mod-security-users — General discussion about mod_security

[mod-security-users] Mod_Security SecServerSignature

[Christian M. <cma...@is...>]

Hi all,

I want to know if it is posible to use SecServerSignature when using 
mod_proxy,
because i have done some test but the Server token doesnt change.

In my httpd.conf i have:

ProxyRequests Off
ProxyPass / http://targetweb/
ProxyPassReverse / http://targetweb/

And then the minimal recommended configuration of the mod_security

But when i telnet localhost 80, the server token that i get is the 
original from targetweb

Any idea?

Thanks in advance
Christian Martorella

Re: [mod-security-users] political web site attacked

[<gve...@mi...>]

On which Linux Distribution are you trying to install mod_security?  
first of all you must compile mod_security and integrate with Apache 
using LoadModule directive (done automatically). Then you must configure 
mod_security.

Also an IDS could help you (Snort).

The web site was defaced?

Regards,
Geffrey

Peter van Summeren wrote:

> Hello,
> this night a political web site in the Netherlands was attacked.
>
> I would like to know what can be done with mod-security and how it 
> should be implemented.
> Let us say: mod-security for dummies.
> Thanks in advance.
> Peter
>
> _________________________________________________________________
> Play online games with your friends with MSN Messenger 
> http://messenger.msn.nl/
>
>
>
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users

Re: [mod-security-users] Problem with url parsing

[Ivan R. <iv...@we...>]

Kin wrote:
> First of all: sorry for my english.
> 
> Ten days ago, after a "replacement", my provider has installed (or updated? 
> i don't know) mod_security. But there are some problem now.
> 
> In my discussion forum, people get lots of error 403 (forbidden). 
> I think the problem are this filters:
>
 > ...
>
> I copy and past this after a quick serch on google, I not take them from my
> server config.
> 
> The problem is that when user of the bullettin board try to send message with a
> "cc ", "ps ", "perl " in it, they got a 403 error.
> 
> For example if i try to send the message:
> "Disable caps lock key"
> 
> It return an error for the "ps "
> 
> "perl is a great lenguage" (403 forbidden)
> 
> "1, 2, 3, ecc ecc" (403 forbidden) 
> (ecc is "etc" in italian and is used very often)
> 
> "ps (post scriptum): bla bla bla" (403 forbidden)
> 
> It's a big problem for me, what I can do with this????
> please let me know something

   Complain to your hosting provider. Some people seem to think
   they can just copy anything they find on the Internet, put
   it into httpd.conf, and magically solve all their security
   problems. (I don't know if this is the case with your provider
   but it sure sounds like it is.) ModSecurity can solve problems
   only when people know what they are doing.

   To create a secure hosting environment one must design systems
   for security. It's not the easiest job in the world, but it
   isn't rocket science either.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Problem with url parsing

[Kin <lu...@gm...>]

First of all: sorry for my english.

Ten days ago, after a "replacement", my provider has installed (or updated? 
i don't know) mod_security. But there are some problem now.

In my discussion forum, people get lots of error 403 (forbidden). 
I think the problem are this filters:

