mod-security-users — General discussion about mod_security

[mod-security-users] Gives error 500 through IE but does not error out through firefox

[raja a. <tag...@gm...>]

Hello!

I have confiured modsecurity 1.8.7 and apache2 with the default
configuration and I receive the following error. I had copied
httpd.conf.regression-v2 to the httpd.conf.

[Wed Apr 27 17:20:59 2005] [error] [client xxx.xxx] mod_security: Access d
enied with code 500. Pattern match "!(^$|^[a-zA-Z0-9]+$)" at COOKIES_VALUES=
 [hos
tname "xxx.xxx.xxx"] [uri "/cgi-bin/test-cgi"]

I get this error only through the IE browser but not through the
firefox browser.

Please let me know if I can do something to work with IE.

Regards,
Raja

Re: [mod-security-users] Frontpage 406 error caused by mod_security

[Ivan R. <iv...@we...>]

ch...@bl... wrote:
> Hi,
> 
> I am recieving a 406 error when attempting to publish to a FrontPage subweb.
> This error does not happen when someone is publishing to the root web.
 >
 > ...
 >
> [Wed Apr 27 00:08:16 2005] [error] [client 68.192.115.60] mod_security:
> Access denied with code 406. Pattern match
> "!(^$|^application/x-www-form-urlencoded$|^multipart/form-data;)" at HEADER.
> [hostname "deb.terzano.com"] [uri "/Deb/_vti_bin/_vti_aut/author.exe"]
> [unique_id Qm8eQEI3TBIAAGz@Pxg]
 >
 > ...
 >
> [Wed Apr 27 00:08:23 2005] [error] [client 68.192.115.60] mod_security:
> Warning. Pattern match "/_vti_bin/_vti_aut/author\\.exe" at THE_REQUEST.
> [hostname "deb.terzano.com"] [uri "/Deb/_vti_bin/_vti_aut/author.exe"]
> [unique_id Qm8eR0I3TBIAAGz@Pxk]
> [Wed Apr 27 00:08:23 2005] [error] [client 68.192.115.60] mod_security:
> Warning. Pattern match "/_vti_bin/" at THE_REQUEST. [hostname
> "deb.terzano.com"] [uri "/Deb/_vti_bin/_vti_aut/author.exe"] [unique_id
> Qm8eR0I3TBIAAGz@Pxk]

   Since you want to allow FrontPage requests it does not make sense
   to have warnings in the log when someone uses it.


> So with Frontpage (v. 2000) they can do everything as normal to the root
> web.  In the subwebs you can change security permissions, create new
> directories, and even new subwebs of subwebs, but you cannot save a new or
> edited page.
> 
> Any ideas?

   Send use the audit log fragment of the rejected entry. There is
   something in the Content-Type that clashes with your mod_security
   configuration.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Frontpage 406 error caused by mod_security

[<ch...@bl...>]

Hi,

I am recieving a 406 error when attempting to publish to a FrontPage subweb.
This error does not happen when someone is publishing to the root web.

The error Frontpage shows is:

406 Not Acceptable
Not Acceptable An appropriate representation of the requested resource
/Deb/_vti_bin/_vti_aut/author.exe could not be found on this server.
Apache/1.3.33 Server at deb.terzano.com Port 80


The resulting error log shows the following:

[Wed Apr 27 00:08:16 2005] [error] [client 68.192.115.60] mod_security:
Access denied with code 406. Pattern match
"!(^$|^application/x-www-form-urlencoded$|^multipart/form-data;)" at HEADER.
[hostname "deb.terzano.com"] [uri "/Deb/_vti_bin/_vti_aut/author.exe"]
[unique_id Qm8eQEI3TBIAAGz@Pxg]
[Wed Apr 27 00:08:23 2005] [error] [client 68.192.115.60] mod_security:
Warning. Pattern match "/_vti_bin/_vti_aut/author\\.exe" at THE_REQUEST.
[hostname "deb.terzano.com"] [uri "/Deb/_vti_bin/_vti_aut/author.exe"]
[unique_id Qm8eR0I3TBIAAGz@Pxk]
[Wed Apr 27 00:08:23 2005] [error] [client 68.192.115.60] mod_security:
Warning. Pattern match "/_vti_bin/" at THE_REQUEST. [hostname
"deb.terzano.com"] [uri "/Deb/_vti_bin/_vti_aut/author.exe"] [unique_id
Qm8eR0I3TBIAAGz@Pxk]


