mod-security-users — General discussion about mod_security

Re: [mod-security-users] UTC Logging in Apache

[Ivan R. <iv...@we...>]

Tyler wrote:
> Yeah, all my Apache logs, access/error and per vhost logs are logging UTC
> time.  And yes, it does go away when I comment out the mod_security module.

   I've just examined the whole module and I don't have a clue. Send
   me examples of how times are logged with and without mod_security
   so that I can see the difference and I'll keep looking (obviosly,
   this is not happening on any of my installations otherwise it
   would be much easier to track it down).

-- 
ModSecurity (http://www.modsecurity.org)
[ Open source IDS for Web applications ]

Re: [mod-security-users] UTC Logging in Apache

[Tyler <ty...@ty...>]

Yeah, all my Apache logs, access/error and per vhost logs are logging UTC
time.  And yes, it does go away when I comment out the mod_security module.

I'm running Gentoo Linux.

Tyler

----- Original Message ----- 
From: "Ivan Ristic" <iv...@we...>
To: "Tyler" <sp...@ty...>
Cc: <mod...@li...>
Sent: Friday, July 18, 2003 2:39 AM
Subject: Re: [mod-security-users] UTC Logging in Apache


> Tyler wrote:
> > Hello All,
> >
> > I just installed mod_security on Apache 1.3.27, and noticed that since I
> > did that, Apache is now logging in UTC.  Is this the default action, or
> > did I do something wrong?
>
>    You mean logging outside mod_security, e.g. access_log, error_log etc?
>
>    As far as I am aware mod_security does not and (mostly) cannot
>    affect the work of other modules. Can it be something else?
>
>    Does it go away when you comment out the module?
>
> -- 
> ModSecurity (http://www.modsecurity.org)
> [ Open source IDS for Web applications ]
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: VM Ware
> With VMware you can run multiple operating systems on a single machine.
> WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the
> same time. Free trial click here: http://www.vmware.com/wl/offer/345/0
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>

Re: [mod-security-users] UTC Logging in Apache

[Ivan R. <iv...@we...>]

Tyler wrote:
> Hello All,
>  
> I just installed mod_security on Apache 1.3.27, and noticed that since I 
> did that, Apache is now logging in UTC.  Is this the default action, or 
> did I do something wrong?

   You mean logging outside mod_security, e.g. access_log, error_log etc?

   As far as I am aware mod_security does not and (mostly) cannot
   affect the work of other modules. Can it be something else?

   Does it go away when you comment out the module?

-- 
ModSecurity (http://www.modsecurity.org)
[ Open source IDS for Web applications ]

[mod-security-users] UTC Logging in Apache

[Tyler <sp...@ty...>]

Hello All,

I just installed mod_security on Apache 1.3.27, and noticed that since I =
did that, Apache is now logging in UTC.  Is this the default action, or =
did I do something wrong? =20

How do I fix this?

Tyler

[mod-security-users] very urgent

[MRS.MARIAM S. A. <m_a...@po...>]

FROM=3A MRS=2EMARIAM SANI ABACHA

STRICTLY PRIVATE


Dear Sir=2C

PROPOSAL FOR THE RE TRANSFER OF US$45=2E5 MILLION UNITED STATES DOLLARS=2E

I take liberty to introduce my humble self to you and permit me to write
you=2E

I am MRS MARIAM ABACHA =28WIDOW=29 the wife of Late General Sani Abacha Former
Head of state of the defunct Military Government of Nigeria=2C who was killed=2C
while in office in 1998=2E

After these=2C the Present Democratic Elected Government of OLUSEGUN OBASANJO
took over in 1999 as a result of Military 
misrule over the years=2C during the tenure of Late General Abacha =28my inlaw=29
he enriched and accumulated a lot of money while in office=2C but
unfortunately for him the man died=2E

This money was lodged in different banks abroad in America=2C Canada=2C Europe
and Africa=2E Etc=2E

However=2C the present Government succeeded in Frozening most of these
Accounts and have so far recalled these money back to the country=2C with
exception of the money deposited in a valt with AMICABLE SECURITY COMPANY in
Cotonou Republic of Benin undiscovered up til date=2E And due to sanction
placed on the family by the Present Government I can not reach this money
nor withdraw it to Nigeria for use=2E

Otherwise=2C we have jointly decided within the family to relocate this funds
out abroad for investment=2E This is the only ways and means we can utilize
this money wisely=2E

