[peceka <pe...@gm...>]

Hi Ivan,

> 
>   Everything else can remain outside jail but there are consequences
>   (e.g. you won't be able to restart Apache, just stop-start it).
> 

Why i'm not able to restart Apache?
When using /usr/local/sbin/apachectl graceful

All httpd processes die and in logs i've got:
httpd: bad user name nobody


But in httpd.conf:
User www
Group www


TIA

p.

Re: [mod-security-users] Apache Version

[Ivan R. <iv...@we...>]

die...@b-... wrote:
> Hello,
> 
> I read in a forum a few months ago that a few fonctionalities of the
> mod_security work not correctly for an apache 1.3.
> Is it right ?

   The way you've said it - no, it's not correct.

   Apache 1.3 does not support output filtering so mod_security does not
   support it either. This feature does work in Apache 2.x.

   Apart from that, you only need to pay attention to the differences
   between the regular expression differences in Apache 1 (POSIX) and
   Apache 2 (PCRE).

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Apache Version

[<die...@b-...>]

Hello,

I read in a forum a few months ago that a few fonctionalities of the
mod=5Fsecurity work not correctly for an apache 1.3.
Is it right =3F

Thank you very much

Di=E9go


 Vanden Bossche Di=E9go - IT Architect
 Service informatique - HICT 215 -=20Section 13/2
 Porte de Halle 41,58
 B-1060 Bruxelles

 ( 02\5283513

  E-mails : die...@B-...

Re: [mod-security-users] Re: mod_ssl: Child could not open SSLMutex lockfile

[Ivan R. <iv...@we...>]

peceka wrote:
> Hi Ivan,

> I've got this same error (FreeBSD and apache+mod_ssl-1.3.33+2.8.22).

   OK, I have figured it out. But first here's a step-by-step guide
   that I've always been using and that always worked:

   I've just made a fresh install of Apache 1.3.33 + mod_ssl
   mod_ssl-2.8.22-1.3.33 + mod_security 1.8.7. Here is what I did:

---
tar zxvf apache_1.3.33.tar.gz
tar zxvf mod_ssl-2.8.22-1.3.33.tar.gz
tar zxvf modsecurity-1.8.7.tar.gz

cd mod_ssl-2.8.22-1.3.33
./configure --with-apache=../apache_1.3.33

cd ../cd apache_1.3.33
./configure \
--prefix=/usr/local/apache \
--enable-module=ssl \
--enable-module=so

make
make certificate
make install

/usr/local/apache/bin/apachectl startssl

[Made sure Apache + SSL works]

/usr/local/apache/bin/apachectl stop

cd /usr/local/src/modsecurity-1.8.7/apache1/
/usr/local/apache/bin/apxs -cia mod_security.c

[Added SecChrootDir /chroot/apache to the end of httpd.conf]

mkdir -p /chroot/apache/usr/local
cd /usr/local
mv apache /chroot/apache/usr/local
ln -s /chroot/apache/usr/local/apache

/usr/local/apache/bin/apachectl startssl

[Woohoo!]

---

Anyway, back to the problem. It appears that mod_ssl creates the 
lockfile before the chroot takes place, closes it, and then wants to 
open it again later, after the chroot. It's not smart enough to create a 
new lock file if it doesn't find one. So if you are attempting to create 
an Apache jail that leaves its logs/ folder outside you get the error 
message. There are two solutions:

1) Easy - use "SSLMutex sem"
2) Dirty - move the logs/ folder into the jail, and create a symlink
            to it from the outside (like I did with the main Apache
            folder in the example above). It is not necessary to move
            all logs into the jail - you can tell mod_ssl (using
            SSLMutex file:/xxx) to place the mutex files somewhere else.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Re: mod_ssl: Child could not open SSLMutex lockfile

[peceka <pe...@gm...>]

Hi Ivan,


I've got this same error (FreeBSD and apache+mod_ssl-1.3.33+2.8.22).

In httpd.conf I've got:

<IfModule mod_security.c>

    SecChrootLock modsec_chroot.lock
    SecChrootDir /usr/chroot/apache

</IfModule>


When I hadn't go SecChrootLock in my /var/log/httpd-error.log i've got:
[Fri May 27 16:14:37 2005] [info] mod_unique_id: using ip 1.2.3.4
[Fri May 27 16:14:38 2005] [error] mod_security: unable to create chroot 
lock "/usr/local/logs/modsec_chroot.lock", errno=2(No such file or 
directory)

even if i've got /usr/local/logs in my /usr/chroot/apache...

