mod-security-users — General discussion about mod_security

[mod-security-users] Wget filter

[Tkachenko A. <al...@tk...>]

Peace be with you,

I use the following filters:
********
    SecFilter "wget+"
    SecFilter "wget%"
********

I have 2 questions, please help me with them:
1) My logs always contain "wget+" but no "wget%" even if the following
request was blocked "cd%20.temp22;wget%20http://".
Why so? Why my log does not contain "wget%" at all?

2) Now I have blocked the "GET /rus/sysswgetst.htm HTTP/1.1" requests with
"Pattern match "wget+" at THE_REQUEST" message
Why so? I don't want to block them.


Thank you!



Alexey.

Re: [mod-security-users] Can mod-security help with this?

[Ivan R. <iv...@we...>]

Danny Shurett wrote:
> Default from the sample:
> 
> <IfModule mod_security.c>

   I assume you have LoadModule somewhere before this line.


>     # Only inspect dynamic requests
>     # (YOU MUST TEST TO MAKE SURE IT WORKS AS EXPECTED)
>     SecFilterEngine DynamicOnly

   Did you test this? If you didn't change "DynamicOnly"
   to "On".

-- 
Ivan Ristic (http://www.modsecurity.org)

Re: [mod-security-users] Can mod-security help with this?

[Ivan R. <iv...@we...>]

Danny Shurett wrote:
> This didn't work for me.  Here is more log info:

   How does the rest of your (mod_security) configuration
   look like? I am positive the signature (the first one
   on the list) because I tested it :)

-- 
Ivan Ristic (http://www.modsecurity.org)

Re: [mod-security-users] Can mod-security help with this?

[Danny S. <dsh...@al...>]

This didn't work for me.  Here is more log info:

216.67.229.212 - - [24/Jan/2005:13:53:43 -0500] "GET
/board/viewtopic.php?p=5290&highlight=%2527%252Esystem(chr(112)%252Echr(101)
%252Echr(114)%252Echr(108)%252Echr(32)%252Echr(45)%252Echr(101)%252Echr(32)%
252Echr(34)%252Echr(112)%252Echr(114)%252Echr(105)%252Echr(110)%252Echr(116)
%252Echr(32)%252Echr(113)%252Echr(40)%252Echr(106)%252Echr(83)%252Echr(86)%2
52Echr(111)%252Echr(119)%252Echr(77)%252Echr(115)%252Echr(100)%252Echr(41)%2
52Echr(34))%252E%2527 HTTP/1.0" 200 98 "-" "Mozilla/4.0"
24.57.53.2 - - [24/Jan/2005:13:53:43 -0500] "GET
/board/viewtopic.php?p=3201&highlight=%2527%252Esystem(chr(112)%252Echr(101)
%252Echr(114)%252Echr(108)%252Echr(32)%252Echr(45)%252Echr(101)%252Echr(32)%
252Echr(34)%252Echr(112)%252Echr(114)%252Echr(105)%252Echr(110)%252Echr(116)
%252Echr(32)%252Echr(113)%252Echr(40)%252Echr(106)%252Echr(83)%252Echr(86)%2
52Echr(111)%252Echr(119)%252Echr(77)%252Echr(115)%252Echr(100)%252Echr(41)%2
52Echr(34))%252E%2527 HTTP/1.0" 200 98 "-" "Mozilla/4.0"
64.186.228.51 - - [24/Jan/2005:13:53:43 -0500] "GET
/board/viewtopic.php?p=4132&highlight=%2527%252Esystem(chr(112)%252Echr(101)
%252Echr(114)%252Echr(108)%252Echr(32)%252Echr(45)%252Echr(101)%252Echr(32)%
252Echr(34)%252Echr(112)%252Echr(114)%252Echr(105)%252Echr(110)%252Echr(116)
%252Echr(32)%252Echr(113)%252Echr(40)%252Echr(106)%252Echr(83)%252Echr(86)%2
52Echr(111)%252Echr(119)%252Echr(77)%252Echr(115)%252Echr(100)%252Echr(41)%2
52Echr(34))%252E%2527 HTTP/1.0" 200 98 "-" "Mozilla/4.0"
64.132.74.96 - - [24/Jan/2005:13:53:43 -0500] "GET
/board/viewtopic.php?p=4171&highlight=%2527%252Esystem(chr(112)%252Echr(101)
%252Echr(114)%252Echr(108)%252Echr(32)%252Echr(45)%252Echr(101)%252Echr(32)%
252Echr(34)%252Echr(112)%252Echr(114)%252Echr(105)%252Echr(110)%252Echr(116)
%252Echr(32)%252Echr(113)%252Echr(40)%252Echr(106)%252Echr(83)%252Echr(86)%2
52Echr(111)%252Echr(119)%252Echr(77)%252Echr(115)%252Echr(100)%252Echr(41)%2
52Echr(34))%252E%2527 HTTP/1.0" 200 98 "-" "Mozilla/4.0"



