mod-security-users Mailing List for ModSecurity

Hi toufik,

Are you talking about the Google summer of code project?

Br.,
Felipe “Zimmerle” Costa
Security Researcher, SpiderLabs

Trustwave | SMART SECURITY ON DEMAND
www.trustwave.com<http://www.trustwave.com/>


From: "tou...@gm...<mailto:tou...@gm...>" <tou...@gm...<mailto:tou...@gm...>>
Reply-To: "mod...@li...<mailto:mod...@li...>" <mod...@li...<mailto:mod...@li...>>
Date: Sunday, December 20, 2015 at 6:26 AM
To: "mod...@li...<mailto:mod...@li...>" <mod...@li...<mailto:mod...@li...>>
Subject: [mod-security-users] Modsecurity snifer mode


build a sniffer mode for ModSecurity

________________________________

This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is strictly prohibited. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format.

Toufik,

It's very hard to understand what you want. Probably a language problem.

If it is a sniffer mode for ModSecurity you want, then there is a sniffer 
mode already. At least according to my understanding to the term.
Just deploy it inline in detectionmode.

Best regards,

Christian


On Sun, Dec 20, 2015 at 10:26:57AM +0100, tou...@gm... wrote:
> Hello
> I'm student, I'm interested to the project of "build a sniffer mode for ModSecurity." 
> I would like to help me please
> 
> Thanks
> Provenance : Courrier pour Windows 10
> 

> ------------------------------------------------------------------------------

> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Hello
I'm student, I'm interested to the project of "build a sniffer mode for ModSecurity." 
I would like to help me please

Thanks
Provenance : Courrier pour Windows 10

Ubuntu 15.04 - The install went fine and the site is blocking the crawlers I expected it too. However, the defaults are blocking too much since we use the Revive ad server on one of this boxes IP's to serve ads to hosts on other IP's on the same box and elsewhere. Also, we only need mod_security to apply to one of *our* IP's.

I followed just the mod_security part of this: 
http://blog.mattbrock.co.uk/hardening-the-security-on-ubuntu-server-14-04/

The scenario is that there are several vhosts sharing the same IP which are each backed by large MySQL db's. They are growing all the time, and the crawlers are hammering each page constantly. The hosts on the other IP's don't have this volume MySQL data, so they can be left alone. It's not just that, I found I was now denied some joomla admin functions, so reckon it would be cleaner just to apply mod_security to the IP I am concerned about.

So I'd like to make 2 changes: 
1. Whitelist ads.example1.com (or its IP) so all inbound traffic from there is allowed
2. Only apply mod_security to IP w.x.y.z, which is one of the IP's on our server which several vhosts share.

I got into a fix trying myself and after too many resets realised it must be easy for someone on this list.

Thanks!

Hello
I want to help me to deploy Modsecurity in sniffer mode
Thanks

Am 18.12.2015 um 21:07 schrieb Oliver Habicht:
> Hi,
>
> pleas remove me from your mailinglist.

WTF don't you unubscribe yourself?
who subscribed you?

the list - footer and headers are not just for fun

List-Unsubscribe:
  <https://lists.sourceforge.net/lists/listinfo/mod-security-users>
 
<mailto:mod...@li...?subject=unsubscribe>

> Kind regards
> Oliver Habicht
>
> ------------------------------------------------------------------------------
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Doing this type of parsing out of the error log would be time consuming and wasteful. May I recommend checking out the JSON audit logging branch available from the fork at 

https://github.com/p0pr0ck5/ModSecurity/tree/json_audit_logging

This allows you to produce audit logs in a standardized, programmatic format. 