# WEB-ATTACKS /bin/ps command attempt
SecFilter "/bin/ps"

# WEB-ATTACKS ps command attempt
#SecFilterSelective THE_REQUEST "ps" chain #SecFilter\x20" "deny,log"

# WEB-ATTACKS /usr/bin/id command attempt SecFilterSelective THE_REQUEST
"/usr/bin/id" chain SecFilter "\x20" "deny,log"

# WEB-ATTACKS echo command attempt
SecFilterSelective THE_REQUEST "/bin/echo" chain SecFilter "\x20" "deny,log"

# WEB-ATTACKS kill command attempt
SecFilterSelective THE_REQUEST "/bin/kill" chain SecFilter "\x20" "deny,log"

# WEB-ATTACKS chmod command attempt
SecFilterSelective THE_REQUEST "/bin/chmod" chain SecFilter "\x20" "deny,log"

# WEB-ATTACKS chgrp command attempt
SecFilterSelective THE_REQUEST "/chgrp" chain SecFilter "\x20" "deny,log"

# WEB-ATTACKS chown command attempt
#SecFilter "/chown"
#SecFilter "\x20"

# WEB-ATTACKS chsh command attempt
SecFilter "/usr/bin/chsh"

# WEB-ATTACKS tftp command attempt
SecFilterSelective THE_REQUEST "tftp" chain SecFilter "\x20" "deny,log"

# WEB-ATTACKS /usr/bin/gcc command attempt SecFilterSelective THE_REQUEST
"/usr/bin/gcc" chain SecFilter "\x20" "deny,log"

# WEB-ATTACKS gcc command attempt
SecFilterSelective THE_REQUEST "gcc\" chain SecFilter "x20-o" "deny,log"

# WEB-ATTACKS /usr/bin/cc command attempt SecFilterSelective THE_REQUEST
"/usr/bin/cc" chain SecFilter "\x20" "deny,log"

# WEB-ATTACKS cc command attempt
#SecFilterSelective THE_REQUEST "cc" chain #SecFilter "\x20"

# WEB-ATTACKS /usr/bin/cpp command attempt SecFilterSelective THE_REQUEST
"/usr/bin/cpp" chain SecFilter "\x20" "deny,log"

# WEB-ATTACKS cpp command attempt
SecFilterSelective THE_REQUEST "cpp" chain SecFilter "\x20" "deny,log"
# WEB-ATTACKS /usr/bin/g++ command attempt SecFilterSelective THE_REQUEST
"/usr/bin/g\+\+" chain SecFilter "\x20" "deny,log"

# WEB-ATTACKS g++ command attempt
SecFilterSelective THE_REQUEST "g\+\+\x20" chain SecFilter "\x20" "deny,log"

# WEB-ATTACKS bin/python access attempt SecFilterSelective THE_REQUEST
"bin/python" chain SecFilter "\x20" "deny,log"

# WEB-ATTACKS python access attempt
#SecFilter "python\x20"

# WEB-ATTACKS bin/tclsh execution attempt SecFilter "bin/tclsh"

# WEB-ATTACKS tclsh execution attempt
SecFilter "tclsh8\x20"

# WEB-ATTACKS bin/nasm command attempt
SecFilter "bin/nasm"

# WEB-ATTACKS nasm command attempt
SecFilter "nasm\x20"

# WEB-ATTACKS /usr/bin/perl execution attempt SecFilter "/usr/bin/perl"

# WEB-ATTACKS perl execution attempt
#SecFilterSelective THE_REQUEST "perl" chain #SecFilter "\x20" "deny,log"

#curl protection
SecFilter "curl\x20"

# WEB-ATTACKS traceroute command attempt SecFilterSelective THE_REQUEST
"traceroute" chain SecFilter "\x20" "deny,log"

# WEB-ATTACKS ping command attempt
SecFilterSelective THE_REQUEST "/bin/ping" chain SecFilter "\x20" "deny,log"

# WEB-ATTACKS netcat command attempt
#SecFilter "nc\x20"

# WEB-ATTACKS nmap command attempt
#SecFilter "nmap\x20"

# WEB-ATTACKS X application to remote host attempt 
SecFilter "\x20-display\x20"

# WEB-ATTACKS mail command attempt
SecFilterSelective THE_REQUEST "/bin/mail" chain SecFilter "\x20" "deny,log"

# WEB-ATTACKS /bin/ls command attempt
SecFilterSelective THE_REQUEST "/bin/ls" chain SecFilter "\x20" "deny,log"

# WEB-ATTACKS /etc/inetd.conf access
SecFilter "/etc/inetd\.conf" log,pass

# WEB-ATTACKS /etc/motd access
SecFilter "/etc/motd" log,pass
# WEB-ATTACKS conf/httpd.conf attempt
SecFilter "conf/httpd\.conf" log,pass 



