mod-security-users — General discussion about mod_security

Re: [mod-security-users] Rules database

[Javier Fernandez-S. <jfe...@ge...>]

Christian Martorella wrote:

> Hi Roman:
> When i tried the modsecurity, i used a script to convert snort rules to 
> modsecurity rules, maybe you could do that to initialize your rules 
> database, and then optimize the set of rules.
> 

Unfortunately, that script does not work as expected and cleaning up 
is time consuming. I sent a patch to the list a while back that Ivan 
applied to the CVS, I would suggest you used 
http://cvs.sourceforge.net/viewcvs.py/mod-security/mod_security/util/ 
instead.

BTW, I also sent a while back (October last year [1]) a script to 
convert Nessus NASL plugins into modsecurity rules, it needs to be 
improved upon, but could also prove useful.

Regards

Javier

[1]Message-ID: <418...@ge...>

Re: [mod-security-users] Rules database

[Roman Medina-H. H. <ro...@rs...>]

Ivan Ristic wrote:
>   ModSecurity will support both formats in version 2, so don't
>   worry.

[...]

>   Again, I agree. The new XML-based format was designed just for
>   that purpose (sharing between systems), hence the added
>   complexity.

Then perhaps you'd not need to include support for ModSecurity. A simple
conversion tool (ensuring you can translate modsecurity format <-> XML
format) would suffice...

Regards,
-Rom=E1n

Re: [mod-security-users] Rules database

[Ivan R. <iv...@we...>]

Tom Anderson wrote:
 >
>>   It never took off. At the last minute I decided a repository
>>   of rules that worked only in mod_security was not the best
>>   way forward. Instead, I designed the portable web application
>>   firewall rule format http://www.modsecurity.org/projects/wasprotect/.
> 
> OMG, that looks horrible!

   :)

   It will look even worse when a layer of meta-data is added to it.


> Please don't make that the only accepted 
> format.

   ModSecurity will support both formats in version 2, so don't
   worry.


> Human readability is key.

   I agree.


> XML is good for sharing rules between systems, but not for human 
> maintained configs.

   Again, I agree. The new XML-based format was designed just for
   that purpose (sharing between systems), hence the added
   complexity.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Rules database

[Tom A. <tan...@oa...>]

----- Original Message ----- 
From: "Ivan Ristic" <iv...@we...>
To: <mod...@li...>
Sent: Monday, April 04, 2005 10:33 AM
Subject: Re: [mod-security-users] Rules database


> Roman Medina-Heigl Hernandez wrote:
>> I visited:
>> http://www.modsecurity.org/db/rules/
>> But I got a bit disappointed when I saw only 4 rules :-(. The db seems
>> to be discontinued... ?
>
>   It never took off. At the last minute I decided a repository
>   of rules that worked only in mod_security was not the best
>   way forward. Instead, I designed the portable web application
>   firewall rule format http://www.modsecurity.org/projects/wasprotect/.

OMG, that looks horrible!  Please don't make that the only accepted format. 
I hate dealing with completely useless markup which can just as easily be 
implied.  It just clutters up the configuration with non-info and bloats 
your file sizes.  The best thing about working in unix environments is that 
everything is kept short and sweet.  Human readability is key.

SecFilterSelective "ARG_open" ^sesame$    (38 chars)

vs

<rule operator="regex" arg="params['open']" value="^sesame$" />    (63 
chars)

Multiply that by your whole configuration file... what a mess!

XML is good for sharing rules between systems, but not for human maintained 
configs.

Tom 

Re: [mod-security-users] Rules database

[Christian M. <cma...@is...>]

Hi Roman:
When i tried the modsecurity, i used a script to convert snort rules to=20
modsecurity rules, maybe you could do that to initialize your rules=20
database, and then optimize the set of rules.

