mod-security-users — General discussion about mod_security

[mod-security-users] excluding virtual hosts

[David O. <da...@cr...>]

Hi all,

I would like to define deny-filters, that exclude certain virtual hosts. 
In other words I want that some defined hosts are allowed to do things 
others are not allowed to.
I don't want to put the filters in the virtual hosts-section because 
it's too many virtual hosts.

How do I set my filters the best way? Should I work with chains?

Thanks,
David


-- 
Seit dem 01.01.05 wird der Email-Verkehr in Deutschland massiv überwacht
(http://www.regtp.de/imperia/md/content/tech_reg_t/ueberwachu/tkuev.pdf).
Versende keine vertraulichen Informationen ohne starke Verschlüsselung!
Mein GnuPG-Key: http://cryptix.de/pgp/david.asc
GnuPG-Fingerprint: CE888BDFF1DED3B8D2105F29CB1920BD87 

Re: [mod-security-users] reporting tools

[Ivan R. <iv...@we...>]

Peter Wood wrote:
> Greetings,
> 
> I've got the latest mod_security release up and running, and it's
> working great to block all sorts of requests to my Apache web
> server... mostly Movable Type blog comment spammers. The audit_log is
> human-readable, but it's a bit time-consuming to read through it to
> see what's being blocked and to see if anything is being wrongly
> blocked. So I'm trying to find some reporting tools that would parse
> the audit_log and display a summary report in some easily-viewed
> HTML-esque manner.
> 
> Searching this mailing list hasn't turned up anything useful, and the
> only thing I've found on Google is a script that parses the audit_log
> and inserts it into a mysql database... but doesn't actually do any
> reporting or analysis.
> 
> Any suggestions?

   I am not aware of any such tools. But I can tell you that I expect
   ModSecurity 2.x to have a built-in viewer. However, ModSecurity 2
   will be a complete rewrite so I can't tell you when it will be
   published. I hope to release the first version in May.

-- 
Ivan Ristic (http://www.modsecurity.org)

Re: [mod-security-users] mod_security and mod_rewrite incompatability

[Ivan R. <iv...@we...>]

Mark Precious wrote:
> Hi,
> 
> I can't seem to resolve what appears to be an
> incompatability between these two popular modules:
> mod_security and mod_rewrite. 
> 
> I'm running a patched apache 2.0.52 with the latest
> stable mod_security and the bundled mod_rewrite.
> 
> To effectively disable mod_security I only need to
> enable mod_rewrite with:
> 
>        <Location "/">
>                RewriteEngine On
>        </Location>
> 
> I first noticed that mod_security would be disabled
> when running the nikto scanner against the httpd
> daemon (with and without the RewriteEngine On). 
> 
> Has anyone else come across this problem?

   Not here. It works fine for me with this simple configuration:

   SecFilterEngine On
   SecFilter 111
   <Location "/">
       RewriteEngine On
   </Location>

   Maybe we need to see your full configuration. You mentioned
   your Apache was patched?

-- 
Ivan Ristic (http://www.modsecurity.org)

Re: [mod-security-users] Instaling

[Ivan R. <iv...@we...>]

i=F1aki wrote:
> HI, I downloaded mod_security with wget, then i read in a reference tha=
t=20
> i compile /usr/local/apache/bin/apxs -cia mod_security.c this but in RH=
E=20
> not in /usr/local/apache/ =BF?

   On a Red Hat system you should be able to just type:

   apxs -cia mod_security.c

   If that doesn't work you probably need to install the httpd-devel RPM.


> the server contains virtual domains, the configuration of httpd.conf is=
=20
> for all?

   That depends where you put the configuration. For example, if you
   put it outside all <VirtualHost> containers it will work for all
   hosts. But if you put it inside only one it will only work for
   that one.

--=20
Ivan Ristic (http://www.modsecurity.org)

[mod-security-users] reporting tools

[Peter W. <prw...@gm...>]

Greetings,

I've got the latest mod_security release up and running, and it's
working great to block all sorts of requests to my Apache web
server... mostly Movable Type blog comment spammers. The audit_log is
human-readable, but it's a bit time-consuming to read through it to
see what's being blocked and to see if anything is being wrongly
blocked. So I'm trying to find some reporting tools that would parse
the audit_log and display a summary report in some easily-viewed
HTML-esque manner.