So with Frontpage (v. 2000) they can do everything as normal to the root
web.  In the subwebs you can change security permissions, create new
directories, and even new subwebs of subwebs, but you cannot save a new or
edited page.

Any ideas?

Thx,

Don

Re: [mod-security-users] tying log entries to rules

[Peter W. <prw...@gm...>]

> Here's a little something I threw together:
> http://orderamidchaos.com/modsec/modsec_auditlog_parser
>=20
> Use it like this:
>  ./modsec_auditlog_parser < /var/log/apache2/modsec_audit_log |less

I wrote something similar:

http://prwdot.org/code/modsecauditlogparse.txt

But it's more quick and dirty... you are welcome to use the code if it
suits you.

Peter
--=20
Peter R. Wood | email: prw...@gm... | blog: http://prwdot.org/

Re: [mod-security-users] tying log entries to rules

[Tom A. <tan...@oa...>]

----- Original Message ----- 
From: "Ivan Ristic" <iv...@we...>
>> 1) are there any tools for monitoring the audit logs, since the output
>> per hit is multi line the normal approach of "grep"ing is not effective.
>> For example my logs are overwhelmingly phpBB exploit attempts (a bot is
>> doing the rounds) the noise from this in the logs is making it very
>> difficult to track down other "hits"
>
>   Not at the moment. In May work will begin on a web-based console to
>   track the audit entries. Since for that I need to build a (Perl)
>   parser I am likely to make it usable from the command line too.

Here's a little something I threw together:
http://orderamidchaos.com/modsec/modsec_auditlog_parser

Use it like this:
 ./modsec_auditlog_parser < /var/log/apache2/modsec_audit_log |less

Maybe it will solve the current problem of weeding through entries, and 
maybe it will help serve as the basis of a more in depth parser.  Right now 
it just grabs a few scraps of info (user agent, message, action) and sums 
them over domains.  BTW, I'm running version 1.7.6, so I don't know if the 
log has changed at all since then.  Let me know if you'd like me to do any 
tweaking for you.

Tom

Re: [mod-security-users] tying log entries to rules

[Ivan R. <iv...@we...>]

caleb racey wrote:
> Hello 
> 
> 
> Kudos on an excellent module and kudos to ivan on the excellent o'reilly
> apache security book.

   Thanks!


> When monitoring the server logs I have two questions:
> 
> 1) are there any tools for monitoring the audit logs, since the output
> per hit is multi line the normal approach of "grep"ing is not effective.
> For example my logs are overwhelmingly phpBB exploit attempts (a bot is
> doing the rounds) the noise from this in the logs is making it very
> difficult to track down other "hits" 

   Not at the moment. In May work will begin on a web-based console to
   track the audit entries. Since for that I need to build a (Perl)
   parser I am likely to make it usable from the command line too.

   BTW, you don't have to grep access_logs either. Have a look at
   the logscan utility: http://www.apachesecurity.net/tools


> 2) is there any way to tie down a "hit" to the rule that caught it? Once
> I have identified false positives it is difficult to track down the rule
> causing it, It would be useful if the log would give some form of rule
> identifier for which rule caused the match

   There is, since yesterday, if you are not afraid to deploy 1.9dev2.
   I've just added three more actions: id, msg, severity. They are
   just plain text fields that will appear in the error message created
   by a rule.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] tying log entries to rules

[caleb r. <Cal...@ne...>]

Hello=20


Kudos on an excellent module and kudos to ivan on the excellent o'reilly
apache security book.