Here is the link:
http://www.modsecurity.org/documentation/converted-snort-rules.html

Cheers
Christian Martorella

Roman Medina-Heigl Hernandez wrote:

>Hi,
>
>I'm interested in protecting webapps in a "generic way" (more or less
>:-)), which means that if I choose to install a PHP-Nuke portal and a
>new SQL injection bug in that portal is disclosed, it will not be
>exploitable (the code would still be buggy until patching, but that's
>unavoidable). Of course, the idea is to catch the more kind of bugs
>being possible (not only SQL injection, but directory traversal, remote
>PHP script injection, shell injection, etc).
>
>I visited:
>http://www.modsecurity.org/db/rules/
>But I got a bit disappointed when I saw only 4 rules :-(. The db seems
>to be discontinued... ?
>
>I'm wondering whether:
>1) There are other "repositories" for mod-security rules, or
>2) Some of you, security-specialists, would be kind enough to share the
>rules you have, ideas, etc.
>
>Other repositories (not direcly related to Mod-security but perhaps
>easily "convertible" to; for instance, rules from other IPS devices) may
>also be interesting.
>
>Hope hearing from you, guys :-)
>
>Kind regards,
>-Rom=E1n
>
>
>-------------------------------------------------------
>SF email is sponsored by - The IT Product Guide
>Read honest & candid reviews on hundreds of IT Products from real users.
>Discover which products truly live up to the hype. Start reading now.
>http://ads.osdn.com/?ad_ide95&alloc_id=14396&op=3Dclick
>_______________________________________________
>mod-security-users mailing list
>mod...@li...
>https://lists.sourceforge.net/lists/listinfo/mod-security-users
>
> =20
>

Re: [mod-security-users] Rules database

[Ivan R. <iv...@we...>]

Roman Medina-Heigl Hernandez wrote:
> I visited:
> http://www.modsecurity.org/db/rules/
> But I got a bit disappointed when I saw only 4 rules :-(. The db seems
> to be discontinued... ?

   It never took off. At the last minute I decided a repository
   of rules that worked only in mod_security was not the best
   way forward. Instead, I designed the portable web application
   firewall rule format http://www.modsecurity.org/projects/wasprotect/.

   The plan is to implement a portable rule database in Q3 this year,
   with the support of other web application firewall vendors.

   To be honest, there was another reason - I spent eight months last
   year writing the book, so I didn't have time to do anything else.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Rules database

[Roman Medina-H. H. <ro...@rs...>]

Gerwin Krist -|- Digitalus Webhosting wrote:

> You could try http://www.gotroot.com/downloads/ftp/mod_security/rules.c=
onf

It looks nice. But it seems to be having problems in Apache 1.x
(according to the comments). Do you know if they've been fixed? I also
read one thread at gotroot.com but it didn't contain specific info about
the issue.

I still have to review the link provided by Alberto (my proxy doesn't
load it, I'll try again l8r).

Thanks to both, Gerwin & Alberto :-)

Regards,
-Rom=E1n

Re: [mod-security-users] Rules database

[Alberto G. I. <ag...@in...>]

On Mon, Apr 04, 2005 at 01:34:30PM +0200, Roman Medina-Heigl Hernandez wr=
ote:
> I'm wondering whether:
> 1) There are other "repositories" for mod-security rules, or

You can try at:
http://modsecrules.monkeydev.org/index.php
It's quite new, but growing fast.

Regards,

Alberto

--=20
Alberto Gonzalez Iniesta    | Formaci=F3n, consultor=EDa y soporte t=E9cn=
ico
agi@(inittab.org|debian.org)| en GNU/Linux y software libre
Encrypted mail preferred    | http://inittab.com

Key fingerprint =3D 9782 04E7 2B75 405C F5E9  0C81 C514 AF8E 4BA4 01C3

Re: [mod-security-users] Rules database

[Gerwin K. -|- D. W. <ge...@di...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello Rom=E1n,

You could try http://www.gotroot.com/downloads/ftp/mod_security/rules.con=
f
It has a LOT of rules.
Hope it's helpfull.