Searching this mailing list hasn't turned up anything useful, and the
only thing I've found on Google is a script that parses the audit_log
and inserts it into a mysql database... but doesn't actually do any
reporting or analysis.

Any suggestions?

Thanks,

Peter

Re: [mod-security-users] mod_security, apache2 and chroot -> help

[Ivan R. <iv...@we...>]

Astarna wrote:
> Hello
> 
> I'm having some major problems getting chroot to work properly with
 > mod_security.. hoping someone will be able to help.
 >
 > ...
> 
> I've created the following directories within the chroot jail
> 
> /var/chroot/apache/var/run
> /var/chroot/apache/var/www
> /var/chroot/apache/usr/lib/apache2
> 
> I've moved my apache files (/usr/lib/apache2) to /var/chroot/apache/usr/lib/apache2. 
> I've created a symlink in /usr/lib/apache2 to point to /var/chroot/apache/usr/lib/apache2. 
> based off of this link: http://sourceforge.net/mailarchive/forum.php?thread_id=5863509&forum_id=33492

   Because you have files in three locations one symlink isn't going
   to handle them all. You also need to link /var/www to
   /var/chroot/apache/var/www. I propose that you keep the pidfile
   somewhere in /usr/lib/apache2 to avoid having to create a third
   symlink.


> I've edit'd the /etc/apache2.conf with the following values:
> ServerRoot /var/chroot/apache/usr/lib/apache2
> DocumentRoot /var/chroot/apache/var/www/localhost/htdocs

   These two are not correct. You need to use:

   ServerRoot /usr/lib/apache2
   DocumentRoot /var/www/localhost/htdocs

-- 
Ivan Ristic (http://www.modsecurity.org)

[mod-security-users] Re: mod_security, apache2 and chroot -> help

[David F. <Da...@me...>]

Hi hanji,

Have you really created these directories WITHIN the chroot jail? I assume you
mean that these directories ARE the chroot area.

> I've created the following directories within the chroot jail
> 
> /var/chroot/apache/var/run
> /var/chroot/apache/var/www
> /var/chroot/apache/usr/lib/apache2

If you have this:

SecChrootDir /var/chroot/apache

You need to change the other config lines to these:

ServerRoot /usr/lib/apache2
DocumentRoot /var/www/localhost/htdocs

since the server doesn't "see" the first part of the path after the chroot
command moves the apparent root directory to /var/chroot/apache

I'm not sure if you really needed to move your /usr/lib/apache2 files to
inside the chroot area. I have found that everything except the documents and
the directory into which the pid file gets written can be left outside. The
exception to this is adding these libraries 

libnss_dns.so.2
libnss_files.so.2
libresolv.so.2

which get used by php, and some Smarty php extension that are read when php
files are accessed. The libraries above are always linked to the php module
dynamically (I can't remember why, but you can't avoid it) so if you use php
they need to be in there.

I hope this help,

David.

-- 
-------------------------------------------------
Email: Da...@me...
-------------------------------------------------

[mod-security-users] Instaling

[<in...@we...>]

HI, I downloaded mod_security with wget, then i read in a reference that=20
i compile /usr/local/apache/bin/apxs -cia mod_security.c this but in RHE=20
not in /usr/local/apache/ =BF?
the server contains virtual domains, the configuration of httpd.conf is=20
for all?

[mod-security-users] Re: mod_security, apache2 and chroot -> help

[Mark P. <m_p...@ya...>]

Hi,

I can't quite see where your problem is occuring.. but
I have an alternate method that doesn't involve moving
files around or creating links. 

I'm sure there are even more elegant ways too...

1) httpd.conf

Note that the PidFile will locate itself in
$SecChrootDir/$ServerRoot/$PidFile
		
	ServerRoot=/opt/apache
	PidFile ./httpd.pid
	DocumentRoot "/htdocs/www"

2) mod_security.conf

	SecChrootDir /jail

3) Directory Structure:

Note the real location for your documents and the
place you should use is in /jail/htdocs/www
		
          mkdir /jail/htdocs/www
          mkdir /jail/opt/apache

Note that with this method $ServerRoot and
$DocumentRoot paths need to be valid paths both inside
and outside the jail. httpd will fail to start if the
non-jailed directory path to $DocumentRoot does not
exist.
          
          mkdir /htdocs/www	

Mark



	
		
__________________________________ 
Do you Yahoo!? 
Yahoo! Mail - You care about security. So do we. 
http://promotions.yahoo.com/new_mail

[mod-security-users] mod_security and mod_rewrite incompatability

[Mark P. <m_p...@ya...>]

Hi,

I can't seem to resolve what appears to be an
incompatability between these two popular modules:
mod_security and mod_rewrite. 