> On Dec 18, 2015, at 11:59, Sasi Sasivarenan <sas...@gm...> wrote:
> 
> Hi,
> 
> 
> I want to separate the error log file by formatting the line as a column. Just we need to display timestamp, client ip, id , uri, unique id, msg......
> 
> 
> how to do using linux command 
> 
> 
> 
>   
> 
>> On Wed, Dec 16, 2015 at 9:06 PM, Margason, Jacob <j.m...@va...> wrote:
>> I’m happy to help out, email me here, ja...@jk... and we can discuss outside the mailing list if you’d like.
>> 
>> From: Sasi Sasivarenan <sas...@gm...>
>> Reply-To: "mod...@li..." <mod...@li...>
>> Date: Wednesday, December 16, 2015 at 8:17 AM
>> To: "mod...@li..." <mod...@li...>
>> Subject: Re: [mod-security-users] Modsecurity log report
>> 
>> Thanks for the quick reply guys...
>> 
>> 
>> Yes jacob, we just want to automate the report. Normally,  
>> 
>> 
>>> On Wed, Dec 16, 2015 at 2:05 AM, Jacob Margason <j.m...@va...> wrote:
>>> I would look into log aggregation tools like Sumo Logic. Why can't you collect the Apache logs daily? or do you just mean you'd like to automate some report building?
>>> 
>>>> On 12/15/2015 02:31 PM, Sasi Sasivarenan wrote:
>>>> Hi,
>>>> 
>>>> we have launched Modsecurity recently which is now in a detection mode. We need a help in log monitoring. we found many pattern matches in the apache error log but unable collect those data on daily basis. Please help how to collect those data and analyse. 
>>> 
>>>  -- 
>>> Jacob Margason
>>> Application Server Administrator
>>> VUIT Linux Applications | Vanderbilt University
>>> 615.380.1013 | j.m...@va...
>>> 
>>> ------------------------------------------------------------------------------
>>> 
>>> _______________________________________________
>>> mod-security-users mailing list
>>> mod...@li...
>>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>>> http://www.modsecurity.org/projects/commercial/rules/
>>> http://www.modsecurity.org/projects/commercial/support/
>> 
>> 
>> ------------------------------------------------------------------------------
>> 
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
> 
> ------------------------------------------------------------------------------
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Hi,

pleas remove me from your mailinglist.

Kind regards
Oliver Habicht

Hi,


I want to separate the error log file by formatting the line as a column.
Just we need to display timestamp, client ip, id , uri, unique id, msg......


how to do using linux command





On Wed, Dec 16, 2015 at 9:06 PM, Margason, Jacob <j.m...@va...>
wrote:

> I’m happy to help out, email me here, ja...@jk... and we can discuss
> outside the mailing list if you’d like.
>
> From: Sasi Sasivarenan <sas...@gm...>
> Reply-To: "mod...@li..." <
> mod...@li...>
> Date: Wednesday, December 16, 2015 at 8:17 AM
> To: "mod...@li..." <
> mod...@li...>
> Subject: Re: [mod-security-users] Modsecurity log report
>
> Thanks for the quick reply guys...
>
>
> Yes jacob, we just want to automate the report. Normally,
>
>
> On Wed, Dec 16, 2015 at 2:05 AM, Jacob Margason <j.m...@va...
> > wrote:
>
>> I would look into log aggregation tools like Sumo Logic. Why can't you
>> collect the Apache logs daily? or do you just mean you'd like to automate
>> some report building?
>>
>> On 12/15/2015 02:31 PM, Sasi Sasivarenan wrote:
>>
>> Hi,
>>
>> we have launched Modsecurity recently which is now in a detection mode.
>> We need a help in log monitoring. we found many pattern matches in the
>> apache error log but unable collect those data on daily basis. Please help
>> how to collect those data and analyse.
>>
>>
>> --
>> Jacob Margason
>> Application Server Administrator
>> VUIT Linux Applications | Vanderbilt University
>> 615.380.1013 | j.m...@va...
>>
>>
>>
>> ------------------------------------------------------------------------------
>>
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>>
>>
>
>
> ------------------------------------------------------------------------------
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>
>