Consequently=2C we beg for your assistance in investing this money ie=2E
Purchase factory =28s=29=2C Estate and any other viable venture you might suggest=2E
I got your contact through your country =28s=29 Embassy=2C as a trustworthy and
reliable person we believe strongly=2C you will not disappoint us=2C we have
also agreed to give you 30% of the total amount as share in this business=2C
at the end of the day=2E

Finally=2C we require the following information to facilitate and
normalization of documentation with the Security Company=2E

=28a=29 Your complete name
=28b=29 Your Telephone=2FFax Numbers
=28c=29 Complete Bank Account Numbers and Addresses=2E

Again=2C all arrangement and logistics of this transaction are in place as you
are free and secured in this transaction=2C you will be glad you did and we
shall remain grateful=2E

I most faithfully look forward to hear from you=2E

Thanks in anticipations=2E

Best regards=2C

MRS=2EMARIAM SANI ABACHA 

N=2FB=3APLEASE FOR CONFIRMATION CHECK THIS WEB=2ESITE
=28www=2Eecondad=2Eorg=2FAbachaLaunch=2Ehtm=29 

Re: [mod-security-users] 1.5.1 SecFilterDefaultAction exec

[Ivan R. <iv...@we...>]

Colin Kong wrote:
> Hello Ivan,
> 
> Forgot to look at the suexec_log...
> 
>     [2003-07-17 14:41:20]: error: invalid
> command(/usr/local/apache/bin/report-modsecurity-attack.pl)
> 
> ...
> 
> Is this information useful?

   Yes, I think I've found the problem by looking into
   the suexec source code. It seems that it doesn't allow
   a leading / in the command name (ie it doesn't allow
   commands with absolute paths):

   if ((cmd[0] == '/') || (!strncmp(cmd, "../", 3))
     || (strstr(cmd, "/../") != NULL)) {
         log_err("error: invalid command (%s)\n", cmd);
     exit(104);
     }

   I am not really sure (yet) what is the reasoning behind this,
   but I'll try to work around it somehow. Why don't you
   try adding one space before the /? Maybe that will
   work :)

-- 
ModSecurity (http://www.modsecurity.org)
[ Open source IDS for Web applications ]

Re: [mod-security-users] 1.5.1 SecFilterDefaultAction exec

[Colin K. <ck...@ya...>]

Hello Ivan,

Forgot to look at the suexec_log...

    [2003-07-17 14:41:20]: error: invalid
command(/usr/local/apache/bin/report-modsecurity-attack.pl)

Under normal situation, a successful log would look like this,

    [2003-07-14 21:34:45]: info: (target/actual) uid: (ckong/ckong)
gid: (ckong/ckong) cmd: hello.pl

after successfully executing hello.pl from
/home/ckong/public_html/cgi-bin/ (which has permission 700 and chmod'ed
ckong.ckong) via http://www.ckong.tld/cgi-bin/hello.pl.

So I modified httpd.conf,

    SecFilterDefaultAction
"deny,log,status:500,exec:report-modsecurity-attack.pl"

and put the script in /home/ckong/public_html/cgi-bin/, chown
ckong.ckong and chmod 700 the script, re-tried some attack, and got the
following error messages in suexec_log,

    [2003-07-17 16:47:48]: info: (target/actual) uid: (ckong/ckong)
gid: (ckong/ckong) cmd: report-modsecurity-attack.pl
    [2003-07-17 17:11:05]: error: cannot stat program:
(report-modsecurity-attack.pl)

I tried different permission modes on the script and the cgi-bin, and
still no luck,
                                   Modes
    _____________________________|_________________
    cgi-bin                      | 755 | 700 |711
    report-modsecurity-attack.pl | 700 | 755

Other scripts like hello.pl got suexec'ed with no error message in
suexec_log.


Is this information useful?


Thanks.
- Colin Kong


=====
Thanks,
- Colin Kong

__________________________________
Do you Yahoo!?
SBC Yahoo! DSL - Now only $29.95 per month!
http://sbc.yahoo.com

[mod-security-users] 1.5.1 SecFilterDefaultAction exec

[Colin K. <ck...@ya...>]

Hello Ivan,

I like your module and I sleep better now :).  Thank you.