So I've added SecChrootLock modsec_chroot.lock and now it's ok.

But returning to main topic ;)

web2# ls -lR /usr/chroot/apache/
total 4
drwxr-xr-x  3 root  wheel  512 May 27 16:08 usr
drwxr-xr-x  3 root  wheel  512 May 27 15:59 var

/usr/chroot/apache/usr:
total 2
drwxr-xr-x  3 root  wheel  512 May 27 16:09 local

/usr/chroot/apache/usr/local:
total 2
drwxr-xr-x  3 root  wheel  512 May 27 16:09 logs

/usr/chroot/apache/usr/local/logs:
total 2
drwxr-xr-x  2 www  www  512 May 27 16:09 ssl_scache

/usr/chroot/apache/usr/local/logs/ssl_scache:
total 0

/usr/chroot/apache/var:
total 2
drwxrwxrwx  2 root  wheel  512 May 27 16:14 run

/usr/chroot/apache/var/run:
total 0


And now after staring Apache i've got in /var/log/httpd-error.log:
[Fri May 27 16:42:56 2005] [info] mod_unique_id: using ip addr 1.2.3.4
[Fri May 27 16:42:57 2005] [notice] mod_security: chroot checkpoint #1 
(pid=4068 ppid=4061)
[Fri May 27 16:42:57 2005] [info] (2)No such file or directory: 
make_sock: for port 443, setsockopt: (SO_ACCEPTFILTER)
[Fri May 27 16:42:57 2005] [info] (2)No such file or directory: 
make_sock: for port 80, setsockopt: (SO_ACCEPTFILTER)
[Fri May 27 16:42:57 2005] [warn] pid file /var/run/httpd.pid 
overwritten -- Unclean shutdown of previous Apache run?
[Fri May 27 16:42:57 2005] [info] mod_unique_id: using ip addr 1.2.3.4
[Fri May 27 16:42:58 2005] [notice] mod_security: chroot checkpoint #2 
(pid=4069 ppid=1)
[Fri May 27 16:42:58 2005] [notice] mod_security: chroot successful, 
path=/usr/chroot/apache
[Fri May 27 16:42:58 2005] [notice] Microsoft-IIS/5.0 configured -- 
resuming normal operations
[Fri May 27 16:42:58 2005] [error] mod_ssl: Child could not open 
SSLMutex lockfile /var/run/ssl_mutex.4068 (System error follows)
[Fri May 27 16:42:58 2005] [error] mod_ssl: Child could not open 
SSLMutex lockfile /var/run/ssl_mutex.4068 (System error follows)
[Fri May 27 16:42:58 2005] [error] mod_ssl: Child could not open 
SSLMutex lockfile /var/run/ssl_mutex.4068 (System error follows)
[Fri May 27 16:42:58 2005] [error] mod_ssl: Child could not open 
SSLMutex lockfile /var/run/ssl_mutex.4068 (System error follows)
[Fri May 27 16:42:58 2005] [error] mod_ssl: Child could not open 
SSLMutex lockfile /var/run/ssl_mutex.4068 (System error follows)
[Fri May 27 16:42:58 2005] [info] Server built: May  8 2005 08:16:10
[Fri May 27 16:42:58 2005] [error] System: No such file or directory 
(errno: 2)
[Fri May 27 16:42:58 2005] [error] System: No such file or directory 
(errno: 2)
[Fri May 27 16:42:58 2005] [error] System: No such file or directory 
(errno: 2)
[Fri May 27 16:42:58 2005] [error] System: No such file or directory 
(errno: 2)
[Fri May 27 16:42:58 2005] [error] System: No such file or directory 
(errno: 2)
[Fri May 27 16:42:58 2005] [notice] Accept mutex: flock (Default: flock)
[Fri May 27 16:42:59 2005] [error] mod_ssl: Child could not open 
SSLMutex lockfile /var/run/ssl_mutex.4068 (System error follows)
[Fri May 27 16:42:59 2005] [error] System: No such file or directory 
(errno: 2)
[Fri May 27 16:43:00 2005] [error] mod_ssl: Child could not open 
SSLMutex lockfile /var/run/ssl_mutex.4068 (System error follows)
[Fri May 27 16:43:00 2005] [error] mod_ssl: Child could not open 
SSLMutex lockfile /var/run/ssl_mutex.4068 (System error follows)
[Fri May 27 16:43:00 2005] [error] System: No such file or directory 
(errno: 2)
[Fri May 27 16:43:00 2005] [error] System: No such file or directory 
(errno: 2)
[Fri May 27 16:43:01 2005] [error] mod_ssl: Child could not open 
SSLMutex lockfile /var/run/ssl_mutex.4068 (System error follows)

I think that i've got correct directory structure and Apache have got 
perm to write in dirs...