When monitoring the server logs I have two questions:

1) are there any tools for monitoring the audit logs, since the output
per hit is multi line the normal approach of "grep"ing is not effective.
For example my logs are overwhelmingly phpBB exploit attempts (a bot is
doing the rounds) the noise from this in the logs is making it very
difficult to track down other "hits"=20

2) is there any way to tie down a "hit" to the rule that caught it? Once
I have identified false positives it is difficult to track down the rule
causing it, It would be useful if the log would give some form of rule
identifier for which rule caused the match=20


regards


Caleb Racey, Webteam, ISS
University of Newcastle upon Tyne

Re: [mod-security-users] Validation type of upload files

[m0nkey <poo...@wa...>]

Hello <br />I wrote a simple approver bash script using 'file'. I'm sure
my bash is poor.. so any recommendations are welcome. <br /><br
/>#!/bin/bash <br />f [ &quot;$#&quot; -ne 1 ] <br />    then echo 0; <br
/>fi <br />PASSVAL=0; <br />FILENAME=$1; <br />OUTVAL=`/usr/bin/file -bi
$FILENAME`; <br />case $OUTVAL in <br />    &quot;image/jpeg&quot;)
PASSVAL=1;; <br />    &quot;image/pjpeg&quot;) PASSVAL=1;; <br />  
 &quot;image/gif&quot;) PASSVAL=1;; <br />  
 &quot;application/x-empty&quot;)PASSVAL=1;; <br />esac <br />if [
$PASSVAL == 1 ] <br />    then echo 1; <br />fi <br /><br /><br />hope
this helps someone. <br />m0nkey


<br>__________________________ <br>
Get your FREE 100MB email today at <a
href="http://www.wapda.com">http://www.wapda.com</a> <BR>
</BODY></HTML>

Re: [mod-security-users] Rules database

[Michael S. <mi...@sh...>]

On Mon, 2005-04-11 at 10:16 +0100, Ivan Ristic wrote:
> Michael Shinn wrote:
> > On Mon, 2005-04-04 at 16:14 +0200, Roman Medina-Heigl Hernandez wrote:
> >=20
> >>Gerwin Krist -|- Digitalus Webhosting wrote:
> >>
> >>
> >>>You could try http://www.gotroot.com/downloads/ftp/mod_security/rules.=
conf
> >>
> >>It looks nice. But it seems to be having problems in Apache 1.x
> >>(according to the comments). Do you know if they've been fixed? I also
> >>read one thread at gotroot.com but it didn't contain specific info abou=
t
> >>the issue.
> >=20
> >=20
> > Hi, I'm the author of those rules.  The rules that choke on apache 1.x
> > deal with my use of pcre regex'es while Apache 1.x apparently only
> > supports POSIX regex's.  The solution is that I need to convert all
> > those regex's to POSIX regex's for the legacy Apache 1.x systems.
> > Otherwise, the rules should work fine.
>=20
>    If you could send me the translation algorithm, I could try and
>    put it right into the Apache 1.x version, so the translation would
>    happen at runtime with both versions supporting the same format?

That would certainly be a much easier solution for me.  :-)

--=20
Michael T. Shinn                                    KeyID:370A4CAB
Key Fingerprint: 0057 437C D882 ECFF 716B 7BD6 6E3B F5BA 370A 4CAB
http://pgp.mit.edu:11371/pks/lookup?op=3Dget&search=3D0x370A4CAB

1st security axiom: Attacks always get better; they never get worse.

