mod-security-users

[mod-security-users] libmodsecurity collection files location

[Ehsan M. <ehs...@gm...>]

Hi all

Modsecurity version 2 had some collection files like ip.pag, global.pag and
etc stored in  location specified by SecDataDir  .
Migrating to modsec V3.0 I can't find such files there.

Where should I be looking at?

Thank you all

Re: [mod-security-users] libmodsecurity collection files location

[Ervin H. <ai...@gm...>]

Hi Ehsan,

On Mon, Jun 11, 2018 at 01:20:58PM +0430, Ehsan Mahdavi wrote:
> Hi all
> 
> Modsecurity version 2 had some collection files like ip.pag, global.pag and
> etc stored in  location specified by SecDataDir  .
> Migrating to modsec V3.0 I can't find such files there.
> 
> Where should I be looking at?

I've never used ModSecurity 2, but in V3, as I know (and if it's
analog what you describe above) there are two kinds of type of
collections:

* in-memory
* lmdb

See the source:

https://github.com/SpiderLabs/ModSecurity/blob/95048d5fcfe43147ab0269bff69e2353817cb7c7/src/modsecurity.cc#L65
https://github.com/SpiderLabs/ModSecurity/tree/v3/master/src/collection/backend

So, the in-memory backend stores the variables in memory, LMDB
stores in an LMDB database, therefore I'm afraid there aren't any
other files, what you're looking for.


Note, that the LMDB collection doesn't work in this state, the
patch are waiting for the merge:
https://github.com/SpiderLabs/ModSecurity/pull/1787

But may be I'm wrong and you're talking about totally another
context of collections. :)



a.

Re: [mod-security-users] libmodsecurity collection files location

[Ehsan M. <ehs...@gm...>]

Hello Ervin,
Thanks for your response.
I think you are talking about the correct options. But to be more specific
I need to reset the statistics collected about different source IP
addresses. These statistics are used to determine IP:DOS_BLOCK and I need
to reset them sometimes.
In Modsecurity V2.x it was enough to delete some of those files.
How Do I do this in V3.0?

regards



On Mon, Jun 11, 2018 at 2:28 PM Ervin Hegedüs <ai...@gm...> wrote:

> Hi Ehsan,
>
> On Mon, Jun 11, 2018 at 01:20:58PM +0430, Ehsan Mahdavi wrote:
> > Hi all
> >
> > Modsecurity version 2 had some collection files like ip.pag, global.pag
> and
> > etc stored in  location specified by SecDataDir  .
> > Migrating to modsec V3.0 I can't find such files there.
> >
> > Where should I be looking at?
>
> I've never used ModSecurity 2, but in V3, as I know (and if it's
> analog what you describe above) there are two kinds of type of
> collections:
>
> * in-memory
> * lmdb
>
> See the source:
>
>
> https://github.com/SpiderLabs/ModSecurity/blob/95048d5fcfe43147ab0269bff69e2353817cb7c7/src/modsecurity.cc#L65
>
> https://github.com/SpiderLabs/ModSecurity/tree/v3/master/src/collection/backend
>
> So, the in-memory backend stores the variables in memory, LMDB
> stores in an LMDB database, therefore I'm afraid there aren't any
> other files, what you're looking for.
>
>
> Note, that the LMDB collection doesn't work in this state, the
> patch are waiting for the merge:
> https://github.com/SpiderLabs/ModSecurity/pull/1787
>
> But may be I'm wrong and you're talking about totally another
> context of collections. :)
>
>
>
> a.
>
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Re: [mod-security-users] libmodsecurity collection files location

[Ervin H. <ai...@gm...>]

Hi Ehsan,

I'm not sure, but the "expirevar" can helps you. You can find
many examples (not just for this issue) here:

https://github.com/SpiderLabs/ModSecurity/blob/v3/master/test/test-cases/regression/

especially:

https://github.com/SpiderLabs/ModSecurity/blob/v3/master/test/test-cases/regression/collection-resource.json#L50


Note, that I'm also not sure, but afraid that this function
("expirevar") doesn't work if the collection backend is LMDB.


HTH,



a.


On Tue, Jun 12, 2018 at 10:18:33AM +0430, Ehsan Mahdavi wrote:
> Hello Ervin,
> Thanks for your response.
> I think you are talking about the correct options. But to be more specific
> I need to reset the statistics collected about different source IP
> addresses. These statistics are used to determine IP:DOS_BLOCK and I need
> to reset them sometimes.
> In Modsecurity V2.x it was enough to delete some of those files.
> How Do I do this in V3.0?
> 
> regards
> 
> 
> 
> On Mon, Jun 11, 2018 at 2:28 PM Ervin Hegedüs <ai...@gm...> wrote:
> 
> > Hi Ehsan,
> >
> > On Mon, Jun 11, 2018 at 01:20:58PM +0430, Ehsan Mahdavi wrote:
> > > Hi all
> > >
> > > Modsecurity version 2 had some collection files like ip.pag, global.pag
> > and
> > > etc stored in  location specified by SecDataDir  .
> > > Migrating to modsec V3.0 I can't find such files there.
> > >
> > > Where should I be looking at?
> >
> > I've never used ModSecurity 2, but in V3, as I know (and if it's
> > analog what you describe above) there are two kinds of type of
> > collections:
> >
> > * in-memory
> > * lmdb
> >
> > See the source:
> >
> >
> > https://github.com/SpiderLabs/ModSecurity/blob/95048d5fcfe43147ab0269bff69e2353817cb7c7/src/modsecurity.cc#L65
> >
> > https://github.com/SpiderLabs/ModSecurity/tree/v3/master/src/collection/backend
> >
> > So, the in-memory backend stores the variables in memory, LMDB
> > stores in an LMDB database, therefore I'm afraid there aren't any
> > other files, what you're looking for.
> >
> >
> > Note, that the LMDB collection doesn't work in this state, the
> > patch are waiting for the merge:
> > https://github.com/SpiderLabs/ModSecurity/pull/1787
> >
> > But may be I'm wrong and you're talking about totally another
> > context of collections. :)
> >
> >
> >
> > a.
> >
> >
> >
> > ------------------------------------------------------------------------------
> > Check out the vibrant tech community on one of the world's most
> > engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
> >

> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot

> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/