Best Regards,
p.

[mod-security-users] Re: Re: Log-parser

[Evert <ev...@di...>]

> The problem with this approach is
> what will your script do if the client submits non-standard client
> headers?  Will this be reported?

nope. but i hadn't seen any other tokens then the tokens i search for
in my parser script, so i didn't know that others where available.
what i can do is make an extra field in the dbase with 'other tokens'
then the tokens i search for... or redesign the parser to include only
the tokens that are available for a specific 'attack'. hmm. let me think
about this.

maybe you can help me a bit by sending some entries of your audit_log
with those extra headers.

kind regards,
Evert

Re: [mod-security-users] Re: Log-parser

[Ryan B. <rcb...@gm...>]

Evert,
Thanks for posting that code!  Hey, I have one question/comment for
you with regards to the "details" page of your script.  Let's take
this log entry as an example -
http://evert.dyndns.org/modsec/index.php?detail=3D86.

Would it be possible to have the script "only" dump the environmental
tokens that were present rather than having a bunch of tokens
null/empty?  The reason that I ask this question is not for aesthetic
pusposes but a more practical reason.  I am assuming that you have
hard coded sections to search for these specific tokens and then
report them in the output file.  The problem with this approach is
what will your script do if the client submits non-standard client
headers?  Will this be reported?

I ran into a similar problem with my use of CGI error scripts with
Apache.  Initially I was hard coding in specific tokens of interest.=20
I found, however, that I was missing a few headers.  I found that is
was better to utilize the printenv concept and just dump what was
there.  This will catch rogue client headers.  Doing a quick search of
my audit_log file on my web servers shows a bunch of different client
headers -

Weferer:
Wser-Agent:
X-Authenticated-User:
X-AvantGo-ChannelId:
X-AvantGo-ClientLanguage:
X-AvantGo-ColorDepth:
X-AvantGo-DeviceId:
X-AvantGo-DeviceOS:
X-AvantGo-DeviceOSVersion:
X-AvantGo-DeviceProcessor:
X-AvantGo-PlatformData:
X-AvantGo-ScreenSize:
X-AvantGo-UserId:
X-AvantGo-Version:
X-Base:
X-BlueCoat-Via:
X-EGZ:
X-FORWARDED-FOR:
X-Forwarded-For:
X-ICAP-Version:
X-IMForwards:
X-Moz:
X-NovINet:
X-Novinet:
X-User-Ip:
X-Vermeer-Content-Type:

Thoughts?
--=20
Ryan C. Barnett
Web Application Security Consortium (WASC) Member
SANS Instructor: Securing Apache
GCIA, GCFA, GCIH, GCUX, GSEC




On 5/23/05, Evert <ev...@di...> wrote:
> for al who were interrested. i made my last release available on the web:
> http://www.digipix.org/~evert/modseclogwatch-v0.0.3.tar.gz
>=20
> the time-problem i spoke of in my previous post are solved now. a simple
> readme for installation is included.
>=20
> for any comments and ideas or changes in my code please send me a
> note :)
>=20
> kind regards,
> Evert
>=20
> btw: sorry for some of the dutch comments in my code. will try to
> rewrite them if i have the time.
>=20
>=20
>=20
>=20
>=20
>=20
> -------------------------------------------------------
> This SF.Net email is sponsored by Oracle Space Sweepstakes
> Want to be the first software developer in space?
> Enter now for the Oracle Space Sweepstakes!
> http://ads.osdn.com/?ad_id=3D7412&alloc_id=3D16344&op=3Dclick
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>

[mod-security-users] Re: Log-parser

[Evert <ev...@di...>]

for al who were interrested. i made my last release available on the web:
http://www.digipix.org/~evert/modseclogwatch-v0.0.3.tar.gz

the time-problem i spoke of in my previous post are solved now. a simple
readme for installation is included.

for any comments and ideas or changes in my code please send me a
note :)

kind regards,
Evert

btw: sorry for some of the dutch comments in my code. will try to
rewrite them if i have the time.

