mod-security-users

[mod-security-users] Re: Mod_security question

[Ivan R. <iv...@we...>]

Spence, Ian (ELS-CAM) wrote:
> Ivan
> 
> Can mod_security check on a token parameter in the URL?
> 
> E.g. _http://server/app?token=digestTokenValue_
> 
> I want the receiving web server to check the token value against an 
> agreed algorithm, for a start it will be MD5 digested.
> 
> I notice with the mod_security rules you can trap on certain parameter 
> values i.e. regex, but given a match can you run a script and then 
> depending on the result of the script, either reject or accept the http 
> request.

   Yes, mod_security can do that. I've added that functionality
   to the 1.9.x branch, so far only in the Apache 1.x version of
   the module. The new directive is called SecFilterExternal and it
   takes only one parameter - the name of the script to execute.

   The script will get the path to the file containing request
   parameters (only that at the moment) as its first parameter.
   Here's an example of a script that uses this feature to interface
   to SpamAssassin:
 
http://cvs.sourceforge.net/viewcvs.py/mod-security/mod_security/util/filter_spamc.pl?rev=1.1&view=auto

   This functionality is still rough and I plan to change the
   data exchange format before the final 1.9.x. version (e.g. to
   include the request headers). But it works and you can play with
   it in the meantime.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] RE: Mod_security question

[Spence, I. (ELS-CAM) <I.S...@El...>]

Ivan

Our target platform is Windows server.

Given the download page states testing has stopped for Windows would you
advise on deploying 1.9 codebase on Windows? I am very interesting in
deploying your suggested enhancement "SecFilterExternal".

Ian Spence

-----Original Message-----
From: Ivan Ristic [mailto:iv...@we...] 
Sent: 01 March 2005 15:04
To: Spence, Ian (ELS-CAM)
Cc: mod...@li...
Subject: Re: Mod_security question

Spence, Ian (ELS-CAM) wrote:
> Ivan
> 
> Can mod_security check on a token parameter in the URL?
> 
> E.g. _http://server/app?token=digestTokenValue_
> 
> I want the receiving web server to check the token value against an 
> agreed algorithm, for a start it will be MD5 digested.
> 
> I notice with the mod_security rules you can trap on certain parameter 
> values i.e. regex, but given a match can you run a script and then 
> depending on the result of the script, either reject or accept the 
> http request.

   Yes, mod_security can do that. I've added that functionality
   to the 1.9.x branch, so far only in the Apache 1.x version of
   the module. The new directive is called SecFilterExternal and it
   takes only one parameter - the name of the script to execute.

   The script will get the path to the file containing request
   parameters (only that at the moment) as its first parameter.
   Here's an example of a script that uses this feature to interface
   to SpamAssassin:
 
http://cvs.sourceforge.net/viewcvs.py/mod-security/mod_security/util/filter_
spamc.pl?rev=1.1&view=auto

   This functionality is still rough and I plan to change the
   data exchange format before the final 1.9.x. version (e.g. to
   include the request headers). But it works and you can play with
   it in the meantime.

--
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net Open source web
application firewall - http://www.modsecurity.org

Re: [mod-security-users] RE: Mod_security question

[Ivan R. <iv...@we...>]

Spence, Ian (ELS-CAM) wrote:
> Ivan
> 
> Our target platform is Windows server.
> 
> Given the download page states testing has stopped for Windows would you
> advise on deploying 1.9 codebase on Windows? I am very interesting in
> deploying your suggested enhancement "SecFilterExternal".

   Well, "stopped testing" is not entirely accurate. The truth is I never
   test mod_security on Windows. I develop and test on Linux, but I only
   compile and run a set of automated tests on Windows. This does not
   mean mod_security does not run or runs badly on Windows. In fact, I
   have had many reports from people who are happily running it on
   Windows. I am merely stating the facts to let people to make their
   own minds.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org