And in particular:

# WEB-ATTACKS ps command attempt
#SecFilterSelective THE_REQUEST "ps" chain #SecFilter\x20" "deny,log"

# WEB-ATTACKS cc command attempt
#SecFilterSelective THE_REQUEST "cc" chain #SecFilter "\x20"

# WEB-ATTACKS perl execution attempt
#SecFilterSelective THE_REQUEST "perl" chain #SecFilter "\x20" "deny,log"

I copy and past this after a quick serch on google, I not take them from my
server config.


The problem is that when user of the bullettin board try to send message with a
"cc ", "ps ", "perl " in it, they got a 403 error.

For example if i try to send the message:
"Disable caps lock key"

It return an error for the "ps "

"perl is a great lenguage" (403 forbidden)

"1, 2, 3, ecc ecc" (403 forbidden) 
(ecc is "etc" in italian and is used very often)

"ps (post scriptum): bla bla bla" (403 forbidden)

It's a big problem for me, what I can do with this????
please let me know something

[mod-security-users] attack on political web site

[Peter v. S. <pet...@ho...>]

Hello,
Thanks everyone for answering my help question.
I need a day or two to answer how the attack took place.

Peter

_________________________________________________________________
Play online games with your friends with MSN Messenger 
http://messenger.msn.nl/

Re: [mod-security-users] political web site attacked

[Oliver S. <Bor...@gm...>]

This highly depends on the attack vector used (and to be used). mod_security
helps you to overcome flaws in scripts and much more, but it could not helo
(IMO) if a DDoS (Distributed Denial of Service) attack is performed against
your machine.
In this case there's only a chance if you can distinguish the DDoS packets
from normal packets - which is usually not possible. Also several server
settings (both of the server software and the OS's TCP/IP stack) can be
tweaked to overcome ongoing attacks. E.g. the server usually sends a reply
to every valid incoming connection request and already reserves system
resources for the connection which would be made upon reply of the client.
But when the client does not reply, these system resources will often be
freed only after certain minutes. Now assume lots of these "connection
attempts" and you understand the attack vector - the system simply exhausts
its own resources. Tweaking this setting can help to counteract.

Oliver

-- 
---------------------------------------------------
May the source be with you, stranger ;)

ICQ: #281645
URL: http://assarbad.net

Re: [mod-security-users] political web site attacked

[Ivan R. <iv...@we...>]

Peter van Summeren wrote:
> Hello,
> this night a political web site in the Netherlands was attacked.
> 
> I would like to know what can be done with mod-security and how it 
> should be implemented.

   I assume the web site is being subjected to a Denial of Service
   attack? As a rule of thumb, the only effective defense against
   DoS can be implemented on the firewall level before it even
   reaches Apache. The real question is how do you find out the
   IP addresses the attackers are coming from? Ideally you would
   put an automated process in place, to send the IP addresses to
   your firewall.

   You need to tell us more about the problem:

   1. How is the web server being attacked?

   2. Is it a network-based attack (TCP or UDP packets) or
      a HTTP-based attack (e.g. against Apache or an application
      running on the server).

   3. Can you determine the attacking IP addresses from the
      logs?

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] political web site attacked

[Meder B. <ba...@tr...>]

Hello!

Did you look at http://www.apachesecurity.net/ ?

Good Luck!

On Tuesday 22 March 2005 07:07, Peter van Summeren wrote:
> Hello,
> this night a political web site in the Netherlands was attacked.
>
> I would like to know what can be done with mod-security and how it should
> be implemented.
> Let us say: mod-security for dummies.
> Thanks in advance.
> Peter
>
> _________________________________________________________________
> Play online games with your friends with MSN Messenger
> http://messenger.msn.nl/
>
>
>
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users

-- 
Best rgrds,
.coder

My Intellect is The Power! (c) The Prodigy

[mod-security-users] political web site attacked

[Peter v. S. <pet...@ho...>]

Hello,
this night a political web site in the Netherlands was attacked.