Gerwin


Roman Medina-Heigl Hernandez wrote:
| Hi,
|
| I'm interested in protecting webapps in a "generic way" (more or less
| :-)), which means that if I choose to install a PHP-Nuke portal and a
| new SQL injection bug in that portal is disclosed, it will not be
| exploitable (the code would still be buggy until patching, but that's
| unavoidable). Of course, the idea is to catch the more kind of bugs
| being possible (not only SQL injection, but directory traversal, remote
| PHP script injection, shell injection, etc).
|
| I visited:
| http://www.modsecurity.org/db/rules/
| But I got a bit disappointed when I saw only 4 rules :-(. The db seems
| to be discontinued... ?
|
| I'm wondering whether:
| 1) There are other "repositories" for mod-security rules, or
| 2) Some of you, security-specialists, would be kind enough to share the
| rules you have, ideas, etc.
|
| Other repositories (not direcly related to Mod-security but perhaps
| easily "convertible" to; for instance, rules from other IPS devices) ma=
y
| also be interesting.
|
| Hope hearing from you, guys :-)
|
| Kind regards,
| -Rom=E1n
|
|
| -------------------------------------------------------
| SF email is sponsored by - The IT Product Guide
| Read honest & candid reviews on hundreds of IT Products from real users=
.
| Discover which products truly live up to the hype. Start reading now.
| http://ads.osdn.com/?ad_ide95&alloc_id=14396&op=3Dclick
| _______________________________________________
| mod-security-users mailing list
| mod...@li...
| https://lists.sourceforge.net/lists/listinfo/mod-security-users
|
|


- --
Met vriendelijke groet/With kind regards,

Gerwin Krist

Digitalus
First-class Internet Webhosting

(w) http://www.digitalus.nl
(e) gerwin at digitalus.nl
(p) PGP-ID: 79B325D4
(t) +31 (0) 598 630000
(f) +31 (0) 598 631860


*************************************************************************=
**************
This message may contain information which is confidential or privileged.
If you are not the intended recipient, please advise the sender immediate=
ly
by reply e-mail and delete this message and any attachments without
retaining
a copy.
*************************************************************************=
**************


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFCUURpCwaJ0XmzJdQRAptKAJ9z4nIiA97D8L5yymPrVy0B4H6grwCgsqKJ
fgDHNrw60VOfIHzKy2NkN+w=3D
=3DynvG
-----END PGP SIGNATURE-----

[mod-security-users] Rules database

[Roman Medina-H. H. <ro...@rs...>]

Hi,

I'm interested in protecting webapps in a "generic way" (more or less
:-)), which means that if I choose to install a PHP-Nuke portal and a
new SQL injection bug in that portal is disclosed, it will not be
exploitable (the code would still be buggy until patching, but that's
unavoidable). Of course, the idea is to catch the more kind of bugs
being possible (not only SQL injection, but directory traversal, remote
PHP script injection, shell injection, etc).

I visited:
http://www.modsecurity.org/db/rules/
But I got a bit disappointed when I saw only 4 rules :-(. The db seems
to be discontinued... ?

I'm wondering whether:
1) There are other "repositories" for mod-security rules, or
2) Some of you, security-specialists, would be kind enough to share the
rules you have, ideas, etc.

Other repositories (not direcly related to Mod-security but perhaps
easily "convertible" to; for instance, rules from other IPS devices) may
also be interesting.

Hope hearing from you, guys :-)

Kind regards,
-Rom=E1n

Re: [mod-security-users] Re: SecChrootDir in vhost?

[Ivan R. <iv...@we...>]

Rocky Olsen wrote:
> Herm, Bugger.
> 
> Well i guess the question to be asked is, does anyone know of a way to
> chroot apache inside <VirutalHost>'s. Say when a connection comes in for a
> vhost and the parent process spawns the child to handle it, that child
> chroot's itself in the vhost's directory?