Re: [mod-security-users] Re: DocumentRoot path

[Ivan R. <iv...@we...>]

Julius Schwartzenberg wrote:
>
> Now when I run the server with the module, I get the following errors in 
> my logs though when I try to access the server:
> [Thu Apr 14 16:02:01 2005] [notice] child pid 3787 exit signal 
> Segmentation fault (11)
> [Thu Apr 14 16:02:02 2005] [notice] child pid 3788 exit signal 
> Segmentation fault (11)
> [Thu Apr 14 16:03:05 2005] [notice] child pid 3789 exit signal 
> Segmentation fault (11)
> [Thu Apr 14 16:03:36 2005] [notice] child pid 3790 exit signal 
> Segmentation fault (11)
> 
> The client recieves an empty page. When I do not use the module, 
> everything seems to work correctly though.
> 
> Did I forgot anything?

   I don't think so. My guess is your web server/application requires
   something that is not present in the jail. But it's not telling
   you what, choosing to just crash instead. It's the reason people
   hate chroot as much as they do.

   There is no easy way around it. Read the chroot part of
   my book for a step-by-step guide how to troubleshoot the
   problem:

   http://www.apachesecurity.net/download/apachesecurity-ch02.pdf

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Re: DocumentRoot path

[Julius S. <us...@zg...>]

Ivan Ristic wrote:
>> I understand. Is there any way to check then if it really is chrooted?
> 
> 
>   There will be two messages in the error log. Also, I think
>   mod_security exists if chroot fails.
> 
>   To be sure, why don't you create an empty /var/www? That way,
>   you will only see the content if the chroot is successful.
Good idea :)

> 
>> This also seems to be a work-around. Is this known problem with 
>> mod_security?
> 
> 
>   No, not really. It's a drawback of the approach, and the fact
>   was not built to support an internal chroot. Therefore it
>   performs some actions before the chroot and some after. There's
>   nothing we can do about that.
> 
I understand.

Now when I run the server with the module, I get the following errors in 
my logs though when I try to access the server:
[Thu Apr 14 16:02:01 2005] [notice] child pid 3787 exit signal 
Segmentation fault (11)
[Thu Apr 14 16:02:02 2005] [notice] child pid 3788 exit signal 
Segmentation fault (11)
[Thu Apr 14 16:03:05 2005] [notice] child pid 3789 exit signal 
Segmentation fault (11)
[Thu Apr 14 16:03:36 2005] [notice] child pid 3790 exit signal 
Segmentation fault (11)

The client recieves an empty page. When I do not use the module, 
everything seems to work correctly though.

Did I forgot anything?

Thanks,
Julius

[mod-security-users] Re: The directory traversal problem

[cyril <cyr...@la...>]

Ulf Harnhammar <metaur <at> operamail.com> writes:

> 
> I haven't tested this, but the following regexes should be helpful when trying
to combat directory traversal:
> 
>   ^[/\]
>   \.\.
> 
> The first matches any string that begins with "/" or "\" characters (like in
"/etc/passwd"). The second
> matches any string with two dots in a row (which of course disallows
legitimate filenames like
> "ulfs.nice.document..doc", but it also catches malicious things like
"../../../../../../etc/passwd").
> 
> Any other ideas?
> 
> As Ivan wrote on webappsec, putting together a repository with regexes and
other snippets for
> mod_security would be a good idea.
> 
> // Ulf
> 

Hello

^[/\]
Doesn't work, because you erase all / of your URL, so your website doesn't work
anymore ^^
I have tried  ^[\+] It doesn't work too.

I have problems with dir traversal, so i am investigating...

Regards
Cyril

Re: [mod-security-users] Re: DocumentRoot path

[Ivan R. <iv...@we...>]

Julius Schwartzenberg wrote:
> Alex wrote:
> 
>> Just do : ln -s /chroot/apache/var/www /var/www
>>
>> It should be working after that
>>
>> Alex V
> 
> 
> I understand. Is there any way to check then if it really is chrooted?

   There will be two messages in the error log. Also, I think
   mod_security exists if chroot fails.

   To be sure, why don't you create an empty /var/www? That way,
   you will only see the content if the chroot is successful.


> This also seems to be a work-around. Is this known problem with 
> mod_security?