On 1/24/05 12:49 PM, "Gerwin Krist" <ge...@di...> wrote:

> Sure you can use:
> SecFilterSelective ARG_highlight %27
> 
> Our company also filters for the following:
>     SecFilterSelective ARGS "fwrite"
>     SecFilterSelective ARGS "fopen"
>     SecFilterSelective ARGS "chr\("
>     SecFilterSelective ARGS "echr\("
>     SecFilterSelective ARGS "system\("
> 
> To be really secure :) I hope it will help you
> 
> Danny Shurett wrote:
> 
>> I am seeing a dos attack with a random string, but it includes this:
>> 
>> highlight=%2527%252Esystem(chr(112)%252Echr(101)
>> 
>> Can someone let me know if mod-security can help with this and how I could
>> use it to stop it?
>> 
>> 
>> 
>> 
>> -------------------------------------------------------
>> This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
>> Tool for open source databases. Create drag-&-drop reports. Save time
>> by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
>> Download a FREE copy at http://www.intelliview.com/go/osdn_nl
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> 
>> 
>>  
>> 
> 
> 
> 
> -------------------------------------------------------
> This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
> Tool for open source databases. Create drag-&-drop reports. Save time
> by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
> Download a FREE copy at http://www.intelliview.com/go/osdn_nl
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> 
> 

Re: [mod-security-users] Can mod-security help with this?

[Gerwin K. <ge...@di...>]

BTW it's not a dos attack. It's the santy worm: 
http://www.f-secure.com/v-descs/santy_a.shtml
It can do nasty things if your not patched or protected!


Danny Shurett wrote:

>I am seeing a dos attack with a random string, but it includes this:
>
>highlight=%2527%252Esystem(chr(112)%252Echr(101)
>
>Can someone let me know if mod-security can help with this and how I could
>use it to stop it?
>
>
>
>
>-------------------------------------------------------
>This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
>Tool for open source databases. Create drag-&-drop reports. Save time
>by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
>Download a FREE copy at http://www.intelliview.com/go/osdn_nl
>_______________________________________________
>mod-security-users mailing list
>mod...@li...
>https://lists.sourceforge.net/lists/listinfo/mod-security-users
>
>
>  
>

Re: [mod-security-users] Can mod-security help with this?

[Gerwin K. <ge...@di...>]

Sure you can use:
SecFilterSelective ARG_highlight %27

Our company also filters for the following:
    SecFilterSelective ARGS "fwrite"
    SecFilterSelective ARGS "fopen"
    SecFilterSelective ARGS "chr\("
    SecFilterSelective ARGS "echr\("
    SecFilterSelective ARGS "system\("

To be really secure :) I hope it will help you

Danny Shurett wrote:

>I am seeing a dos attack with a random string, but it includes this:
>
>highlight=%2527%252Esystem(chr(112)%252Echr(101)
>
>Can someone let me know if mod-security can help with this and how I could
>use it to stop it?
>
>
>
>
>-------------------------------------------------------
>This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
>Tool for open source databases. Create drag-&-drop reports. Save time
>by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
>Download a FREE copy at http://www.intelliview.com/go/osdn_nl
>_______________________________________________
>mod-security-users mailing list
>mod...@li...
>https://lists.sourceforge.net/lists/listinfo/mod-security-users
>
>
>  
>

[mod-security-users] Can mod-security help with this?