   For that to happen you would need to run Apache as root, perform
   chroot and suid on every request, and configure children to die
   after serving only one request. It's perfectly possible, but would
   probably suffer a performance penalty. There are suid modules
   around, but I haven't heard of one that allows chroot too.

   But you can do the following:

   Run a separate Apache instance for each <VirtualHost>, chrooted
   and running as the user. Install one Apache instance in front
   and use it as a reverse proxy. This is a very secure and flexible
   solution but it requires a lot of memory. It is thus only suitable
   when there is a small number of virtual hosts.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Re: SecChrootDir in vhost?

[Rocky O. <ro...@mi...>]

Herm, Bugger.

Well i guess the question to be asked is, does anyone know of a way to
chroot apache inside <VirutalHost>'s. Say when a connection comes in for a
vhost and the parent process spawns the child to handle it, that child
chroot's itself in the vhost's directory?

realize it's a bit off topic for this list, but might as well ask.

-Rocky



--=20
______________________________________________________________________


what's with today, today?

Email:	ro...@mi...
PGP:	http://rocky.mindphone.org/rocky_mindphone.org.gpg

Re: [mod-security-users] Strange error when blocking a petition

[Alberto G. I. <ag...@in...>]

On Tue, Mar 29, 2005 at 03:51:43PM -0500, Tom Anderson wrote:
>=20
> ----- Original Message -----=20
> From: "Alberto Gonzalez Iniesta" <ag...@in...>
> To: <mod...@li...>
> Sent: Tuesday, March 29, 2005 11:53 AM
> Subject: [mod-security-users] Strange error when blocking a petition
>=20
>=20
> >Hi all,
> >
> >I'm getting the following error from time to time. I'm not running
> >windows, so I'm not very worried about it, but the
> >'ap_setup_client_block failed with 400' message doesn't look good. Is =
it
> >a problem with my mod_security installation? Or is it normal?
> >
> >195.194.x.x - - [24/Mar/2005:00:54:50 +0100] "POST=20
> >/_vti_bin/_vti_aut/fp30reg.dll HTTP/1.1" 500 647 Access denied with co=
de=20
> >500. ap_setup_client_block failed with 400
>=20
> Here's some things that would probably catch this on my system:
>=20
> SecFilterSelective "HTTP_TRANSFER_ENCODING" "chunked"

Here:
SecFilterSelective HTTP_Transfer-Encoding "!^$"

> SecFilter=20
> "\.(conf|cf|ini|cfg|htpasswd|htaccess|htgroup|inc|history|bash_history|=
exe|pwd|cnf|dll)"
>=20
> I also have this, but I don't recall why:
>=20
> SecFilter errors/400
>=20
> I have a bunch of "/_vti_bin" requests in my error log, but they are al=
l=20
> 404.  How did you get a 500 instead of a 404 if they're posting to a dl=
l=20
> and you're not running Windows?

I get a 500 'cos the petition probably triggered the
HTTP_Transfer-Encoding rule or any other. The file asked by the client
does not have to exist to trigger a rule and get kicked.



--=20
Alberto Gonzalez Iniesta    | Formaci=F3n, consultor=EDa y soporte t=E9cn=
ico
agi@(inittab.org|debian.org)| en GNU/Linux y software libre
Encrypted mail preferred    | http://inittab.com

Key fingerprint =3D 9782 04E7 2B75 405C F5E9  0C81 C514 AF8E 4BA4 01C3

Re: [mod-security-users] Strange error when blocking a petition

[Tom A. <tan...@oa...>]

----- Original Message ----- 
From: "Alberto Gonzalez Iniesta" <ag...@in...>
To: <mod...@li...>
Sent: Tuesday, March 29, 2005 11:53 AM
Subject: [mod-security-users] Strange error when blocking a petition


> Hi all,
>
> I'm getting the following error from time to time. I'm not running
> windows, so I'm not very worried about it, but the
> 'ap_setup_client_block failed with 400' message doesn't look good. Is it
> a problem with my mod_security installation? Or is it normal?
>
> 195.194.x.x - - [24/Mar/2005:00:54:50 +0100] "POST 
> /_vti_bin/_vti_aut/fp30reg.dll HTTP/1.1" 500 647 Access denied with code 
> 500. ap_setup_client_block failed with 400