Hi Gyana,

The log entries you provided has already addressed the main problem
with the blocking. According to the first line of given log from
you as below:

[Thu Dec 17 08:27:56.553114 2015] [proxy_http:error] [pid 7148:tid 904]
[client 10.134.13.178:57752[1]] AH01114: HTTP: failed to make connection
to backend: pangy01-w2k8vm1.ca.com[2]

Apache told that it was unable to connect to the backend, and an 503
error was returned from proxy module that captured by modsecurity
and triggered  rule 970901. You may be able to use curl or other
tools to help you to diagnose the connection issue happend at your
modsecurity instance.

--
BR, Morris
 
 
On Thu, Dec 17, 2015, at 10:11 PM, Gyana Ranjan Panigrahi wrote:
> This is my error.log which i captured when i tried to launch URL.
> [Thu Dec 17 08:27:56.553114 2015] [proxy_http:error] [pid 7148:tid 904] [client 10.134.13.178:57752] AH01114: HTTP: failed to make connection to backend: pangy01-w2k8vm1.ca.com
> [Thu Dec 17 08:27:56.553114 2015] [:error] [pid 7148:tid 904] [client 10.134.13.178] ModSecurity: Access denied with code 403 (phase 4). Pattern match "^5\\\\d{2}$" at RESPONSE_STATUS. [file "C:/win32app/Spectrum/apache/modsecurity-crs/base_rules/modsecurity_crs_50_outbound.conf"] [line "53"] [id "970901"] [rev "2"] [msg "The application is not available"] [data "Matched Data: 503 found within RESPONSE_STATUS: 503"] [severity "ERROR"] [ver "OWASP_CRS/2.2.9"] [maturity "9"] [accuracy "9"] [tag "WASCTC/WASC-13"] [tag "OWASP_TOP_10/A6"] [tag "PCI/6.5.6"] [hostname "pangy01-w2k8vm1"] [uri "/spectrum"] [unique_id "VnK4WQrxATYAABvsgIgAAAA-"]
> [Thu Dec 17 08:27:56.553114 2015] [:error] [pid 7148:tid 904] [client 10.134.13.178] ModSecurity: Warning. Operator GE matched 4 at TX:outbound_anomaly_score. [file "C:/win32app/Spectrum/apache/modsecurity-crs/base_rules/modsecurity_crs_60_correlation.conf"] [line "40"] [id "981205"] [msg "Outbound Anomaly Score Exceeded (score 4): The application is not available"] [hostname "pangy01-w2k8vm1"] [uri "/spectrum"] [unique_id "VnK4WQrxATYAABvsgIgAAAA-"]
> [Thu Dec 17 08:27:56.771519 2015] [authz_core:error] [pid 7148:tid 904] [client 10.134.13.178:57753] AH01630: client denied by server configuration: C:/apache, referer: http://pangy01-w2k8vm1:8081/spectrum
>  
>  
> Thanks Gyana
>  
> On Thu, Dec 17, 2015 at 7:28 PM, Reindl Harald <h.r...@th...> wrote:
>> 
>> 
>> 
Am 17.12.2015 um 14:49 schrieb Gyana Ranjan Panigrahi:
>>> 
<Connector   port="8080" address="127.0.0.1" URIEncoding="UTF-8"
>>> 
maxHttpHeaderSize="8192" maxThreads="150" minSpareThreads="25"
>>> 
enableLookups="true" redirectPort="8443" acceptCount="100"
>>> 
connectionTimeout="20000" disableUploadTimeout="true" tcpNoDelay="true" />
>>> 
>>> 
When i tried to launch URL it says Forbidden  You don't have permission
>>> 
to access /spectrum on this server. Additionally, a 503 Service
>>> 
Unavailable error was encountered while trying to use an ErrorDocument
>>> 
to handle the request
>> 
>> 
that's hardly a mod_security question and without logs nobody can help you
>>  
>>  
>>  
>>  
>>  
>> ------------------------------------------------------------------------------
>>  
>> _______________________________________________
>> 
mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> 
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>>  
>  
>  
>  
> -- 
> *Best & Regards
> Gyana Ranjan Panigrahi****
*
>  
>  
>  
>  
>  
>  
>  
>  
>  
> ------------------------------------------------------------------------------
> _________________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
 