Re: [mod-security-users] Re: mod_security v1.8.4 Chroot problem

[Ivan R. <iv...@we...>]

Dan Bethe wrote:
> I've got mod_security 1.8.4 with just the chroot function, httpd 1.3.31, and
> frontpage 2002.  It works fine without chroot.  I haven't tested with suexec
> yet.  With chroot enabled, I'm having troubles with the suidkey.
> 
> With mod_frontpage being loaded *before* mod_security, and with /bin/ps and
> /usr/bin/sum and /proc inside the chroot, frontpage properly creates its
> suidkey.$PID inside the chroot.  fpcounter.exe appears to function, but with the
> counter reset to 1, never incrementing.  There are no errors in error_log either
> of the main server or of the vhost in question.  It's as is mod_frontpage
> believes that it's working, and yet it's apparently not with fpcounter.exe.  The
> administrative web GUI works.  fpcounter.exe and the administrative web GUI are
> the only items I've tested it with.
> 
> Please see my strace output at http://smuckola.org/etc/httpd_strace.text
> 
> Do you have any clues or suggestions?

Could this be the problem?

[pid 25606] open("/home/dtm/public_html//_private/menu.html.cnt", 
O_RDWR) = -1 EACCES (Permission denied)


It is clear the FrontPage module does not check whether the descriptor
is valid or not:

[pid 25606] lseek(-1, 0, SEEK_SET)      = -1 EBADF (Bad file descriptor)
[pid 25606] write(-1, "FPCountFile ", 12) = -1 EBADF (Bad file descriptor)
[pid 25606] write(-1, "00000000001", 11) = -1 EBADF (Bad file descriptor)
[pid 25606] close(-1)                   = -1 EBADF (Bad file descriptor)

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] mod_ssl: Child could not open SSLMutex lockfile

[Ivan R. <iv...@we...>]

Thai Duong wrote:
> Hi guys,
> 
> When I chroot my Apache 1.3.x with mod_security, it kept reporting that 
> error. I have searched through this list and found that this error had 
> been reported one but still there is no solution rite?
> 
> It seems that this problem only occurs in Apache 1.3, I have sucessfully 
> chroot Apache 2.0 with mod_ssl without any problem before. Here is my 
> modsec.conf which is included at the end of httpd.conf
> 
> -----------snip-------------
> 
> # Yes, we want to use mod_security
> ClearModuleList
> AddModule mod_security.c
> AddModule mod_env.c
> AddModule mod_log_config.c
> AddModule mod_mime.c
> AddModule mod_negotiation.c
> AddModule mod_access.c
> AddModule mod_auth.c
> AddModule mod_setenvif.c
> AddModule mod_ssl.c
> AddModule mod_php4.c
>  
> SecFilterEngine On
>  
> SecServerSignature "Microsoft IIS/5.0"
>  
> SecChrootDir /chroot/jail
> 
> ---snip------------
> 
> Any suggestion?

   Use strace to find out what is mod_ssl trying to do.

   How does your directory structure look like? Show us both, the one
   outside jail and the one in /chroot/jail.


> Anyway, I found a solution, just set SSLMutex directive to none, it
> works like a charm.

   FYI with SSLMutex set to none the SSL session cache can become
   corrupted from time to time.


> FYI, I encountered a lot of problems when using mod_security as a
> static module of both apache 1.3.x and httpd 2.x. Most of the problems
> are with the mod_ssl module (also compiled statically). mod_ssl
> complained that it could not open its SSLMutex, and when I set
> SSLMutext to none, it continued complained that it could not write to
> the scache directory, which I have created both in the chroot jail and
> the original path. I also chowned these directories to apache but
> still no luck. It seems that mod_security is not made to use as a
> static module/in a static  server (I meant a server that all modules
> are compiled statically), rite?

   In my experience, it does not matter if Apache is compiled statically
   or the modules are loaded at runtime. It is only the order of
   initialisation that matters. Consequently, mod_security should work
   equally well in both cases.