[Danny S. <dsh...@al...>]

I am seeing a dos attack with a random string, but it includes this:

highlight=%2527%252Esystem(chr(112)%252Echr(101)

Can someone let me know if mod-security can help with this and how I could
use it to stop it?

Re: [mod-security-users] two audit logs?

[Ivan R. <iv...@we...>]

da...@ez... wrote:
> Is there any way to set two different audit logs? Something like:
> 
> SecAuditEngine On
> SecAuditLog logs/audit_log
> 
> SecAuditEngine RelevantOnly
> SecAuditLog logs/relevant_log
> 
> I want one log that shows everything and one that shows only what matched a
> filter. Is it possible? This would be a big help. If we had this and a
> client's site was hacked we would have full logging and could see exactly
> how it was done. Then we could create new filters to block such attacks and
> tell the client what scripts need to be secured. I really don't want to only
> have a log of everything because we need to see just what matched. We have
> to monitor this to make sure the rules we have setup are not creating
> problems for our clients. This would be almost impossible with one huge
> file.

   No, you can't have two audit logs for the same content. (You can
   have two audit logs for two applications/areas on the same web
   server.)

   However, what you can do, is log everything but have a script
   that parses out the full audit log and separates the ones with
   matches.

-- 
Ivan Ristic (http://www.modsecurity.org)

[mod-security-users] two audit logs?

[<da...@ez...>]

Is there any way to set two different audit logs? Something like:

SecAuditEngine On
SecAuditLog logs/audit_log

SecAuditEngine RelevantOnly
SecAuditLog logs/relevant_log

I want one log that shows everything and one that shows only what matched a
filter. Is it possible? This would be a big help. If we had this and a
client's site was hacked we would have full logging and could see exactly
how it was done. Then we could create new filters to block such attacks and
tell the client what scripts need to be secured. I really don't want to only
have a log of everything because we need to see just what matched. We have
to monitor this to make sure the rules we have setup are not creating
problems for our clients. This would be almost impossible with one huge
file.

Re: [mod-security-users] mod_security directives order

[Ivan R. <iv...@we...>]

Tkachenko Alexei wrote:
> Peace be with you,
> 
> Currently seems mod_security works in this way: if request match directive
> (SecFilter for example) than the corresponded action performed and no other
> action performed even if this request match another directive too.
> 
> Is there any possibility to bypass this?
> Maybe for particular directive or something like this?

   The request does not have to terminate on a rule match so, yes, it
   possible to do several different things for one request. E.g.

   # log only
   SecFilter KEYWORD1 log,pass

   # execute something
   SecFilter KEYWORD2 log,pass,exec:/some/binary

   # deny request
   SecFilter KEYWORD3 log,deny

-- 
Ivan Ristic (http://www.modsecurity.org)

[mod-security-users] mod_security directives order

[Tkachenko A. <al...@tk...>]

Peace be with you,

Currently seems mod_security works in this way: if request match directive
(SecFilter for example) than the corresponded action performed and no other
action performed even if this request match another directive too.

Is there any possibility to bypass this?
Maybe for particular directive or something like this?


-----
Regards,
Alex A. Tkachenko

Re: [mod-security-users] Deleting Banned Ips

[Ivan R. <iv...@we...>]

Faruk Aysoy wrote:
> Guys,
> As you know, the mod_security blocks the ip( some kind
> of ban) how can we delete that ip from the blacklist.

   There's no blacklist. For every request that comes in
   mod_security makes a decision whether to block it or
   not - every time.