I put all the lines from httpd.conf.example-full that comes with the
tar file download into my httpd.conf and I made some modifications,
including the following line:

    SecFilterDefaultAction
"deny,log,status:500,exec:/usr/local/apache/bin/report-modsecurity-attack.pl"

And I tried it out by passing /etc, ../, <html>, and "select from" to
one of my web pages.  audit_log got a corresponding entry for each
attack, and I got 500 error code each time as well.  Also, in each of
audit_log entries, it shows

    mod_security-executed:
/usr/local/apache/bin/report-modsecurity-attack.pl

However, I am not getting any alert email from the perl script. 
However, if I execute that script (chmod'ed 755) directly as root, I'll
get an alert email.  I tried chown the script to root and nobody, but
to no avail.  As long as the permission mode is 755, it's okay, right?

Another experiment: I changed the following in my httpd.conf

    SecFilterDefaultAction
"deny,log,status:500,exec:/usr/local/apache/bin/report-modsecurity-attack.pl"
    SecFilter "\.\./"

to

    SecFilterDefaultAction "deny,log,status:500"
    SecFilter "\.\./"
"exec:/usr/local/apache/bin/report-modsecurity-attack.pl"

And I retried the ../ attack.  This time, I got 200 OK in my browser,
audit_log got modified and it also shows the "mod_security-executed"
line; however, I am not getting any alert email from the script.  I
checked the mail log and it shows no indication of any mailing
activities.  Below is the script and the mode_security section from my
httpd.conf.  I hope you can spot any stupid errors either in the script
or in my httpd.conf.

Thanks.
- Colin Kong


#!/usr/bin/perl -w

my $recipient='admin';
my $mailprog = "/usr/sbin/sendmail";
my $report ='';

foreach (sort keys %ENV) {
    $report .= "$_=$ENV{$_}\n";
}

open(MAIL,"|$mailprog -t");
#print MAIL "Content-Type: text/html; charset=iso-8859-1\n";

print MAIL "To: $recipient\n";
print MAIL "From: $recipient\n";

print MAIL "Subject: mod_security report $ENV{'HOSTNAME'}\n";

print MAIL $report;
print MAIL "\n\n";

close (MAIL);

-------------------------------------------------------

<IfModule mod_security.c>

    # Turn the filtering engine On or Off
    SecFilterEngine On

    # Make sure that URL encoding is valid
    SecFilterCheckURLEncoding On

    # Only allow bytes from this range
    #SecFilterForceByteRange 32 126

    # The audit engine works independently and
    # can be turned On of Off on the per-server or
    # on the per-directory basis. "On" will log everything,
    # "DynamicOrRelevant" will log dynamic requests or violations,
    # and "RelevantOnly" will only log policy violations
    SecAuditEngine RelevantOnly

    # The name of the audit log file
    SecAuditLog logs/modsecurity_audit_log

    #SecFilterDebugLog logs/modsec_debug_log
    #SecFilterDebugLevel 0

    # Should mod_security inspect POST payloads
    SecFilterScanPOST On

    # Action to take by default
    SecFilterDefaultAction
"deny,log,status:500,exec:/usr/local/apache/bin/report-modsecurity-attack.pl"

    # Redirect user on filter match
    #SecFilter xxx redirect:http://www.webkreator.com

    # Execute the external script on filter match
    #SecFilter yyy
log,exec:/home/users/ivanr/apache/bin/report-attack.pl

    # Simple filter
    #SecFilter 111
    
    # Only check the QUERY_STRING variable
    #SecFilterSelective QUERY_STRING 222

    # Only check the body of the POST request
    #SecFilterSelective POST_PAYLOAD 333

    # Only check arguments (will work for GET and POST)
    #SecFilterSelective ARGS 444

    # Test filter
    #SecFilter "/cgi-bin/modsec-test.pl/keyword"

    # Another test filter, will be denied with 404 but not logged
    # action supplied as a parameter overrides the default action
    #SecFilter 999 "deny,nolog,status:500"

    # Prevent OS specific keywords
    #SecFilter /etc/password
    SecFilter /etc

    # Prevent path traversal (..) attacks
    SecFilter "\.\./"

    # Weaker XSS protection but allows common HTML tags
    SecFilter "<[[:space:]]*script"

    # Prevent XSS atacks (HTML/Javascript injection)
    SecFilter "<(.|\n)+>"

    # Very crude filters to prevent SQL injection attacks
    SecFilter "delete[[:space:]]+from"
    SecFilter "insert[[:space:]]+into"
    SecFilter "select.+from"