I'm running a patched apache 2.0.52 with the latest
stable mod_security and the bundled mod_rewrite.

To effectively disable mod_security I only need to
enable mod_rewrite with:

       <Location "/">
               RewriteEngine On
       </Location>

I first noticed that mod_security would be disabled
when running the nikto scanner against the httpd
daemon (with and without the RewriteEngine On). 

Has anyone else come across this problem? 

thanks

Mark



		
__________________________________ 
Do you Yahoo!? 
Yahoo! Mail - now with 250MB free storage. Learn more.
http://info.mail.yahoo.com/mail_250

[mod-security-users] mod_security, apache2 and chroot -> help

[Astarna <ma...@as...>]

Hello

I'm having some major problems getting chroot to work properly with mod_security.. hoping someone will be able to help.

Currently, I'm trying to get chroot to fall into /var/chroot/apache. My apache version is apache-2.0.52-r1 and using mod_security-1.8.6.

I've created the following directories within the chroot jail

/var/chroot/apache/var/run
/var/chroot/apache/var/www
/var/chroot/apache/usr/lib/apache2

I've moved my apache files (/usr/lib/apache2) to /var/chroot/apache/usr/lib/apache2.

I've created a symlink in /usr/lib/apache2 to point to /var/chroot/apache/usr/lib/apache2.

based off of this link: http://sourceforge.net/mailarchive/forum.php?thread_id=5863509&forum_id=33492

I've edit'd the conf with this value for jail:
SecChrootDir /var/chroot/apache

I've edit'd the /etc/apache2.conf with the following values:
ServerRoot /var/chroot/apache/usr/lib/apache2
DocumentRoot /var/chroot/apache/var/www/localhost/htdocs
LoadModule security_module    extramodules/mod_security.so (this is at the top of the module stack)

Apache starts fine.. drops the pid in /var/chroot/apache/var/run/apache2.pid

but when I try to navigate to the webroot.. I constantly get a 403 forbidden error. Viewing the error logs (/var/log/apache2/error_log), I get this:

[Thu Jan 13 17:20:01 2005] [error] [client 10.1.5.5] client denied by server configuration: /var/chroot
[Thu Jan 13 17:20:01 2005] [error] [client 10.1.5.5] client denied by server configuration: /var/chroot
[Thu Jan 13 17:20:02 2005] [error] [client 10.1.5.5] client denied by server configuration: /var/chroot
[Thu Jan 13 17:20:02 2005] [error] [client 10.1.5.5] client denied by server configuration: /var/chroot

I've copied /var/www /var/chroot/apache/var/www. I'm not sure why it wants to only go to /var/chroot????

Any help is greatly appreciated!!!
thanks
hanji

RE: [mod-security-users] Log question

[Tkachenko A. <al...@tk...>]

Thank you, Ivan, for your answer.

>>   So I guess you are not logging to a single file and splitting the
>>   file into virtual hosts later.

Yes.
It is virtual hosting.

>>   I think it is possible to have as many CustomLog entries as
>>   necessary.

When you use CustomLog inside the VirtualHost then global CustomLog does not
log any request related to this VirtualHost.
So I need to add 1 more CustomLog inside each VirtualHost (and this is bad
idea) or to track requests on higher level - mod_security for example.

>>   I've already done something like that for the error log in
>>   Apache 2.x (since it is not possible for Apache 1.x). It's called

Unfortunately I use apache 1.x.

But: as I understand mod_security currently already has possibility to track
different events (regexp - SecFilter) and act in different ways - so you can
use 1 SecFilter to log in 1 file, use another SecFilter to log in another
file and use 3-rd SecFilter to just dent without logging and so on?
If this is correct that it is possible to do what I asked.
I just asked how to do it in right way.