> I donot want to add an ip to whitelist - allow list-,
> b/c then any further actions coming from that ip
> cannot be stopped. I just want to delete that ip from
> blacklist, as it never attacked my server before. How
> can I do this? Thank you for your attention and time.

   If a reject is being rejected that means it triggered
   at least one rule in your configuration. Assuming your
   configuration is correct the request is an attack. If
   the request is not an attack then your configuration is
   incorrect :)

-- 
Ivan Ristic (http://www.modsecurity.org)

Re: [mod-security-users] Important Issue About SecFilterEngine - Immediate Help Needed

[Ivan R. <iv...@we...>]

HerKonu Team - Black wrote:
> Hi,
> First of all, thank you for your response. Our server is running on
> the Suse/Linux. However, we do not know how to write(design) rules to
> identify the attacks. If you can help us with that, we would be very
> glad. Also, when you talk about the logs, do you mean the server logs
> about the attacks, or the logs taken by the mod_security?

   Web server logs. I'll write the rules you show me one Apache
   access log entry that belongs to the attackers.

-- 
Ivan Ristic (http://www.modsecurity.org)

Re: [mod-security-users] Important Issue About SecFilterEngine - Immediate Help Needed

[Ivan R. <iv...@we...>]

HerKonu Team - Black wrote:
> Hi,
> We are under attack by Ddos and Http-Request style attacks by some
> lamers, and we have been making a research for a long time, and we
> tried so many modules, but they weren't good enough to protect our
> website. Finally, we found your apache module, which is mod_security
> and we installed it. It is working great when we turn "SecFilterEngine
> On", it blocks the attacking ips and protects our website and the
> server. However, when we do this, nobody can login to our website with
> their usernames and passwords, when they try it gives an error:500 to
> them.

   Well, the configuration you are using is no good. That's the
   configuration I use for regression testing - it's not designed
   to work in real life.

   What you need to do is design a rule (or rules) to identify
   the attacks. Can you do that from your logs?

   Is the server running Linux?

-- 
Ivan Ristic (http://www.modsecurity.org)

[mod-security-users] Important Issue About SecFilterEngine - Immediate Help Needed

[HerKonu T. - B. <he...@gm...>]

Hi,
We are under attack by Ddos and Http-Request style attacks by some
lamers, and we have been making a research for a long time, and we
tried so many modules, but they weren't good enough to protect our
website. Finally, we found your apache module, which is mod_security
and we installed it. It is working great when we turn "SecFilterEngine
On", it blocks the attacking ips and protects our website and the
server. However, when we do this, nobody can login to our website with
their usernames and passwords, when they try it gives an error:500 to
them.
We tried "SecFilterEngine DynamicOnly", at that time, it enabled the
loging in process, but it doesn't protect the server, the server
becomes frozen ina few seconds. So, we are seeking for a solution of
both protecting our server and use our website efficiently, without
any problems. I am sending our mod_security.conf in the attachment, so
you can also check it. Other informations are written below. I hope we
can get a quick answer and help, we would appreciate it. Thank you for
your attention and time.

HerKonu.Com Team

We are using:
   Php-Nuke Style Web-Site
   Apache 2.0
   mod_security.conf (included in the attachment)

Our website is: www.herkonu.com, however, to protect server from the
lamer attacks, now we moved our real website to this secret address:
http://www.herkonu.com/saldirulandingil/index.php

[mod-security-users] Deleting Banned Ips

[Faruk A. <fa...@ya...>]

Guys,
As you know, the mod_security blocks the ip( some kind
of ban) how can we delete that ip from the blacklist.
I donot want to add an ip to whitelist - allow list-,
b/c then any further actions coming from that ip
cannot be stopped. I just want to delete that ip from
blacklist, as it never attacked my server before. How
can I do this? Thank you for your attention and time.