Links:

  1. http://10.134.13.178:57752/
  2. http://pangy01-w2k8vm1.ca.com/

This is my error.log which i captured when i tried to launch URL.
[Thu Dec 17 08:27:56.553114 2015] [proxy_http:error] [pid 7148:tid 904]
[client 10.134.13.178:57752] AH01114: HTTP: failed to make connection to
backend: pangy01-w2k8vm1.ca.com
[Thu Dec 17 08:27:56.553114 2015] [:error] [pid 7148:tid 904] [client
10.134.13.178] ModSecurity: Access denied with code 403 (phase 4). Pattern
match "^5\\\\d{2}$" at RESPONSE_STATUS. [file
"C:/win32app/Spectrum/apache/modsecurity-crs/base_rules/modsecurity_crs_50_outbound.conf"]
[line "53"] [id "970901"] [rev "2"] [msg "The application is not
available"] [data "Matched Data: 503 found within RESPONSE_STATUS: 503"]
[severity "ERROR"] [ver "OWASP_CRS/2.2.9"] [maturity "9"] [accuracy "9"]
[tag "WASCTC/WASC-13"] [tag "OWASP_TOP_10/A6"] [tag "PCI/6.5.6"] [hostname
"pangy01-w2k8vm1"] [uri "/spectrum"] [unique_id "VnK4WQrxATYAABvsgIgAAAA-"]
[Thu Dec 17 08:27:56.553114 2015] [:error] [pid 7148:tid 904] [client
10.134.13.178] ModSecurity: Warning. Operator GE matched 4 at
TX:outbound_anomaly_score. [file
"C:/win32app/Spectrum/apache/modsecurity-crs/base_rules/modsecurity_crs_60_correlation.conf"]
[line "40"] [id "981205"] [msg "Outbound Anomaly Score Exceeded (score 4):
The application is not available"] [hostname "pangy01-w2k8vm1"] [uri
"/spectrum"] [unique_id "VnK4WQrxATYAABvsgIgAAAA-"]
[Thu Dec 17 08:27:56.771519 2015] [authz_core:error] [pid 7148:tid 904]
[client 10.134.13.178:57753] AH01630: client denied by server
configuration: C:/apache, referer: http://pangy01-w2k8vm1:8081/spectrum


Thanks Gyana

On Thu, Dec 17, 2015 at 7:28 PM, Reindl Harald <h.r...@th...>
wrote:

>
>
> Am 17.12.2015 um 14:49 schrieb Gyana Ranjan Panigrahi:
>
>> <Connector   port="8080" address="127.0.0.1" URIEncoding="UTF-8"
>> maxHttpHeaderSize="8192" maxThreads="150" minSpareThreads="25"
>> enableLookups="true" redirectPort="8443" acceptCount="100"
>> connectionTimeout="20000" disableUploadTimeout="true" tcpNoDelay="true" />
>>
>> When i tried to launch URL it says Forbidden  You don't have permission
>> to access /spectrum on this server. Additionally, a 503 Service
>> Unavailable error was encountered while trying to use an ErrorDocument
>> to handle the request
>>
>
> that's hardly a mod_security question and without logs nobody can help you
>
>
>
>
>
>
> ------------------------------------------------------------------------------
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>
>