   The problems you are experiencing are due to the fact mod_ssl
   needs to work with certain files (the cache files and the mutex)
   after chroot takes place. You simply need a correct directory
   structure for that to happen.

   Again, the use of strace would pinpoint the problem.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Log-parser

[Markus R. <we...@mr...>]

really nice looking. i also would be interested ;-)

thanxs

markus

Ryan Barnett wrote:
> Evert,
> That is a cool looking interface.  Reminds me of the SnortSnarf
> output.  I would be interested in the code if you could make it
> available.
> 
> 
> Let me know if anyone is interested in the sgrep.pl script and I will
> post it to the list.
> 
> Thanks,
> 

 >> On 5/10/05, Evert <ev...@di...> wrote:
 >> since there were nog audit_log parsers around i wrote one myself. is 
somebody
 >> interrested in the code? then i can put it online somewhere.
 >>
 >> the ouput is like this: http://evert.dyndns.org/modsec/
 >>
 >> kind regards,
 >> Evert Daman
 >>

[mod-security-users] Re: Log-parser

[Evert <eve...@ho...>]

sure. but there's one little bug in it (this morning i noticed that 20:00 is
put in
the dbase as 2:00, don't know why yet...). when that one is out i'll post my
code here.

kind regards,
Evert



"Ryan Barnett" <rcb...@gm...> wrote in message
news:cba...@ma......
Evert,
That is a cool looking interface.  Reminds me of the SnortSnarf
output.  I would be interested in the code if you could make it
available.

FYI - I am writing a book on Apache security/intrusion detection.  I
am currently writing a chapter on log monitoring/analysis.  I would
like to include this code if you don't mind.  I would of course give
you proper credit :)

Additionally, I have a PERL script I call sgrep.pl that will parse
through the audit_log and extract out an entire record that has the
search text in it.  Here is some example output -

# ./sgrep.pl -f audit_log -s "passwd.txt" |less
========================================
Request: 62.103.182.12 - - [Fri Mar 12 03:55:49 2004] "HEAD
http://www.abrianna.com/ccbill/password/htpasswd.txt  HTTP/1.0" 404 0
Handler: proxy-server
----------------------------------------
HEAD http://www.abrianna.com/ccbill/password/htpasswd.txt  HTTP/1.0
Cache-Control: no-cache
Connection: close
Host: www.abrianna.com
Pragma: no-cache
Proxy-Connection: keep-alive
Referer: http://www.abrianna.com/ccbill/password/htpasswd.txt
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

HTTP/1.0 404 Not Found
Content-Type: text/html; charset=iso-8859-1
X-Cache: MISS from www.testproxy.net
Connection: close


========================================
Request: 217.160.165.173 - - [Fri Mar 12 22:41:17 2004] "GET
/wwwboard/passwd.txt HTTP/1.1" 200 578
Handler: (null)
--CUT--


Let me know if anyone is interested in the sgrep.pl script and I will
post it to the list.

Thanks,

-- 
Ryan C. Barnett
Web Application Security Consortium (WASC) Member
SANS Instructor: Securing Apache
GCIA, GCFA, GCIH, GCUX, GSEC

On 5/10/05, Evert <ev...@di...> wrote:
> since there were nog audit_log parsers around i wrote one myself. is
somebody
> interrested in the code? then i can put it online somewhere.
>
> the ouput is like this: http://evert.dyndns.org/modsec/
>
> kind regards,
> Evert Daman
>
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by Oracle Space Sweepstakes
> Want to be the first software developer in space?
> Enter now for the Oracle Space Sweepstakes!
> http://ads.osdn.com/?ad_id=7412&alloc_id=16344&op=click
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>


-- 
Ryan C. Barnett
Web Application Security Consortium (WASC) Member
SANS Instructor: Securing Apache
GCIA, GCFA, GCIH, GCUX, GSEC


-------------------------------------------------------
This SF.Net email is sponsored by Oracle Space Sweepstakes
Want to be the first software developer in space?
Enter now for the Oracle Space Sweepstakes!
http://ads.osdn.com/?ad_idt12&alloc_id344&op=ick

Re: [mod-security-users] Log-parser

[Ryan B. <rcb...@gm...>]

Evert,
That is a cool looking interface.  Reminds me of the SnortSnarf
output.  I would be interested in the code if you could make it
available.