Here's some things that would probably catch this on my system:

SecFilterSelective "HTTP_TRANSFER_ENCODING" "chunked"

SecFilter 
"\.(conf|cf|ini|cfg|htpasswd|htaccess|htgroup|inc|history|bash_history|exe|pwd|cnf|dll)"

I also have this, but I don't recall why:

SecFilter errors/400

I have a bunch of "/_vti_bin" requests in my error log, but they are all 
404.  How did you get a 500 instead of a 404 if they're posting to a dll and 
you're not running Windows?

Tom

Re: [mod-security-users] Strange error when blocking a petition

[Alberto G. I. <ag...@in...>]

On Tue, Mar 29, 2005 at 08:05:59PM +0100, Ivan Ristic wrote:
> Alberto Gonzalez Iniesta wrote:
> >Hi all,
> >
> >I'm getting the following error from time to time. I'm not running
> >windows, so I'm not very worried about it, but the
> >'ap_setup_client_block failed with 400' message doesn't look good. Is =
it
> >a problem with my mod_security installation? Or is it normal?
> >
> >195.194.x.x - - [24/Mar/2005:00:54:50 +0100] "POST=20
> >/_vti_bin/_vti_aut/fp30reg.dll HTTP/1.1" 500 647 Access denied with co=
de=20
> >500. ap_setup_client_block failed with 400
>=20
>   It should be normal (although not very user-friendly, I admit).
>=20
>   They probably sent a chunked request body and you are using
>   Apache 1.x? Can you look into the audit log to confirm my
>   suspicion?
>=20

Yes, Apache 1.3.26. I don't have an audit log right now, but I'll setup
one and come back later with more info.

Thanks.


--=20
Alberto Gonzalez Iniesta    | Formaci=F3n, consultor=EDa y soporte t=E9cn=
ico
agi@(inittab.org|debian.org)| en GNU/Linux y software libre
Encrypted mail preferred    | http://inittab.com

Key fingerprint =3D 9782 04E7 2B75 405C F5E9  0C81 C514 AF8E 4BA4 01C3

Re: [mod-security-users] Strange error when blocking a petition

[Ivan R. <iv...@we...>]

Alberto Gonzalez Iniesta wrote:
> Hi all,
> 
> I'm getting the following error from time to time. I'm not running
> windows, so I'm not very worried about it, but the
> 'ap_setup_client_block failed with 400' message doesn't look good. Is it
> a problem with my mod_security installation? Or is it normal?
> 
> 195.194.x.x - - [24/Mar/2005:00:54:50 +0100] "POST /_vti_bin/_vti_aut/fp30reg.dll HTTP/1.1" 500 647 Access denied with code 500. ap_setup_client_block failed with 400

   It should be normal (although not very user-friendly, I admit).

   They probably sent a chunked request body and you are using
   Apache 1.x? Can you look into the audit log to confirm my
   suspicion?

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Strange error when blocking a petition

[Alberto G. I. <ag...@in...>]

Hi all,

I'm getting the following error from time to time. I'm not running
windows, so I'm not very worried about it, but the
'ap_setup_client_block failed with 400' message doesn't look good. Is it
a problem with my mod_security installation? Or is it normal?

195.194.x.x - - [24/Mar/2005:00:54:50 +0100] "POST /_vti_bin/_vti_aut/fp3=
0reg.dll HTTP/1.1" 500 647 Access denied with code 500. ap_setup_client_b=
lock failed with 400


Running:
Debian woody
apache          1.3.26-0woody6
mod_security/1.8.7 (build in this system)
libc6           2.2.5-11.8
libdb2          2.7.7.0-7

Thanks,

Alberto

--=20
Alberto Gonzalez Iniesta    | Formaci=F3n, consultor=EDa y soporte t=E9cn=
ico
agi@(inittab.org|debian.org)| en GNU/Linux y software libre
Encrypted mail preferred    | http://inittab.com

Key fingerprint =3D 9782 04E7 2B75 405C F5E9  0C81 C514 AF8E 4BA4 01C3

[mod-security-users] Announcing the mod_security rules database!