-- 

*Best & RegardsGyana Ranjan Panigrahi*

Am 17.12.2015 um 14:49 schrieb Gyana Ranjan Panigrahi:
> <Connector   port="8080" address="127.0.0.1" URIEncoding="UTF-8"
> maxHttpHeaderSize="8192" maxThreads="150" minSpareThreads="25"
> enableLookups="true" redirectPort="8443" acceptCount="100"
> connectionTimeout="20000" disableUploadTimeout="true" tcpNoDelay="true" />
>
> When i tried to launch URL it says Forbidden  You don't have permission
> to access /spectrum on this server. Additionally, a 503 Service
> Unavailable error was encountered while trying to use an ErrorDocument
> to handle the request

that's hardly a mod_security question and without logs nobody can help you

Hi All,

I currently have a Tomcat server hosting a web app with  apache proxy in
front of it. The Tomcat server is also terminating Client Authenticated SSL
connections to the web application.I configured  a new instance of apache,
install mod_security, reconfigure my web app so that the ssl connections
terminate at apache, and then use mod_proxyto connect to tomcat.
My VirtaulHost configuration looks like below:

Listen 8081
<VirtualHost *:8081>
  ProxyPass       /spectrum http://pangy01-w2k8vm1:8080/spectrum
  ProxyPassReverse    /spectrum http://pangy01-w2k8vm1:8080/spectrum
</VirtualHost>

where pangy01-w2k8vm1 is my host and apache runs on 8081 port and tomcat on
8080.and i blocked the tomcat port for outside acess because i want every
URL should first hit apache then go through modsecurity and hits tomcat.

SO for blocking tomcat i added the loopback address in the server.xml file
like below:

<Connector   port="8080" address="127.0.0.1" URIEncoding="UTF-8"
maxHttpHeaderSize="8192" maxThreads="150" minSpareThreads="25"
enableLookups="true" redirectPort="8443" acceptCount="100"
connectionTimeout="20000" disableUploadTimeout="true" tcpNoDelay="true" />

When i tried to launch URL it says Forbidden  You don't have permission to
access /spectrum on this server. Additionally, a 503 Service Unavailable
error was encountered while trying to use an ErrorDocument to handle the
request.

Plase help me on this!!!


-- 

*Best & RegardsGyana Ranjan Panigrahi*

I’m happy to help out, email me here, ja...@jk... and we can discuss outside the mailing list if you’d like.

From: Sasi Sasivarenan <sas...@gm...<mailto:sas...@gm...>>
Reply-To: "mod...@li...<mailto:mod...@li...>" <mod...@li...<mailto:mod...@li...>>
Date: Wednesday, December 16, 2015 at 8:17 AM
To: "mod...@li...<mailto:mod...@li...>" <mod...@li...<mailto:mod...@li...>>
Subject: Re: [mod-security-users] Modsecurity log report

Thanks for the quick reply guys...


Yes jacob, we just want to automate the report. Normally,


On Wed, Dec 16, 2015 at 2:05 AM, Jacob Margason <j.m...@va...<mailto:j.m...@va...>> wrote:
I would look into log aggregation tools like Sumo Logic. Why can't you collect the Apache logs daily? or do you just mean you'd like to automate some report building?

On 12/15/2015 02:31 PM, Sasi Sasivarenan wrote:
Hi,

we have launched Modsecurity recently which is now in a detection mode. We need a help in log monitoring. we found many pattern matches in the apache error log but unable collect those data on daily basis. Please help how to collect those data and analyse.


--
Jacob Margason
Application Server Administrator
VUIT Linux Applications | Vanderbilt University
615.380.1013 | j.m...@va...<mailto:j.m...@va...>

------------------------------------------------------------------------------

_______________________________________________
mod-security-users mailing list
mod...@li...<mailto:mod...@li...>
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

Thanks for the quick reply guys...


