I am using Google Cloud Platform to test out ModSecurity and I am using a tutorial to launch it. However, I need to restart Apache every once in a while. I'm using Ubuntu 18.04. I write sudo systemctl restart apache2,…
I have Cloud Foundry and php app with mod-sec. The app receives from the browser a json POST. The post contains several images coded in base 64 and Apace cut this in some lines: 2020-05-01T13:49:31.69+0200 [APP/PROC/WEB/0] OUT 11:49:31 httpd modsec…
I just migrated my Website to a new server using Plesk. Firewall (Modsecurity) is enabled by default on Plesk. But looking at the log, I found this message repeated several times : ModSecurity: Warning. Operator GE matched 4 at TX:outgoing_points.…
I'm trying to get the following rule to work but it seems to be doing nothing: # Test IP address and block by country code SecGeoLookupDb /usr/share/GeoIP/GeoIP.dat SecRule REMOTE_ADDR "@geoLookup" "chain,id:20,drop,msg:'Block China IP address'" SecRule GEO:COUNTRY_CODE "@streq CN HK" I…
I have Ubuntu 18.10 with apache2, libapache2-mod-security2, modsecurity-crs packages with their default configuration except for enabling ModSecurity debug logging and copying modsecurity.conf-recommended and adding SecRuleEngine On. I added a new SecRule to a separate file in /etc/modsecurity/ Content of /etc/modsecurity/sf4-modsec.conf…
I have both Apache and Modsecurity working together. I'm trying to limit hit rate by request's header (like "facebookexternalhit"). And then return a friendly "429 Too Many Requests" and "Retry-After: 3". I know I can read a file of headers…
I want to have one server with HAproxy and a standalone mod_security installed which routes every packets to mod_security first and check by its rules. Then if there wasn't anything suspicious in packets (SQL Injection, DOS Attacks, ...) pass them…
I run my own web server, but after I installed mod_security I was unable to get cross site linking to work, always had an error! So if I tried to post a link on Facebook from my web site (captnslounge.com)…
I put ModSecurity for a web server and works fine. But some of the cases it blocked and giving Access Denied page. Below shows unwanted rule IDs which are getting from after reading log file. 950109 950901 958291 960024 973338…