Could you please clarify?
Thank you!


Alexey.



-----Original Message-----
From: Ivan Ristic [mailto:iv...@we...] 
Sent: Thursday, January 13, 2005 01:47
To: Tkachenko Alexei
Cc: mod...@li...
Subject: Re: [mod-security-users] Log question

Tkachenko Alexei wrote:
> Ivan, I can't use such thing.
> I have hundreds of virtual hosts and can't add this "CustomLog ..." to 
> each of them.

   So I guess you are not logging to a single file and splitting the
   file into virtual hosts later.


> Additionally I need to preserve current CustomLog setting for each 
> VirtualHost.

   I think it is possible to have as many CustomLog entries as
   necessary.


> So I need to add additional logging for all requests by regexp of URL.

   I've already done something like that for the error log in
   Apache 2.x (since it is not possible for Apache 1.x). It's called
   mod_globalerror.c (get it from http://www.apachesecurity.net). With
   this module installed it is possible to have per-virtual host
   ErrorLog directives *and* have the log entries duplicated in the
   global log.

   As for normal requests, I am adding syslog support for exactly
   that in mod_security 1.9. Perhaps I can add the option to write
   log entries to disk too.

--
Ivan Ristic (http://www.modsecurity.org)

Re: [mod-security-users] Log question

[Ivan R. <iv...@we...>]

Tkachenko Alexei wrote:
> Ivan, I can't use such thing.
> I have hundreds of virtual hosts and can't add this "CustomLog ..." to each
> of them.

   So I guess you are not logging to a single file and splitting the
   file into virtual hosts later.


> Additionally I need to preserve current CustomLog setting for each
> VirtualHost.

   I think it is possible to have as many CustomLog entries as
   necessary.


> So I need to add additional logging for all requests by regexp of URL.

   I've already done something like that for the error log in
   Apache 2.x (since it is not possible for Apache 1.x). It's called
   mod_globalerror.c (get it from http://www.apachesecurity.net). With
   this module installed it is possible to have per-virtual host
   ErrorLog directives *and* have the log entries duplicated in the
   global log.

   As for normal requests, I am adding syslog support for exactly
   that in mod_security 1.9. Perhaps I can add the option to write
   log entries to disk too.

-- 
Ivan Ristic (http://www.modsecurity.org)

RE: [mod-security-users] Log question

[Tkachenko A. <al...@tk...>]

Ivan, I can't use such thing.
I have hundreds of virtual hosts and can't add this "CustomLog ..." to each
of them.
Additionally I need to preserve current CustomLog setting for each
VirtualHost.

So I need to add additional logging for all requests by regexp of URL.

Also I need to preserve existing mod_security logging.
What should I place to the mod_security, is it allowed to have different
mod_security logging for different conditions?



Alexey. 


-----Original Message-----
From: Ivan Ristic [mailto:iv...@we...] 
Sent: Monday, January 03, 2005 15:17
To: Tkachenko Alexei
Cc: mod...@li...
Subject: Re: [mod-security-users] Log question

Tkachenko Alexei wrote:
> Peace be with you,
> 
> 
> I'd like to log all php and perl requests in different logs in 
> addition to my usual mod_security logging.

   All requests? You can do that without mod_security. Something like
   this should work:

   SetEnvIf Request_URI (\.php|\.phtml|/)$ dynamic
   CustomLog logs/b92.log combined env=dynamic

--
Ivan Ristic (http://www.modsecurity.org)

[Fwd: Re: [mod-security-users] Apache 2 child process crash when chrooted (even with CVS version)]

[Ivan R. <iv...@we...>]

-- 
Ivan Ristic (http://www.modsecurity.org)

Re: [mod-security-users] Apache 2 child process crash when chrooted (even with CVS version)

[Ivan R. <iv...@we...>]

Thai Duong wrote:
> Hello all,
> I had successfully chrooted my Apache 2 with mod_security, it run very
> smoothly until I installed phpldapadmin (http://www.phpldapadmin.com,
> a free LADP administrator's tool).
> 
> When I tried to login into phpldapadmin, it didnt response anything,
> and when I looked at the error_log of httpd, it was something like
> below:
> 
> [Mon Jan 10 18:53:23 2005] [notice] child pid 19339 exit signal
> Segmentation fault (11)

   It's unlikely the crash has anything to do with modsecurity. It's
   probably that phpldapadmin expects a file or device to always be
   there and segfaults because the file is not available in the jail
   (and there's no code to handle that eventuality).