[Jan P S. <jp...@yo...>]

http://modsecrules.monkeydev.org/index.php

Over the past few days, I have been building a PHP system that stores 
mod_security rules in a convenient format that is easily downloadable 
via wget, and other methods. This database also has an aggressiveness 
classification system, which allows rules that may break some PHP 
scripts to be placed in more aggressive categories. Users can then 
download which ever rule category they wish. This rule database can be 
submitted to by anyone, and needs to be adminned properly.

At the moment, I am the only admin, and when I go back to uni, it will 
be impossible to do it by myself. This could be a real benefit to the 
community, and I am appealing for admins to lend their time to adminning 
this database. It's all done through a nice web interface.

Take a look: http://modsecrules.monkeydev.org/index.php

If you wish to become an admin, please email me at ch...@ph... 
<mailto:ch...@ph...> with the following details:

Your name and stuff
E-mail address
A bit about yourself, and your history with mod_security.

Admins must be trust worthy, responsible people, as this could be used 
VERY widely to help secure servers. Please only email me if you have 
extensive experience with mod_sec, and know the syntax fairly well.

Thanks very much

Jan

Re: [mod-security-users] SecChrootDir in vhost?

[Ivan R. <iv...@we...>]

Rocky Olsen wrote:
> Are there any plans for adding SecChrootDir directive to <VirutalHost>'s?

   No, because it's not possible. Chroot is an irreversable process, and
   all Apache children must be capable of serving any of the virtual
   hosts in the configuration.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] SecChrootDir in vhost?

[Rocky O. <ro...@mi...>]

Are there any plans for adding SecChrootDir directive to <VirutalHost>'s?



--=20
______________________________________________________________________


what's with today, today?

Email:	ro...@mi...
PGP:	http://rocky.mindphone.org/rocky_mindphone.org.gpg

Re: [mod-security-users] SecFilterInheritance

[Peter W. <prw...@gm...>]

> <Directory>
> Limit scope based on absolute filesystem paths
> http://httpd.apache.org/docs-2.0/mod/core.html#directory
> 
> <Location>
> Limit scope based on URL
> http://httpd.apache.org/docs-2.0/mod/core.html#location

P.S.

The links to documentation are for Apache 2.0x. For Apache 1.x, the links are:

<Directory>: http://httpd.apache.org/docs/mod/core.html#directory
<Location>: http://httpd.apache.org/docs/mod/core.html#location

-- 
Peter R. Wood | email: prw...@gm... | blog: http://prwdot.org/

Re: [mod-security-users] SecFilterInheritance

[Peter W. <prw...@gm...>]

Hi Shelagh,

Funny running into you here. :-)

> containing spam.  Peter suggested bypassing ModSecurity for certain
> locations and I've figured out how to do this for a file, eg, 
> 
> <Files mt.cgi> 
> SecFilterInheritance Off 
> </Files> 
> 
> I would like to know how to do this for a whole directory, is it possible? 

<Files> limits scope by filename. You can use either one of the
following directives to achieve what you want:

<Directory>
Limit scope based on absolute filesystem paths
http://httpd.apache.org/docs-2.0/mod/core.html#directory

<Location>
Limit scope based on URL
http://httpd.apache.org/docs-2.0/mod/core.html#location

FYI, these are Apache directives, and are not specific to mod_security.

> I'm assuming there is a way, using a .htaccess file, to stop ModSecurity
> scanning the data entry forms but to continue blocking the referrer spam. 

