mod-security-users

[mod-security-users] Some filter questions

[BassPlayer <bas...@an...>]

I would like to filter these user agents

        User Agents:
                [360] Mozilla/4.75 [en] (X11, U; Nessus)
                [2] Nessus

From reading the manual I'm not sure what locations are equivilent to the
User-Agent: entry in the log.

From this entry in the manual

HTTP_header =96 search request header "header" (HEADER_header also works =
as
of 1.9)

I would guess it would be something like

SecFilterSelective HEADER_User-Agent Nessus

Re: [mod-security-users] Some filter questions

[Ivan R. <iv...@we...>]

BassPlayer wrote:
> I would like to filter these user agents
> 
>         User Agents:
>                 [360] Mozilla/4.75 [en] (X11, U; Nessus)
>                 [2] Nessus
> 
> From reading the manual I'm not sure what locations are equivilent to the
> User-Agent: entry in the log.
> 
> From this entry in the manual
> 
> HTTP_header – search request header "header" (HEADER_header also works as
> of 1.9)
> 
> I would guess it would be something like
> 
> SecFilterSelective HEADER_User-Agent Nessus

  Yup, that should do it.

-- 
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall

Re: [mod-security-users] Some filter questions

[Tom A. <tan...@oa...>]

BassPlayer wrote:
> I would like to filter these user agents
>=20
>         User Agents:
>                 [360] Mozilla/4.75 [en] (X11, U; Nessus)
>                 [2] Nessus
>=20
>>From reading the manual I'm not sure what locations are equivilent to t=
he
> User-Agent: entry in the log.
>=20
>>From this entry in the manual
>=20
> HTTP_header =96 search request header "header" (HEADER_header also work=
s as
> of 1.9)
>=20
> I would guess it would be something like
>=20
> SecFilterSelective HEADER_User-Agent Nessus

I actually handle those with mod_rewrite instead:

RewriteCond %{HTTP_USER_AGENT} Nessus [NC]
RewriteRule .* - [F,L]

That's just because I was blocking useragents before I started using=20
mod_security.  I wonder if there is any advantage to using one or the=20
other in this case.

Tom