   You can probably find what file is causing the problems if you
   strace the process as it crashes. When you do that you'll be able
   to copy the file into jail to solve the problem.

   I couldn't see from the web site whether phpldapadmin requires
   some PHP extension to work with LDAP. Does it? If it does it's
   probably the fault of the extension or the LDAP libraries it uses.
   It's unlikely that a web-only application can cause a crash.

-- 
Ivan Ristic (http://www.modsecurity.org)

[mod-security-users] Apache 2 child process crash when chrooted (even with CVS version)

[Thai D. <th...@gm...>]

Hello all,
I had successfully chrooted my Apache 2 with mod_security, it run very
smoothly until I installed phpldapadmin (http://www.phpldapadmin.com,
a free LADP administrator's tool).

When I tried to login into phpldapadmin, it didnt response anything,
and when I looked at the error_log of httpd, it was something like
below:

[Mon Jan 10 18:53:23 2005] [notice] child pid 19339 exit signal
Segmentation fault (11)

phpldapadmin runs without any problem if I dont use the chroot feature
of mod_security, my configuration is very simple:

SecFilterEngine On
SecServerSignature Microsoft/IIS-5.0
SecChrootDir /chroot/httpd
# The name of the audit log file
SecAuditLog logs/audit_log
SecFilterDebugLog logs/modsec_debug_log
SecFilterDebugLevel 0

I also get the nightly built version of mod_security but have no luck.
Please advise. Below are some information maybe useful:

[root@ronaldo apache2]# httpd -v
Server version: Apache/2.0.52
Server built:   Oct 15 2004 11:39:29

[root@ronaldo apache2]#  php -v
PHP 4.3.10 (cgi) (built: Dec 21 2004 10:27:48)
Copyright (c) 1997-2004 The PHP Group
Zend Engine v1.3.0, Copyright (c) 1998-2004 Zend Technologies


Thai.

Re: [mod-security-users] Filter rules in extra file?

[Ivan R. <iv...@we...>]

David Obando wrote:
> Dear all,
> 
> is it possible to store the filter rules (or the whole mod_security 
> configuration) in an extra file (not httpd.conf)? It would keep my 
> apache configs clearer and other users could read the rules easier.

   It is, use the Apache Include directive:
   http://httpd.apache.org/docs-2.0/mod/core.html#include

-- 
Ivan Ristic (http://www.modsecurity.org)

[mod-security-users] Filter rules in extra file?

[David O. <da...@cr...>]

Dear all,

is it possible to store the filter rules (or the whole mod_security 
configuration) in an extra file (not httpd.conf)? It would keep my 
apache configs clearer and other users could read the rules easier.

Thanks,
David

-- 
The day microsoft makes something that doesn't suck is the day they start making vacuum cleaners.

Re: [mod-security-users] Unicode problem.

[Ivan R. <iv...@we...>]

Thierry Robitaille wrote:
> Hi,
> 
> Ok, but I have 1 vhost that use UTF-8 has default ("AddDefaultCharset 
> UTF-8"), is there a way to enable it just for this one?
> 
> The rest of my mod_sec conf and rules are apply to all my vhosts.

   Of course. Disable it globally and only enable it for that
   virtual host (inside the <VirtualHost> container).

-- 
Ivan Ristic (http://www.modsecurity.org)

Re: [mod-security-users] Unicode problem.

[Ivan R. <iv...@we...>]

Thierry Robitaille wrote:
> Hi,
> 
> I just enable SecFilterCheckUnicodeEncoding and mod_sec(1.8.6) seem to 
> see invalid unicode encoding in this referer:
> "http://search.ke.voila.fr/S/wanadoo?gb=site&dt=*&cid=wng&kw=diversit%E9%20culturel" 
> 
> but there is no unicode in it, only url encoding characters.
> 
> Any idea?

   In short: if there's no Unicode there then Unicode encoding
   validation won't do any good for you. It will just produce false
   positives, such as the one you used as the example. Therefore you
   need to turn it off.