   No, not really. It's a drawback of the approach, and the fact
   was not built to support an internal chroot. Therefore it
   performs some actions before the chroot and some after. There's
   nothing we can do about that.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Re: DocumentRoot path

[Julius S. <us...@zg...>]

Alex wrote:
> On Wed, 2005-04-13 at 22:52 +0200, Julius Schwartzenberg wrote:
> 
>>Hi,
>>I'm trying to chroot my Apache 2 server.
>>I've added this to my httpd.conf:
>># mod_security stuff
>>SecChrootDir /chroot/apache
>>
>>And I moved the directory /var/www to /chroot/apache/var/www
>>
>>When I try to start Apache, I now get the following error message though:
>>Starting httpd daemon:  /usr/sbin/apachectl start
>>Syntax error on line 357 of /etc/apache2/httpd.conf:
>>DocumentRoot must be a directory
>>
>>Am I doing something wrong? I would expect I would only need to specify 
>>the path within the chroot environment. Do I need to specify the full 
>>path instead?
>>
>>Thanks in advance,
>>Julius
>>
> 
> 
> Just do : ln -s /chroot/apache/var/www /var/www
> 
> It should be working after that
> 
> Alex V

I understand. Is there any way to check then if it really is chrooted?
This also seems to be a work-around. Is this known problem with 
mod_security?

Julius

Re: [mod-security-users] DocumentRoot path

[Alex <al...@ss...>]

On Wed, 2005-04-13 at 22:52 +0200, Julius Schwartzenberg wrote:
> Hi,
> I'm trying to chroot my Apache 2 server.
> I've added this to my httpd.conf:
> # mod_security stuff
> SecChrootDir /chroot/apache
>=20
> And I moved the directory /var/www to /chroot/apache/var/www
>=20
> When I try to start Apache, I now get the following error message though:
> Starting httpd daemon:  /usr/sbin/apachectl start
> Syntax error on line 357 of /etc/apache2/httpd.conf:
> DocumentRoot must be a directory
>=20
> Am I doing something wrong? I would expect I would only need to specify=20
> the path within the chroot environment. Do I need to specify the full=20
> path instead?
>=20
> Thanks in advance,
> Julius
>=20

Just do : ln -s /chroot/apache/var/www /var/www

It should be working after that

Alex V

[mod-security-users] DocumentRoot path

[Julius S. <us...@zg...>]

Hi,
I'm trying to chroot my Apache 2 server.
I've added this to my httpd.conf:
# mod_security stuff
SecChrootDir /chroot/apache

And I moved the directory /var/www to /chroot/apache/var/www

When I try to start Apache, I now get the following error message though:
Starting httpd daemon:  /usr/sbin/apachectl start
Syntax error on line 357 of /etc/apache2/httpd.conf:
DocumentRoot must be a directory

Am I doing something wrong? I would expect I would only need to specify 
the path within the chroot environment. Do I need to specify the full 
path instead?

Thanks in advance,
Julius

Re: [mod-security-users] Network Attack v2.8 and Referers

[Ivan R. <iv...@we...>]

Black wrote:
> Hi,
> I want to learn, if we can ban ips with certain log entries by
> mod_security, for example, in the harvest part: "Network Attack v2.8".
> Also, can we reject the connections to our server from certain
> referers such as "www.sanaldarbe.com" , "www.tahribat.com" and
> "www.tithac.com". If we can, then can you help us with this issue?
> Thank you for your time and attention.
> 
> Log Examples: 
> 
> 213.208.67.82 - - [09/Apr/2005:13:34:49 +0200] "GET /index.php
> HTTP/1.0" 200 1177 "-" "FireFox - Network Attack v2.8 - fuck you"
> 212.405.32.11 - - [09/Apr/2005:13:34:49 +0200] "GET /index.php
> HTTP/1.0" 200 1177 "-" "FireFox - Network Attack v2.8 - tithack"