They would simply need to put the following in their .htaccess file:

<IfModule mod_security.c>
SecFilterInheritance Off
SecFilterSelective HTTP_Referer "example rule to block"
</IfModule>

This would only block content found in referers. Be sure to note that
this does not necessarily eliminate referrers from Apache's log files.
You would need to do some custom log configuration in Apache so that
requests blocked by mod_security do not show up in the Apache logs.

Peter
-- 
Peter R. Wood | email: prw...@gm... | blog: http://prwdot.org/

[mod-security-users] SecFilterInheritance

[Shelagh G. <sh...@sm...>]

I run a small web hosting business and recently we've been plagued with
trackback spam.  It's been so bad recently that if I don't catch that attack
at the start and disable all the trackback scripts the server very quickly
becomes unusable and has to be rebooted.  To try and stem the tide I've
implemented Peter Wood's script
(http://prwdot.org/docs/blacklist_to_modsec.html) that uses the MT Blacklist
to create a set of rules for ModSecurity to block comments and trackbacks
containing spam.  Peter suggested bypassing ModSecurity for certain
locations and I've figured out how to do this for a file, eg, 
<Files mt.cgi>
SecFilterInheritance Off
</Files>

I would like to know how to do this for a whole directory, is it possible?

The other situation I'd like some help with is one of my customers who
doesn't blog at all.  Their site is devoted to transcribing a census index.
The only forms on the site are those used by the transcribers for data entry
in a password-protected area which is never going to get spammed.  One the
one hand they could just bypass ModSecurity completely but the handy thing
I've noticed about Peter's script is that not only is it blocking comments
and trackbacks it appears to be blocking a lot of referrer spam as well.
I'm assuming there is a way, using a .htaccess file, to stop ModSecurity
scanning the data entry forms but to continue blocking the referrer spam.

Thanks - Shelagh

Re: [mod-security-users] Mod_Security SecServerSignature

[Christian M. <cma...@is...>]

Thank's now with mod_headers works like i wanted ;)

Bye


Ivan Ristic wrote:

> Christian Martorella wrote:
>
>> Hi all,
>>
>> I want to know if it is posible to use SecServerSignature when using 
>> mod_proxy,
>> because i have done some test but the Server token doesnt change.
>>
>> In my httpd.conf i have:
>>
>> ProxyRequests Off
>> ProxyPass / http://targetweb/
>> ProxyPassReverse / http://targetweb/
>>
>> And then the minimal recommended configuration of the mod_security
>>
>> But when i telnet localhost 80, the server token that i get is the 
>> original from targetweb
>>
>> Any idea?
>
>
>   Yes, that's how mod_proxy operates. Under normal circumstances it
>   does not sent its own Server response header but uses the one
>   received from the target web server.
>
>   But, if you were to send an invalid request, one that causes
>   an HTTP 400 Bad Request error, you would see the server name
>   you configured using SecServerSignature.
>
>   The solution is to use bot SecServerSignature (for invalid
>   requests) and mod_headers (for all other requests), in which
>   case the Server response header can always show the same value.
>

Re: [mod-security-users] Mod_Security SecServerSignature

[Ivan R. <iv...@we...>]

Christian Martorella wrote:
> Hi all,
> 
> I want to know if it is posible to use SecServerSignature when using 
> mod_proxy,
> because i have done some test but the Server token doesnt change.
> 
> In my httpd.conf i have:
> 
> ProxyRequests Off
> ProxyPass / http://targetweb/
> ProxyPassReverse / http://targetweb/
> 
> And then the minimal recommended configuration of the mod_security
> 
> But when i telnet localhost 80, the server token that i get is the 
> original from targetweb
> 
> Any idea?

   Yes, that's how mod_proxy operates. Under normal circumstances it
   does not sent its own Server response header but uses the one
   received from the target web server.

   But, if you were to send an invalid request, one that causes
   an HTTP 400 Bad Request error, you would see the server name
   you configured using SecServerSignature.

   The solution is to use bot SecServerSignature (for invalid
   requests) and mod_headers (for all other requests), in which
   case the Server response header can always show the same value.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org