Faruk


PS:I am using, Suse Linux, Apache2 and the latest
stable version of mod_security


		
__________________________________ 
Do you Yahoo!? 
Read only the mail you want - Yahoo! Mail SpamGuard. 
http://promotions.yahoo.com/new_mail 

Re: [mod-security-users] Log question

[Ivan R. <iv...@we...>]

Tkachenko Alexei wrote:
> But: as I understand mod_security currently already has possibility to track
> different events (regexp - SecFilter) and act in different ways - so you can
> use 1 SecFilter to log in 1 file, use another SecFilter to log in another
> file and use 3-rd SecFilter to just dent without logging and so on?
> If this is correct that it is possible to do what I asked.
> I just asked how to do it in right way.

   Hmm, it's possible although not supported in the current release. I'll
   implement something along those lines and contact you so that you
   can test it.

-- 
Ivan Ristic (http://www.modsecurity.org)

Re: [mod-security-users] How to/feature requests?

[Ivan R. <iv...@we...>]

Eli wrote:
> One of those was to prevent Apache from logging (to the access logs) certain
> requests coming in.

   ModSecurity doesn't help there because Apache rejects invalid requests
   long before they reach ModSecurity. One way to handle that is not to
   log the request line:

   LogFormat "%!414r" no414
   CustomLog logs/access_log no414

   Alternatively, you may try to use custom logging and SetEnvIf to
   avoid logging the requests altogether.


> "nolog,deny,status:403", we could have "nolog,deny,status:403,envtag:3a"

   The setenv action will appear in 1.9.


> Also, I was hoping to be able to use mod_security to log POST data (form
> data, not binary) in the event of hackers trying to do things, etc...

   It's possible. Look in the manual for the description of the audit
   logging.


> I was also hoping that it would be possible to use
> SecFilterCheckURLEncoding, SecFilterCheckUnicodeEncoding and
> SecFilterForceByteRange only on URL/URI data (ie, in a GET request), and not
> parse POST data with it.  You could implement a toggle, but then it may even
> be better to have specific filters just for the 2 POST data types because
> then you could have a very restrictive byte range for URI info, and then a
> more relaxed one for POST data being submitted in a form.  This was what I
> was hoping to have so I could restrict bytes to 32-127 in GET requests, but
> then for POST requests, relax it to 0-255 since it's very common for people
> to submit data with newlines in it and such (textareas) and other characters
> which I assume would be blocked when there's no reason to worry about
> situations like that.

   There's no reason to allow more characters in POST. Then the attacker
   would only need to change from GET to POST to execute the attack
   successfully. Still, you can turn off SecFilterForceByteRange
   completely and examine the bytes explicitly. E.g.

   SecFilterSelective THE_REQUEST "!^[\x0a\x0d\x20-\x7f]+$"

-- 
Ivan Ristic (http://www.modsecurity.org)

[mod-security-users] How to/feature requests?

[Eli <eli...@ex...>]

I recently installed mod_security on a server to hopefully do a few =
things
that I thought it may be able to do.

One of those was to prevent Apache from logging (to the access logs) =
certain
requests coming in.  Sites on servers have been getting bogus HTTP =
SEARCH
requests which Apache will reject and it causes no harm, however the =
path
provided with the SEARCH request is in high ascii, so Apache quotes the
characters in the log files and you end up with an enormous line of junk =
in
your log files.  This has been borking the stats software from reading =
the
logfiles which means we then have to fix the log files by hand (oh, yay =
:P).
Anyways, I set up this:

	SecFilterSelective "REQUEST_METHOD" "!^(GET|HEAD|POST)$"
"nolog,deny,status:403"

Initially I thought the nolog meant it wouldn't let Apache log it at all =
-
then I noticed it was just preventing it from being recorded by =
mod_security
in the error logfile.  I then thought that if I used mod_security JUST =
to
filter based on that rule, I could use the environment variable trick =
with a
CustomLog line to prevent logging any lines that mod_security was =
triggered
on.  However, that means I have to not log ANYTHING mod_security =
touches,
since it's just that one env variable for everything.