I would like to know what can be done with mod-security and how it should be 
implemented.
Let us say: mod-security for dummies.
Thanks in advance.
Peter

_________________________________________________________________
Play online games with your friends with MSN Messenger 
http://messenger.msn.nl/

Re: [mod-security-users] Apache 2, AddHandler

[<gve...@mi...>]

Thank you Ivan, I see right now that RHEL3 uses the Filter mechanism.

Geffrey

Ivan Ristic wrote:

> Geffrey Velásquez [MINAG] wrote:
>
>>
>> Hi Daniel,
>> This is exactly what I have in /etc/httpd/conf.d/php.ini and there is 
>> no AddHandler directive... maybe could be added?
>
>
>   No, this:
>
>> #
>> # Cause the PHP interpreter handle files with a .php extension.
>> #
>> <Files *.php>
>>    SetOutputFilter PHP
>>    SetInputFilter PHP
>>    LimitRequestBody 524288
>> </Files>
>
>
>   replaces the AddHandler/AddType functionality.
>

Re: [mod-security-users] Apache 2, AddHandler

[Ivan R. <iv...@we...>]

Geffrey Vel=E1squez [MINAG] wrote:
>=20
> Hi Daniel,
> This is exactly what I have in /etc/httpd/conf.d/php.ini and there is n=
o=20
> AddHandler directive... maybe could be added?

   No, this:

> #
> # Cause the PHP interpreter handle files with a .php extension.
> #
> <Files *.php>
>    SetOutputFilter PHP
>    SetInputFilter PHP
>    LimitRequestBody 524288
> </Files>

   replaces the AddHandler/AddType functionality.

--=20
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Apache 2, AddHandler

[<gve...@mi...>]

Hi Daniel,
This is exactly what I have in /etc/httpd/conf.d/php.ini and there is no 
AddHandler directive... maybe could be added?


#
# PHP is an HTML-embedded scripting language which attempts to make it
# easy for developers to write dynamically generated webpages.
#

LoadModule php4_module modules/libphp4.so

#
# Cause the PHP interpreter handle files with a .php extension.
#
<Files *.php>
    SetOutputFilter PHP
    SetInputFilter PHP
    LimitRequestBody 524288
</Files>

#
# Add index.php to the list of files that will be served as directory
# indexes.
#
DirectoryIndex index.php




Code Fish Security wrote:

> Ivan Ristic wrote:
>
>> Geffrey Velásquez wrote:
>>
>>>
>>> But.. in the httpd.conf that comes with RHEL3 (Apache 2) is not 
>>> present AddType or AddHandler for php, is correct to add this 
>>> directive? PHP is running as MODULE and working well without AddType.
>>
>>
>>
>>   That's (probably) because RHEL3 uses a version of PHP that integrates
>>   with Apache 2 using the filter mechanism. Look for "php" in
>>   httpd.conf and you'll find other directives. That means that you
>>   cannot rely on DynamicOnly settings.
>>
>>   FYI, the filter integration method has been abandoned, and replaced
>>   with the "standard" handler method. So if you download a newer
>>   version of PHP you'll be able to get DynamicOnly to work.
>>
> Thankfully it's not that bad. RHEL (and Fedora) have a 
> /etc/httpd/conf.d/ directory that holds a number of sub confs. In 
> httpd.conf you'll notice it will include all *.conf files in this 
> directory. This makes life a lot easier as you can store your 
> extensions/virtualhosts as seperate config files in here rather than a 
> monolithing httpd.conf. You will see one in there called php.conf 
> which contains the AddHandler line.
>
> All the best
>
> Daniel McNamara
> Code Fish Sys ADmin
>
>
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_ide95&alloc_id396&opÌk
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users