FYI - I am writing a book on Apache security/intrusion detection.  I
am currently writing a chapter on log monitoring/analysis.  I would
like to include this code if you don't mind.  I would of course give
you proper credit :)

Additionally, I have a PERL script I call sgrep.pl that will parse
through the audit_log and extract out an entire record that has the
search text in it.  Here is some example output -

# ./sgrep.pl -f audit_log -s "passwd.txt" |less
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Request: 62.103.182.12 - - [Fri Mar 12 03:55:49 2004] "HEAD
http://www.abrianna.com/ccbill/password/htpasswd.txt  HTTP/1.0" 404 0
Handler: proxy-server
----------------------------------------
HEAD http://www.abrianna.com/ccbill/password/htpasswd.txt  HTTP/1.0
Cache-Control: no-cache
Connection: close
Host: www.abrianna.com
Pragma: no-cache
Proxy-Connection: keep-alive
Referer: http://www.abrianna.com/ccbill/password/htpasswd.txt
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

HTTP/1.0 404 Not Found
Content-Type: text/html; charset=3Diso-8859-1
X-Cache: MISS from www.testproxy.net
Connection: close


=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Request: 217.160.165.173 - - [Fri Mar 12 22:41:17 2004] "GET
/wwwboard/passwd.txt HTTP/1.1" 200 578
Handler: (null)
--CUT--


Let me know if anyone is interested in the sgrep.pl script and I will
post it to the list.

Thanks,

--=20
Ryan C. Barnett
Web Application Security Consortium (WASC) Member
SANS Instructor: Securing Apache
GCIA, GCFA, GCIH, GCUX, GSEC

On 5/10/05, Evert <ev...@di...> wrote:
> since there were nog audit_log parsers around i wrote one myself. is some=
body
> interrested in the code? then i can put it online somewhere.
>=20
> the ouput is like this: http://evert.dyndns.org/modsec/
>=20
> kind regards,
> Evert Daman
>=20
>=20
>=20
> -------------------------------------------------------
> This SF.Net email is sponsored by Oracle Space Sweepstakes
> Want to be the first software developer in space?
> Enter now for the Oracle Space Sweepstakes!
> http://ads.osdn.com/?ad_id=3D7412&alloc_id=3D16344&op=3Dclick
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>=20


--=20
Ryan C. Barnett
Web Application Security Consortium (WASC) Member
SANS Instructor: Securing Apache
GCIA, GCFA, GCIH, GCUX, GSEC

[mod-security-users] Re: Log-parser

[Evert <eve...@ho...>]

yes, but both weren't webbased....

fixed the login problem :)


"Tom Anderson" <tan...@oa...> wrote in message
news:036b01c55d4e$8dec6800$6ecfcfcf@Betson110...
> From: "Evert" <ev...@di...>
> > since there were nog audit_log parsers around i wrote one myself
>
> There were two audit_log parsers posted to this list just last month.
>
> http://orderamidchaos.com/modsec/modsec_auditlog_parser
> http://prwdot.org/code/modsecauditlogparse.txt
>
> Tom
>
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by Oracle Space Sweepstakes
> Want to be the first software developer in space?
> Enter now for the Oracle Space Sweepstakes!
> http://ads.osdn.com/?ad_id=7412&alloc_id=16344&op=click

Re: [mod-security-users] Log-parser

[Tom A. <tan...@oa...>]

From: "Evert" <ev...@di...>
> since there were nog audit_log parsers around i wrote one myself

There were two audit_log parsers posted to this list just last month.

http://orderamidchaos.com/modsec/modsec_auditlog_parser
http://prwdot.org/code/modsecauditlogparse.txt

Tom

Re: [mod-security-users] Log-parser

[Alberto G. I. <ag...@in...>]

On Tue, May 10, 2005 at 08:04:41AM +0000, Evert wrote:
> since there were nog audit_log parsers around i wrote one myself. is so=
mebody=20
> interrested in the code? then i can put it online somewhere.
>=20
> the ouput is like this: http://evert.dyndns.org/modsec/
>=20
> kind regards,
> Evert Daman

Authorization Required

 This server could not verify that you are authorized to access the
 document requested. Either you supplied the wrong credentials (e.g.,
 bad password), or your browser doesn't understand how to supply the
 credentials required.