So, I was wondering if there was any other way to do what I'm trying to =
do,
or if maybe a request for something more extensible with regards to =
blocking
requests from travelling further in Apache (I don't know enough about =
the
internal workings - does Apache log the request before mod_security can
touch it?  If so could it just be dropped if we didn't want to log it?), =
or
maybe having multiple environment variables possible - like rather than
"nolog,deny,status:403", we could have "nolog,deny,status:403,envtag:3a"
which would give an environment variable specific "tag" to that filter.
Then when testing for mod_security-relevant in a CustomLog, we could =
instead
test for mod_security-relevant-3a (tag is appended to the variable) or
something?  This would allow people to selectively log stuff based on a =
per
filter basis.


Also, I was hoping to be able to use mod_security to log POST data (form
data, not binary) in the event of hackers trying to do things, etc...  I
know the log file would be enormous, but it would still be nice to do.  =
The
unfortunate part was that it seems there's no way to do this that I =
could
see either, however maybe if the suggestion above was implemented it =
could
be.

I was also hoping that it would be possible to use
SecFilterCheckURLEncoding, SecFilterCheckUnicodeEncoding and
SecFilterForceByteRange only on URL/URI data (ie, in a GET request), and =
not
parse POST data with it.  You could implement a toggle, but then it may =
even
be better to have specific filters just for the 2 POST data types =
because
then you could have a very restrictive byte range for URI info, and then =
a
more relaxed one for POST data being submitted in a form.  This was what =
I
was hoping to have so I could restrict bytes to 32-127 in GET requests, =
but
then for POST requests, relax it to 0-255 since it's very common for =
people
to submit data with newlines in it and such (textareas) and other =
characters
which I assume would be blocked when there's no reason to worry about
situations like that.

Sorry for rambling on like that, just figured I'd voice my wants and see =
if
others agree with them :)

Thanks!

Eli.

Re: [mod-security-users] ModSecurity for Java - Deploying

[Roger <rm...@ya...>]

Replaced old version of jdk and jakarta for the new jdk1.5.0_01 and  new
jakarta-tomcat-5.5.4 and all is ok!

I have still not proven Your new version complied modsecurity-java-m3a.zip
with JDK 1.4 

Thanks!

-roger


		
__________________________________ 
Do you Yahoo!? 
Meet the all-new My Yahoo! - Try it today! 
http://my.yahoo.com 
 

Re: [mod-security-users] ModSecurity for Java - Deploying

[Ivan R. <iv...@we...>]

Roger wrote:
> Hi,
> I am trying installing ModSecurity for Java but I can not get to run
> sucessfully, I get the follow message(jakarta's log) when deploying by
> jakarta's manager web:
> --------------
> 2005-01-19 11:42:34 StandardContext[/msj]Excepci=F3n arrancando filtro
> ModSecurityFilter
> java.lang.UnsupportedClassVersionError:
> com/webkreator/modsecurity/ModSecurityFilter (Unsupported major.minor
> version 49.0)
> 	at java.lang.ClassLoader.defineClass0(Native Method)
> [...]
> ----------
>=20
> I use jakarta-tomcat-5.0.28 with j2sdk1.4.1_01 in WinXP Pro box.
> What java-tools/class I must to get??

   I am not familiar with that error but it seems to me that it's
   complaining about the class version number. I may have compiled it
   with JDK 1.5 by mistake. I'll post a new version, compiled with
   JDK 1.4, today or tomorrow.

--=20
Ivan Ristic (http://www.modsecurity.org)

[mod-security-users] ModSecurity for Java - Deploying

[Roger <rm...@ya...>]

Hi,
I am trying installing ModSecurity for Java but I can not get to run
sucessfully, I get the follow message(jakarta's log) when deploying by
jakarta's manager web:
--------------
2005-01-19 11:42:34 StandardContext[/msj]Excepción arrancando filtro
ModSecurityFilter
java.lang.UnsupportedClassVersionError:
com/webkreator/modsecurity/ModSecurityFilter (Unsupported major.minor
version 49.0)
	at java.lang.ClassLoader.defineClass0(Native Method)
[...]
----------

I use jakarta-tomcat-5.0.28 with j2sdk1.4.1_01 in WinXP Pro box.
What java-tools/class I must to get?? 