   Sure you can:

   SecFilterSelective HTTP_USER_AGENT "Network Attack"

   or:

   SecFilterSelective HTTP_REFERER "sanaldarbe\.com"

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Network Attack v2.8 and Referers

[Oliver S. <Bor...@gm...>]

Sorry if that is wrong on this list. I don't even know whether mod_security
supports exactly this feature. But I would do it in mod_rewrite as described
in the Rewrite Guide:
http://httpd.apache.org/docs-2.0/misc/rewriteguide.html

E.g. denying access to certain user agents could be done like this:
-----------------------------
RewriteEngine on
RewriteCond %{HTTP_USER_AGENT}  ^FireFox - Network Attack v2.8
RewriteRule   ^/.*  -  [F]
-----------------------------

Similarly for referrers:
-----------------------------
RewriteEngine on
RewriteCond %{HTTP_REFERER} ^http://www.tahribat.com
RewriteRule   ^/.*  -  [F]
-----------------------------

HTTP_REFERER is spelled correctly - it was a typo in the first NSCA server
which still exists for compatibility.

Oliver

> Hi,
> I want to learn, if we can ban ips with certain log entries by
> mod_security, for example, in the harvest part: "Network Attack v2.8".
> Also, can we reject the connections to our server from certain
> referers such as "www.sanaldarbe.com" , "www.tahribat.com" and
> "www.tithac.com". If we can, then can you help us with this issue?
> Thank you for your time and attention.
> 
> Log Examples: 
> 
> 213.208.67.82 - - [09/Apr/2005:13:34:49 +0200] "GET /index.php
> HTTP/1.0" 200 1177 "-" "FireFox - Network Attack v2.8 - fuck you"
> 212.405.32.11 - - [09/Apr/2005:13:34:49 +0200] "GET /index.php
> HTTP/1.0" 200 1177 "-" "FireFox - Network Attack v2.8 - tithack"
> 
> 
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> 

-- 
---------------------------------------------------
May the source be with you, stranger ;)

ICQ: #281645
URL: http://assarbad.net

Re: [mod-security-users] Rules database

[Ivan R. <iv...@we...>]

Michael Shinn wrote:
> On Mon, 2005-04-04 at 16:14 +0200, Roman Medina-Heigl Hernandez wrote:
> 
>>Gerwin Krist -|- Digitalus Webhosting wrote:
>>
>>
>>>You could try http://www.gotroot.com/downloads/ftp/mod_security/rules.conf
>>
>>It looks nice. But it seems to be having problems in Apache 1.x
>>(according to the comments). Do you know if they've been fixed? I also
>>read one thread at gotroot.com but it didn't contain specific info about
>>the issue.
> 
> 
> Hi, I'm the author of those rules.  The rules that choke on apache 1.x
> deal with my use of pcre regex'es while Apache 1.x apparently only
> supports POSIX regex's.  The solution is that I need to convert all
> those regex's to POSIX regex's for the legacy Apache 1.x systems.
> Otherwise, the rules should work fine.

   If you could send me the translation algorithm, I could try and
   put it right into the Apache 1.x version, so the translation would
   happen at runtime with both versions supporting the same format?

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Network Attack v2.8 and Referers

[Black <fa...@gm...>]

Hi,
I want to learn, if we can ban ips with certain log entries by
mod_security, for example, in the harvest part: "Network Attack v2.8".
Also, can we reject the connections to our server from certain
referers such as "www.sanaldarbe.com" , "www.tahribat.com" and
"www.tithac.com". If we can, then can you help us with this issue?
Thank you for your time and attention.