Re: [mod-security-users] Apache 2, AddHandler

[Code F. S. <sec...@co...>]

Ivan Ristic wrote:

> Geffrey Vel=E1squez wrote:
>
>>
>> But.. in the httpd.conf that comes with RHEL3 (Apache 2) is not=20
>> present AddType or AddHandler for php, is correct to add this=20
>> directive? PHP is running as MODULE and working well without AddType.
>
>
>   That's (probably) because RHEL3 uses a version of PHP that integrates
>   with Apache 2 using the filter mechanism. Look for "php" in
>   httpd.conf and you'll find other directives. That means that you
>   cannot rely on DynamicOnly settings.
>
>   FYI, the filter integration method has been abandoned, and replaced
>   with the "standard" handler method. So if you download a newer
>   version of PHP you'll be able to get DynamicOnly to work.
>
Thankfully it's not that bad. RHEL (and Fedora) have a=20
/etc/httpd/conf.d/ directory that holds a number of sub confs. In=20
httpd.conf you'll notice it will include all *.conf files in this=20
directory. This makes life a lot easier as you can store your=20
extensions/virtualhosts as seperate config files in here rather than a=20
monolithing httpd.conf. You will see one in there called php.conf which=20
contains the AddHandler line.

All the best

Daniel McNamara
Code Fish Sys ADmin

Re: [mod-security-users] Apache 2, AddHandler

[Ivan R. <iv...@we...>]

Geffrey Vel=E1squez wrote:
>
> But.. in the httpd.conf that comes with RHEL3 (Apache 2) is not present=
=20
> AddType or AddHandler for php, is correct to add this directive? PHP is=
=20
> running as MODULE and working well without AddType.

   That's (probably) because RHEL3 uses a version of PHP that integrates
   with Apache 2 using the filter mechanism. Look for "php" in
   httpd.conf and you'll find other directives. That means that you
   cannot rely on DynamicOnly settings.

   FYI, the filter integration method has been abandoned, and replaced
   with the "standard" handler method. So if you download a newer
   version of PHP you'll be able to get DynamicOnly to work.

--=20
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Apache 2, AddHandler

[<ge...@ne...>]

Hi list,

According with the user manual, if I use SecFilterEngine DynamicOnly y 
must modify:

AddType application/x-httpd-php .php

for:

AddHandler application/x-httpd-php .php


But.. in the httpd.conf that comes with RHEL3 (Apache 2) is not present 
AddType or AddHandler for php, is correct to add this directive? PHP is 
running as MODULE and working well without AddType.


Regards,
Geffrey

Re: [mod-security-users] Apache segfaults with mod_security

[Ivan R. <iv...@we...>]

Rob Tanner wrote:
> Hi,
> 
> I downloaded and build mod_security v1.8.7 as per the INSTALL directions:
> 
> cd apache2
> apxs -cia mod_security.c
> apachectl stop
> apachectl start
> 
> Apache will not start and gets a segfault.  Unfortunately, I do not have a
> more detailed problem description than that.  I'm running apache v2.0.47 on
> RedHat AS3.
> 
> Any ideas about where to look?

   Update for the list: we tracked the crash to the APR function
   unixd_set_global_mutex_perms(). My guess is there's a problem in
   an older version of APR. Rob decided to upgrade to the latest
   version of Apache and that solved his problem.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] blacklist to modsec

[Peter W. <prw...@gm...>]

Greetings all,

I had passed this through to Ivan first, and he said to go ahead and
send it out to the list.

Some of you may already know this, but I've written a script called
blacklist_to_modsec. This is a Perl script that parses blacklist data
in the style of Jay Allen's Master Blacklist, and turns it into
mod_security rules. It includes support for pulling rules directly
from MT-Blacklist's database, if you happen to be using it, and also
includes support for running commands to restart your Apache server if
necessary.