    # Require HTTP_USER_AGENT and HTTP_HOST headers
    #SecFilterSelective "HTTP_USER_AGENT|HTTP_HOST" "^$"

    # Forbid file upload
    SecFilterSelective "HTTP_CONTENT_TYPE" multipart/form-data

    # Only watch argument p1
    #SecFilterSelective "ARG_p1" 555

    # Watch all arguments except p1
    #SecFilterSelective "ARGS|!ARG_p2" 666

    # Only allow our own test utility to send requests (or Mozilla)
    #SecFilterSelective HTTP_USER_AGENT "!(mod_security|mozilla)"

    # Do not allow variables with this name
    #SecFilterSelective ARGS_NAMES 777

    # Do now allow this variable value (names are ok)
    #SecFilterSelective ARGS_VALUES 888

    # Stop spamming through FormMail
    # note the exclamation mark at the beginning
    # of the filter - only requests that match this regex will
    # be allowed
    #<Location /cgi-bin/FormMail>
    #    SecFilterSelective "ARG_recipient" "!@webkreator.com$"
    #</Location>

    # when allowing upload, only allow images
    # note that this is not foolproof, a determined attacker
    # could get around this 
    #<Location /fileupload.php>
    #    SecFilterInheritance Off
    #    SecFilterSelective POST_PAYLOAD "!image/(jpeg|bmp|gif)"
    #</Location>

</IfModule>


=====
Thanks,
- Colin Kong

__________________________________
Do you Yahoo!?
SBC Yahoo! DSL - Now only $29.95 per month!
http://sbc.yahoo.com

Re: [mod-security-users] Rule

[Ivan R. <iv...@we...>]

> How can i block this kind of request : GET 
> http://www.bluegrassass.com/BGAmembers/index.html

   You can block it with:

   SecFilterSelective THE_REQUEST "http://"

   but that will probably block all proxy requests. If you want
   to that it would probably be easier to turn the proxy off:

   ProxyRequests Off

   If you need the proxy but want to prevent some people from
   using it have a look here:

   http://httpd.apache.org/docs/mod/mod_proxy.html
   (assuming you're using Apache 1.x)

   The code snippet is:

   <Directory proxy:*>
       Order Deny,Allow
       Deny from all
       Allow from yournetwork.example.com
   </Directory>

-- 
ModSecurity (http://www.modsecurity.org)
[ Open source IDS for Web applications ]

[mod-security-users] Rule

[G. <jg...@jo...>]

It's me again....

How can i block this kind of request : GET 
http://www.bluegrassass.com/BGAmembers/index.html

It seems that some people try to use the web server as a proxy.

Thanks for all

Re: [mod-security-users] Need more information

[Ivan R. <iv...@we...>]

> I would be happy if in the next release the SecFilteScanPOST will have a 
> default value.

   There is a default value, it is off by default.


> In fact, i observe that mod_security doesn't work correctly if i don't 
> put a SecFilteScanPOST off

   Maybe it is some other problem. Send me the configuration that
   creates problems for you and I will have a look.

-- 
ModSecurity (http://www.modsecurity.org)
[ Open source IDS for Web applications ]

[mod-security-users] Need more information

[G. <jg...@jo...>]

HI,


I would be happy if in the next release the SecFilteScanPOST will have a 
default value.

In fact, i observe that mod_security doesn't work correctly if i don't put 
a SecFilteScanPOST off


Thanks

J GALLOT

Re: [mod-security-users] installation instructions wrong?

[Ivan R. <iv...@we...>]

Maurice Volaski wrote:
> I tried installing mod_security as part of apachetoolbox 
> (www.apachetoolbox.com). I ran into problems with both of these lines
> 
> --activate-module=src/modules/extra/mod_security
> --enable-module=security
> 
> I couldn't get either line to work as is. What I ended up doing was
> 
> --enable-module=/path/to/mod_security.c
> --add-module =/path/to/mod_security.c
> 
> The main problem seems the module name must be spelled out entirely: 
> "mod_security.c".
> 
> There was still a complaint from the Configure program about one of the 
> files not being found, but it nevertheless did work.

   I believe that there are several ways to add a module to
   Apache 1. I haven't tried ApacheToolbox yet but I plan to examine
   it soon.

   If you want to use --add-module then it alone is sufficient:

   --add-module=/path/to/mod_security.c

   it will add and activate the module at the same time.