Log Examples: 

213.208.67.82 - - [09/Apr/2005:13:34:49 +0200] "GET /index.php
HTTP/1.0" 200 1177 "-" "FireFox - Network Attack v2.8 - fuck you"
212.405.32.11 - - [09/Apr/2005:13:34:49 +0200] "GET /index.php
HTTP/1.0" 200 1177 "-" "FireFox - Network Attack v2.8 - tithack"

Re: [mod-security-users] Rules database

[Michael S. <mi...@sh...>]

On Mon, 2005-04-04 at 16:14 +0200, Roman Medina-Heigl Hernandez wrote:
> Gerwin Krist -|- Digitalus Webhosting wrote:
>=20
> > You could try http://www.gotroot.com/downloads/ftp/mod_security/rules.c=
onf
>=20
> It looks nice. But it seems to be having problems in Apache 1.x
> (according to the comments). Do you know if they've been fixed? I also
> read one thread at gotroot.com but it didn't contain specific info about
> the issue.

Hi, I'm the author of those rules.  The rules that choke on apache 1.x
deal with my use of pcre regex'es while Apache 1.x apparently only
supports POSIX regex's.  The solution is that I need to convert all
those regex's to POSIX regex's for the legacy Apache 1.x systems.
Otherwise, the rules should work fine.  Its just a regex formating issue
for the two platforms.

>=20
> I still have to review the link provided by Alberto (my proxy doesn't
> load it, I'll try again l8r).
>=20
> Thanks to both, Gerwin & Alberto :-)
>=20
> Regards,
> -Rom=C3=A1n
>=20
>=20
>=20
>=20
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_ide95&alloc_id=14396&op=3Dclick
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
--=20
Michael T. Shinn                                    KeyID:370A4CAB
Key Fingerprint: 0057 437C D882 ECFF 716B 7BD6 6E3B F5BA 370A 4CAB
http://pgp.mit.edu:11371/pks/lookup?op=3Dget&search=3D0x370A4CAB

1st security axiom: Attacks always get better; they never get worse.

Re: [mod-security-users] Where is 1.8.7 Windows DLL?

[Ivan R. <iv...@we...>]

Kevin Roberts wrote:
> Where will I find the 1.8.7 DLL for Apache 2/Win32? I've looked at all the
> links on the mod_security web site and only seem to find source files. I was
> expecting to find a download similar to mod_security-bin-win-1.8.6.zip. Does
> it exist?

   No, at least not on www.modsecurity.org. I stopped compiling for
   Windows some time ago. Maybe someone else will start producing the
   binaries. (Guenter usually did for Apache 2 but I notice he too
   is still at 1.8.6)

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Where is 1.8.7 Windows DLL?

[Oliver S. <Bor...@gm...>]

Just compile it yourself.

> Where will I find the 1.8.7 DLL for Apache 2/Win32? I've looked at all the
> links on the mod_security web site and only seem to find source files. I
> was
> expecting to find a download similar to mod_security-bin-win-1.8.6.zip.
> Does
> it exist?

-- 
---------------------------------------------------
May the source be with you, stranger ;)

ICQ: #281645
URL: http://assarbad.net

[mod-security-users] Where is 1.8.7 Windows DLL?

[Kevin R. <kev...@ho...>]

Where will I find the 1.8.7 DLL for Apache 2/Win32? I've looked at all the
links on the mod_security web site and only seem to find source files. I was
expecting to find a download similar to mod_security-bin-win-1.8.6.zip. Does
it exist?

Re: [mod-security-users] Rules database

[Ivan R. <iv...@we...>]

Roman Medina-Heigl Hernandez wrote:
> Ivan Ristic wrote:
> 
>>  ModSecurity will support both formats in version 2, so don't
>>  worry.
> 
> 
> [...]
> 
> 
>>  Again, I agree. The new XML-based format was designed just for
>>  that purpose (sharing between systems), hence the added
>>  complexity.
> 
> 
> Then perhaps you'd not need to include support for ModSecurity. A simple
> conversion tool (ensuring you can translate modsecurity format <-> XML
> format) would suffice...

   Perhaps. Right now the XML format can do a few things ModSecurity
   native cannot but I can probably rectify that in 2.0.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org