I have been assisted in my endeavor by David Phillips
(http://tweezersedge.com/) who has contributed some of the code I
used, and who has also done a lot of debugging work. David has, out of
necessity, written in some additional functionality that allows the
rules to be inserted into an .htaccess file. I'm planning to include
this functionality in the main script, but until then, you can drop by
his site and ask him about the necessary code. I know that a lot of
people only have access to server configuration via .htaccess files,
so I think this is an important thing to have. Note, of course, that
whoever runs the main Apache server (e.g. your hosting provider) must
have the mod_security module enabled before you can make use of it
through .htaccess.

Full information, documentation, links to relevant blog entries, and
code download can be found here:

http://prwdot.org/docs/blacklisttomodsec.html

Feel free to email me with any questions, concerns, suggestions, etc.

Thanks,

Peter
-- 
Peter R. Wood | email: prw...@gm... | blog: http://prwdot.org/

Re: [mod-security-users] [Fwd: Question about ModSecurity on a Reverse proxy]

[Ivan R. <iv...@we...>]

Geoffroy Raimbault:
> 
> I have a small problem using Modsecurity on a reverse proxy with apache2 
> filtering on CGI variables. It seems that some variable like 
> REQUEST_FILENAME or SCRIPT_FILENAME are changed by mod_proxy before 
> being filtered by mod_security.
> 
> 
> For example, In trying to filter the access to files having an ".inc" 
> extension with the filter :
> 
> SecFilterSelective REQUEST_FILENAME ".inc$"

   This should be "\.inc$", BTW.


> But, looking in the modsecurity debugs log, we can see that it try the 
> filter on a modified REQUEST_FILENAME :
> 
> """"
> [09/Mar/2005:18:39:20 +0100] 
> [www.site11.com/sid#8166dd8][rid#81bc3f8][/config.inc] Checking 
> signature "\\.inc$" at REQUEST_FILENAME
> [09/Mar/2005:18:39:20 +0100] 
> [www.site11.com/sid#8166dd8][rid#81bc3f8][/config.inc] Checking against 
> "proxy:http://192.168.20.151/config.inc?test=1"
> """"

   Yes, that's how Apache handles proxying internally.


> May be there is something to do with the module ordering process of 
> Apache 2 to solve the problem ?

   No, I don't think so. And in Apache 2 the module ordering process
   is handled internally so you can't influence it.

   But if the target resource is on another server then I think
   you should not try to use the REQUEST_FILENAME variable. Try something
   else, for example, use REQUEST_URI and \.

   SecFilterSelective REQUEST_URI (\.inc$|\.inc\?)

> 
> Geoffroy


-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Blocking referer spam

[Ivan R. <iv...@we...>]

Kayne McGladrey wrote:
> Hello,
> 
> I've been running mod_security for a while now to successfully block
> referer spam, comment spam, and trackback spam from my blog. I'm
> running on a shared server and thus am forced to use my .htaccess
> file.  I've asked about including the mod_security rules in a rules
> file, and my hosting provider will not allow that use.
 > ...
> Where it says "RULES GO HERE" there are a series of rules to block
> spamvertised websites. My .htaccess is about 160k because of all the
> rules. Last month, I added the following line:
> 
>     SecFilterSelective HTTP_Referer|ARGS "doobu.com"

   Strictly speaking, you should use "doobu\.com". Otherwise the dot
   will be taken to represent any character.


> This is intended to block referer spam from doobu.com. This has been
> working for roughly a month. Beginning yesterday, I began seeing the
> rat bastards from doobu.com start filling up my logfile again:

   Have you considered the possibility your hosting provider has turned
   mod_security off? Because your rule works in my test environment.
   Remove the <IfModule ...> safeguards to see what will happen.

   You can find out more about what happens if you turn the debug
   log on and use it with level 9. (You should do this in a less
   popular folder, or one you created especially for this purpose.)