   The approach described in the manual works for me (provided you
   use the two options in that order). I am not really sure
   what could be the problem in your setup.

   ...

   Nevertheless, the --add-module approach is simpler than the approach
   described in the manual. I will update the manual to use it instead.

Bye,
Ivan

[mod-security-users] installation instructions wrong?

[Maurice V. <mvo...@ae...>]

I tried installing mod_security as part of apachetoolbox 
(www.apachetoolbox.com). I ran into problems with both of these lines

--activate-module=src/modules/extra/mod_security
--enable-module=security

I couldn't get either line to work as is. What I ended up doing was

--enable-module=/path/to/mod_security.c
--add-module =/path/to/mod_security.c

The main problem seems the module name must be spelled out entirely: 
"mod_security.c".

There was still a complaint from the Configure program about one of 
the files not being found, but it nevertheless did work.
-- 

Maurice Volaski, mvo...@ae...
Computing Support, Rose F. Kennedy Center
Albert Einstein College of Medicine of Yeshiva University

Re: [mod-security-users] chroot apache an audit log

[Ivan R. <iv...@we...>]

> 1.: audit_log:
> there are only a few requests inside. in the error_log are many more 
> denied lines from mod_security.
> is this normal ?

   Not exactly. There are a couple of lines of code there left by
   mistake and they cause audit logger not to log requests that
   it judges to be "non-dynamic". The same logic was implemented
   in the filtering part of the module. I decided to remove it
   because the behavior was hard-coded. It will come back as part
   of the v1.6 release but with a couple of configuration options
   so people can turn it on and off at will.

   If it bothers you simply comment the four lines below the
   comment in sec_logger.

   // ignore non-dynamic requests
   if (r->handler == NULL) {
       sec_debug_log(r, 2, "...
       return OK;
   }

   I will comment the code as part of the v1.5.1 release (will be
   ready in a couple of days).


> 2.: chroot apache:
> i tried to chroot apache with mod_security.
> i made is directory /chroot/apache opened httpd.conf and moved AddModule 
> mod_security.c to the first line after ClearModuleList.
> i added the line:
>  SecChrootDir /chroot/apache
> 
> and restarted apache
> then i get this error:
> Syntax error on line 1318 of /etc/httpd/httpd.conf:
> Invalid command 'SecChrootDir', perhaps mis-spelled or defined by a 
> module not included in the server configuration

   Did you get the latest version from CVS? The chroot feature is
   only available for Apache 1.x and in the CVS only. I will release
   v1.5.1 shortly to fix some bugs and add certain enhancements to
   the Apache 2.x code.

-- 
ModSecurity (http://www.modsecurity.org)
[ Open source IDS for Web applications ]

[mod-security-users] chroot apache an audit log

[mutombo <mut...@gm...>]

hi.
I've installed mod_security yesterday and it works like a charm, but i have 
a few questions.

1.: audit_log:
there are only a few requests inside. in the error_log are many more denied 
lines from mod_security.
is this normal ?

2.: chroot apache:
i tried to chroot apache with mod_security.
i made is directory /chroot/apache opened httpd.conf and moved AddModule 
mod_security.c to the first line after ClearModuleList.
i added the line:
  SecChrootDir /chroot/apache

and restarted apache
then i get this error:
Syntax error on line 1318 of /etc/httpd/httpd.conf:
Invalid command 'SecChrootDir', perhaps mis-spelled or defined by a module 
not included in the server configuration

get this too with httpd -t .

regards

ch. michallek

[mod-security-users] Chrooting Apache

[Ivan R. <iv...@we...>]

Hi, I've just added a feature to mod_security (CVS and Apache 1.x
only at the moment) that greatly simplifies the process of
chrooting in some (most?) cases.

Essentially, the chroot call is made from the Apache itself, at the
very end of the initialisation process. The beauty of it is that
Apache performs everything it needs (shared libraries, log files)
before the chroot call and the jail need not contain any of those.

I've written a short article here:
http://www.modsecurity.org/documentation/apache-internal-chroot.html

and the link in CVS is (again, only Apache 1.x):
http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/*checkout*/mod-security/mod_security/apache1/mod_security.c?rev=1.4

What I have described works perfectly for me but I am interested
to hear other opinions (or experiences). If you are interested
please give it a try and let me know how you feel.

Bye,
Ivan

[Mod-security-users] Test 1

[Ivan R. <iv...@we...>]

Test 1