   ModSecurity can't tell (because HTTP does not support it) whether some
   incoming data is Unicode or not. Therefore it's on you to decide
   whether to enable the validation feature or not, using the knowledge
   of your application. If the Unicode encoding validation feature is
   enabled then all data must be a valid UTF-8 encoding. In your example,
   the %e9 character is treated as the first of a three-byte UTF-8
   encoded character. ModSecurity complains because the second and the
   third bytes are not valid.

-- 
Ivan Ristic (http://www.modsecurity.org)

[mod-security-users] Unicode problem.

[Thierry R. <tr...@ri...>]

Hi,

I just enable SecFilterCheckUnicodeEncoding and mod_sec(1.8.6) seem to see=
=20
invalid unicode encoding in this referer:
"http://search.ke.voila.fr/S/wanadoo?gb=3Dsite&dt=3D*&cid=3Dwng&kw=3Ddiversi=
t%E9%20culturel"

but there is no unicode in it, only url encoding characters.

Any idea?

Thanks
Thierry
##
part of my conf:

SecFilterScanPOST On
SecFilterCheckURLEncoding On
SecFilterCheckCookieFormat On
SecFilterCheckUnicodeEncoding On
SecFilterForceByteRange 1 255
###
part of the log:

GET / HTTP/1.1
Accept: */*
Referer:=20
http://search.ke.voila.fr/S/wanadoo?gb=3Dsite&dt=3D*&cid=3Dwng&kw=3Ddiversit=
%E9%20culturel
Accept-Language: en-ca,en-us;q=3D0.7,fr-ca;q=3D0.3
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: www.something.com
Connection: Keep-Alive
mod_security-message: Error validating header value (Referer): Invalid=20
Unicode encoding: invalid byte value
mod_security-action: 403
#######


Toujours le premier =E0 vous offrir la gamme compl=E8te de services Internet=
 de=20
classe affaires, depuis 1994.

Thierry Robitaille
Responsable du Support Technique, Administrateur UNIX et NT

Registraire agr=E9=E9 par:  L'Autorit=E9 canadienne pour les enregistrements=
=20
internet.

URL : http://www.riq.qc.ca
T=E9l=E9phone :     (418) 521-2884  Qu=E9bec
                 (514) 875-5351  Montr=E9al=20

Re: [mod-security-users] Log question

[Ivan R. <iv...@we...>]

Tkachenko Alexei wrote:
> Peace be with you,
> 
> 
> I'd like to log all php and perl requests in different logs in addition to
> my usual mod_security logging.

   All requests? You can do that without mod_security. Something like
   this should work:

   SetEnvIf Request_URI (\.php|\.phtml|/)$ dynamic
   CustomLog logs/b92.log combined env=dynamic

-- 
Ivan Ristic (http://www.modsecurity.org)

[mod-security-users] Log question

[Tkachenko A. <al...@tk...>]

Peace be with you,


I'd like to log all php and perl requests in different logs in addition to
my usual mod_security logging.

Something like this: "Log all '.php|.phtml' -> mod_sec_php.log" and "Log all
'.cgi|.perl' -> mod_sec_perl.log".
Is it possible with mod-security tacking into account that I have usual
audit.log logging for different types of attack?

To the mod_sec_php.log and mod_sec_perl.log I'd like to log only apache
requests but not the whole information that I have in the audit_log from
mod_security.



Regards, Alexey

Re: [mod-security-users] Apache2 / mod_sec per virtual host config?

[Ivan R. <iv...@we...>]

Jan Gerle wrote:
> Hi there
> 
> As I fummbled around with this great mod I found out that in my 
> configuration, as soon as I activate mod_security in one virtual host 
> (name based), _all_ virtual hosts have mod_sec activated with the rules 
> I defined for that one special vhost.
> 
> As I read from the documentation this should not be the case - so: what 
> am I missing? Is it a mod_sec version-thing?

   That should definitely not be the case. I just checked the latest
   1.8 version with Apache 2.0.52 and works fine here. Send me
   (directly, not to the list) the httpd.conf and I'll give it a look.

   One more thing: how are you testing? From your workstation with a
   browser, or from the server itself (e.g. using telnet).

-- 
Ivan Ristic (http://www.modsecurity.org)