Thanks in advance!

-roger


		
__________________________________ 
Do you Yahoo!? 
Meet the all-new My Yahoo! - Try it today! 
http://my.yahoo.com 
 

Re: [mod-security-users] excluding virtual hosts

[Ivan R. <iv...@we...>]

David Obando wrote:
> I found the answer myself.
> One example would be:
> 
> SecFilterSelective ARGS "/bin/" chain
> SecFilterSelective SERVER_NAME !example.com

   Correct. FYI you should be aware that second rule will match
   "www.example.com", "somethingelse.example.com",
   "example.com.modsecurity.org" and so on. It's better to use
   the dollar sign to anchor the regex to the end of string. E.g.

   SecFilterSelective SERVER_NAME !example.com$

   Anyway, that approach only works one rule at a time. There
   are other things you could try:

   1) The allow action will let the request through. So if you
      do something like this:

      # rules that apply to all hosts
      SecFilter ...
      SecFilter ...

      # end processing early for some hosts
      SecFilterSelective SERVER_NAME (example1.com|example2.com)$ allow

      # rules that apply to some hosts
      SecFilter ...


   2) You could use the skip action to skip over some rules
      but you would need to count them so it's not very
      practical.

   3) You can explicitly disable filtering for some hosts:

      <VirtualHost ...>
      SecFilterEngine Off
      </VirtualHost>

   4) Or clear the rule list and load a partial list only:

      <VirtualHost ...>
      SecFilterInheritance Off
      Include conf/partial_modsecurity_rules.conf
      </VirtualHost>

-- 
Ivan Ristic (http://www.modsecurity.org)

Re: [mod-security-users] excluding virtual hosts

[Katsuharu W. <ml...@pa...>]

At Mon, 17 Jan 2005 13:03:02 +0100,
David Obando wrote:
> 
> I would like to define deny-filters, that exclude certain virtual hosts. 
> In other words I want that some defined hosts are allowed to do things 
> others are not allowed to.
> I don't want to put the filters in the virtual hosts-section because 
> it's too many virtual hosts.
> 
> How do I set my filters the best way? Should I work with chains?
> 

How about this?

 SecFilterSelective HTTP_HOST "allow2.vhost.com" skipnext:2
 SecFilterSelective HTTP_HOST "allow1.vhost.com" skipnext:1
 SecFilter foo deny

--
Katsuharu Watanabe
Key fingerprint = 121E AC94 AD99 C468 9E02  C868 827B D767 058A E62E

Re: [mod-security-users] excluding virtual hosts

[David O. <da...@cr...>]

I found the answer myself.
One example would be:

SecFilterSelective ARGS "/bin/" chain
SecFilterSelective SERVER_NAME !example.com


Regards,
David


David Obando schrieb am 17.01.2005 13:03:

> Hi all,
>
> I would like to define deny-filters, that exclude certain virtual 
> hosts. In other words I want that some defined hosts are allowed to do 
> things others are not allowed to.
> I don't want to put the filters in the virtual hosts-section because 
> it's too many virtual hosts.
>
> How do I set my filters the best way? Should I work with chains?
>
> Thanks,
> David
>
>


-- 
Seit dem 01.01.05 wird der Email-Verkehr in Deutschland massiv überwacht
(http://www.regtp.de/imperia/md/content/tech_reg_t/ueberwachu/tkuev.pdf).
Versende keine vertraulichen Informationen ohne starke Verschlüsselung!
Mein GnuPG-Key: http://cryptix.de/pgp/david.asc
GnuPG-Fingerprint: CE888BDFF1DED3B8D2105F29CB1920BD87