:)

--=20
Alberto Gonzalez Iniesta    | Formaci=F3n, consultor=EDa y soporte t=E9cn=
ico
agi@(inittab.org|debian.org)| en GNU/Linux y software libre
Encrypted mail preferred    | http://inittab.com

Key fingerprint =3D 9782 04E7 2B75 405C F5E9  0C81 C514 AF8E 4BA4 01C3

[mod-security-users] Re: =?utf-8?b?bW9kX3NlY3VyaXR5?= v1.8.4 Chroot problem

[Dan B. <gm...@sm...>]

I've got mod_security 1.8.4 with just the chroot function, httpd 1.3.31, and
frontpage 2002.  It works fine without chroot.  I haven't tested with suexec
yet.  With chroot enabled, I'm having troubles with the suidkey.

With mod_frontpage being loaded *before* mod_security, and with /bin/ps and
/usr/bin/sum and /proc inside the chroot, frontpage properly creates its
suidkey.$PID inside the chroot.  fpcounter.exe appears to function, but with the
counter reset to 1, never incrementing.  There are no errors in error_log either
of the main server or of the vhost in question.  It's as is mod_frontpage
believes that it's working, and yet it's apparently not with fpcounter.exe.  The
administrative web GUI works.  fpcounter.exe and the administrative web GUI are
the only items I've tested it with.

Please see my strace output at http://smuckola.org/etc/httpd_strace.text

Do you have any clues or suggestions?

Re: [mod-security-users] Re: mod_ssl: Child could not open SSLMutex lockfile

[Thai D. <th...@gm...>]

FYI, I encountered a lot of problems when using mod_security as a static=20
module of both apache 1.3.x and httpd 2.x. Most of the problems are with th=
e=20
mod_ssl module (also compiled statically). mod_ssl complained that it could=
=20
not open its SSLMutext, and when I set SSLMutext to none, it continued=20
complained that it could not write to the scache directory, which I have=20
created both in the chroot jail and the original path. I also chowned these=
=20
directories to apache but still no luck. It seems that mod_security is not=
=20
made to use as a static module/in a static server (I meant a server that al=
l=20
modules are compiled statically), rite?

-T

On 5/13/05, Thai Duong <th...@gm...> wrote:
>=20
> Hi David,
>=20
> I have created that directory with a correct permission but it doest work=
.=20
> Anyway, I found a solution, just set SSLMutex directive to none, it works=
=20
> like a charm.
>=20
> -T
>=20
>=20
> On 5/12/05, David Fletcher <Da...@me...> wrote:
> >=20
> > Hi TIA,
> >=20
> > I could be on the wrong track, but I think I was getting this error=20
> > until I
> > created the directory
> >=20
> > /chroot/apache/usr/local/apache/logs/ssl_scache
> >=20
> > where the chroot is to /chroot/apache
> >=20
> > If I remember correctly, Apache wants to write there after the chroot=
=20
> > has taken
> > place, by which time it cannot open new files in the log directory in=
=20
> > the main
> > file system. Ensure Apache has write permissions even if the directory=
=20
> > already exists.
> >=20
> > It's a while since I had the problem so I could have this wrong, but it=
=20
> > might
> > help.
> >=20
> > David
> >=20
> > >Subject: [mod-security-users] mod_ssl: Child could not open SSLMutex=
=20
> > lockfile
> > >Reply-To: mod...@li...
> > >
> > >------=3D_Part_2042_9626190.1115640236279
> > >Content-Type: text/plain; charset=3DISO-8859-1
> > >Content-Transfer-Encoding: quoted-printable=20
> > >Content-Disposition: inline
> > >
> > >Hi guys,
> > >
> > >When I chroot my Apache 1.3.x with mod_security, it kept reporting=20
> > that=3D20
> > >error. I have searched through this list and found that this error had=
=20
> > been=3D=20
> > >=3D20
> > >reported one but still there is no solution rite?=3D20
> >=20
> > --
> > ---------------------------------------
> > Email da...@me...
> > ---------------------------------------=20
> >=20
> > -------------------------------------------------------
> > This SF.Net <http://SF.Net> email is sponsored by Oracle Space=20
> > Sweepstakes
> > Want to be the first software developer in space?
> > Enter now for the Oracle Space Sweepstakes!=20
> > http://ads.osdn.com/?ad_id=3D7393&alloc_id=3D16281&op=3Dclick
> > _______________________________________________
> > mod-security-users mailing list=20
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users=20
> >=20
>=20
>