   BTW, I've never tried to create a debug log from a .htaccess
   file. It might not work.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Blocking referer spam

[Kayne M. <ka...@ie...>]

Hello,

I've been running mod_security for a while now to successfully block
referer spam, comment spam, and trackback spam from my blog. I'm
running on a shared server and thus am forced to use my .htaccess
file.  I've asked about including the mod_security rules in a rules
file, and my hosting provider will not allow that use. Thus, here's
the start of my mod_security configuration from the .htaccess in the
root directory of my website.

<IfModule mod_security.c>
    # Turn the filtering engine On or Off
    #SecFilterEngine DynamicOnly
    SecFilterEngine On

    # Make sure that URL encoding is valid
    SecFilterCheckURLEncoding On

    # Unicode encoding check
    SecFilterCheckUnicodeEncoding Off

    # Only allow bytes from this range
    SecFilterForceByteRange 0 255

    # Only log suspicious requests
    SecAuditEngine RelevantOnly

    #sane defaults
    SecFilterCheckCookieFormat Off
    SecFilterCheckUnicodeEncoding Off

    # The name of the audit log file
    SecAuditLog /home/kmcgladr/security/audit.log

    # Should mod_security inspect POST payloads
    SecFilterScanPOST On

    # By default log and deny suspicious requests
    # with HTTP status 403
    SecFilterDefaultAction "deny,log,status:403"

    # Only accept request encodings we know how to handle
    # we exclude GET requests from this because some (automated)
    # clients supply "text/html" as Content-Type
    SecFilterSelective REQUEST_METHOD "!^(GET|HEAD)$" chain
    #SecFilterSelective HTTP_Content-Type
"!(^application/x-www-form-urlencoded$|^multipart/form-data;)"

    # Require Content-Length to be provided with
    # every POST request
    SecFilterSelective REQUEST_METHOD "^POST$" chain
    SecFilterSelective HTTP_Content-Length "^$"

    # Don't accept transfer encodings we know we don't handle
    # (and you don't need it anyway)
    SecFilterSelective HTTP_Transfer-Encoding "!^$"

   # RULES GO HERE

</IfModule>

Where it says "RULES GO HERE" there are a series of rules to block
spamvertised websites. My .htaccess is about 160k because of all the
rules. Last month, I added the following line:

    SecFilterSelective HTTP_Referer|ARGS "doobu.com"

This is intended to block referer spam from doobu.com. This has been
working for roughly a month. Beginning yesterday, I began seeing the
rat bastards from doobu.com start filling up my logfile again:

80.13.20.133 - - [05/Mar/2005:02:18:02 -0500] "GET
/kayne/archives/2004/07/20/dell_vs_the_usps HTTP/1.1" 200 15371
"http://www.doobu.com/mortgag
e-rate.html" "Mozilla/4.0 (compatible; MSIE 4.01; Windows NT)"
212.138.47.21 - - [05/Mar/2005:02:21:04 -0500] "GET
/kayne/archives/2003/08/01/mailing_dining_room_tables?action=results&poll_ident=11
HTTP/1.0"
 200 20236 "http://www.doobu.com/best-mortgage-rates.html"
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Maxthon)"
148.244.150.57 - - [05/Mar/2005:02:21:15 -0500] "GET
/kayne/archives/2003/07/02/free_hot_tub HTTP/1.1" 200 16301
"http://www.doobu.com/home-equi
ty.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Maxthon)"
166.114.30.40 - - [05/Mar/2005:02:21:18 -0500] "GET
/kayne/archives/2003/01/26/two_towers_review_by_dave_barry?action=results&poll_ident=10
HTTP
/1.0" 200 14982 "http://www.doobu.com/mortgage-quote.html"
"Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1)"
81.80.153.241 - - [05/Mar/2005:02:21:19 -0500] "GET
/kayne/archives/2004/08/15/doorbelling_with_jeff_griffin HTTP/1.0" 200
14223 "http://www.doo
bu.com/personal-loan.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows
NT 5.1; iOpus-I-M)"
212.138.47.17 - - [05/Mar/2005:02:22:29 -0500] "GET
/kayne/archives/2004/06/10/back_on_icq?action=results&poll_ident=10
HTTP/1.0" 200 15091 "htt
p://www.doobu.com/home-loans.html" "Mozilla/4.0 (compatible; MSIE 5.0;
Windows ME) Opera 5.11 [en]"
212.138.47.16 - - [05/Mar/2005:02:29:23 -0500] "GET
/kayne/archives/2003/01/25/spicy_chicken HTTP/1.0" 200 14756
"http://www.doobu.com/mortgage-
loans.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET
CLR 1.1.4322)"
212.199.249.206 - - [05/Mar/2005:02:30:58 -0500] "GET
/kayne/archives/2004/08/08/vacation_photos_now_online HTTP/1.1" 200
16348 "http://www.doob
u.com/mortgage-refinance.html" "Mozilla/4.0 (compatible; MSIE 5.0;
Windows ME) Opera 5.11 [en]"
212.47.27.194 - - [05/Mar/2005:02:32:07 -0500] "GET
/kayne/archives/2004/06/06/at_large_delegate HTTP/1.1" 200 18120
"http://www.doobu.com/home-
loan.html" "Mozilla/4.0 (compatible; MSIE 5.0; Mac_PowerPC; AtHome021)"

Just to focus on those examples, I don't have a .htaccess defined in
each of the directories referenced.

I do not understand how my configuration is now failing to block spam
from this one referer spammer.

Please advise on how to adjust my configuration to block this referer
spam.

[mod-security-users] [Fwd: Question about ModSecurity on a Reverse proxy]

[Ivan R. <iv...@we...>]

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Apache segfaults with mod_security

[Ivan R. <iv...@we...>]

Rob Tanner wrote:
> Hi,
> 
> I downloaded and build mod_security v1.8.7 as per the INSTALL directions:
> 
> cd apache2
> apxs -cia mod_security.c
> apachectl stop
> apachectl start
> 
> Apache will not start and gets a segfault.  Unfortunately, I do not have a
> more detailed problem description than that.  I'm running apache v2.0.47 on
> RedHat AS3.
> 
> Any ideas about where to look?

   That's strange. Is there anything in the Apache error log? Do you have
   any of the mod_security configuration directives in httpd.conf?

   You can try doing the following:

   1. Go to where your httpd binary is.
   2. strace ./httpd -X 2> output
   3. Wait until Apache either starts or segfaults
   4. Send the output to me privately

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] Apache segfaults with mod_security

[Rob T. <rt...@li...>]

Hi,

I downloaded and build mod_security v1.8.7 as per the INSTALL directions:

cd apache2
apxs -cia mod_security.c
apachectl stop
apachectl start

Apache will not start and gets a segfault.  Unfortunately, I do not have a
more detailed problem description than that.  I'm running apache v2.0.47 on
RedHat AS3.

Any ideas about where to look?

Thanks.

-- 
Rob Tanner
UNIX Services Manager
Linfield College, McMinnville OR

Re: [mod-security-users] XML-Tags in HTTP GET

[Ivan R. <iv...@we...>]

Thomas B=F6rnert wrote:
> Hi List,
>=20
> the next question, xml tags are matched by
>=20
> SecFilter "<(.|\n)+>"
>=20
> is there a solution to allow xml in GET and POST,
> by hold the security?

   That depends on whether your application is vulnerable. What
   exactly are you trying to prevent with SecFilter "<(.|\n)+>"?

--=20
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] XML-Tags in HTTP GET

[Thomas <tb...@tb...>]

Hi List,

the next question, xml tags are matched by

SecFilter "<(.|\n)+>"

is there a solution to allow xml in GET and POST,
by hold the security?

Thanks.

-Thomas