Yes jacob, we just want to automate the report. Normally,


On Wed, Dec 16, 2015 at 2:05 AM, Jacob Margason <j.m...@va...>
wrote:

> I would look into log aggregation tools like Sumo Logic. Why can't you
> collect the Apache logs daily? or do you just mean you'd like to automate
> some report building?
>
> On 12/15/2015 02:31 PM, Sasi Sasivarenan wrote:
>
> Hi,
>
> we have launched Modsecurity recently which is now in a detection mode. We
> need a help in log monitoring. we found many pattern matches in the apache
> error log but unable collect those data on daily basis. Please help how to
> collect those data and analyse.
>
>
> --
> Jacob Margason
> Application Server Administrator
> VUIT Linux Applications | Vanderbilt University
> 615.380.1013 | j.m...@va...
>
>
>
> ------------------------------------------------------------------------------
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>
>

I would look into log aggregation tools like Sumo Logic. Why can't you collect the Apache logs daily? or do you just mean you'd like to automate some report building?

On 12/15/2015 02:31 PM, Sasi Sasivarenan wrote:
> Hi,
>
> we have launched Modsecurity recently which is now in a detection mode. We need a help in log monitoring. we found many pattern matches in the apache error log but unable collect those data on daily basis. Please help how to collect those data and analyse. 

-- 
Jacob Margason
Application Server Administrator
VUIT Linux Applications | Vanderbilt University
615.380.1013 | j.m...@va...

Sasi,

What you need to perform is the tuning of your installation. This is
a time-consuming process, but it will make sure that you end up with
a setup that brings only few pattern matches which are easier to
review.

Please google to find ModSec tuning advice.

Good luck!

Christian

On Wed, Dec 16, 2015 at 02:01:44AM +0530, Sasi Sasivarenan wrote:
> Hi,
> 
> we have launched Modsecurity recently which is now in a detection mode. We
> need a help in log monitoring. we found many pattern matches in the apache
> error log but unable collect those data on daily basis. Please help how to
> collect those data and analyse.

> ------------------------------------------------------------------------------

> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Hi,

we have launched Modsecurity recently which is now in a detection mode. We
need a help in log monitoring. we found many pattern matches in the apache
error log but unable collect those data on daily basis. Please help how to
collect those data and analyse.

Guillermo,

Divide et Impera - or in English: Divide and Rule.

I let that roman motto be my guide in things server and instances.  For
a RP setup, I think you want at least a pair, so you have redundancy,
can update them one by one without downtime and generally feel better.
As you have a pair, you need a simple deployment tool and if you have a
simple deployment tool, there is not much difference, if you 1, 2, 4 or
8 RP instances.

Ahoj,

Christian



On Fri, Dec 11, 2015 at 04:37:02PM -0300, Guillermo Caminer wrote:
> Hi list!
> 
> What would be best, in a multiple WebServer environment: use one ModSec instance per Web Server, or
> use one instance in a reverse proxy in front of all the Web Servers? Each has it owns cons and pros:
> multiple instances requires higher administration work, but would be more efficient. In the other
> hand, having one instance in a reverse proxy could create a bottle-neck but will ease administration.
> 
> What do you think?
> 
> Thanks in advance?
> 
> ------------------------------------------------------------------------------
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

In a system I helped develop, we used a series or reverse proxies to handle
modsec across many backends. In part what we found was that the rules
required a not insignificant amount of memory so it was actually more
efficient from that standpoint to have fewer modsec instances. Your
constraints may be different, best to measure.

Cheers,
Brian

On Fri, Dec 11, 2015, 13:42 Guillermo Caminer <fla...@gm...>
wrote:

> Hi list!
>
> What would be best, in a multiple WebServer environment: use one ModSec
> instance per Web Server, or
> use one instance in a reverse proxy in front of all the Web Servers? Each
> has it owns cons and pros:
> multiple instances requires higher administration work, but would be more
> efficient. In the other
> hand, having one instance in a reverse proxy could create a bottle-neck
> but will ease administration.
>
> What do you think?
>
> Thanks in advance?
>
>
> ------------------------------------------------------------------------------
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

We are currently deploying about 25 web servers behind a set of reverse proxies with mod security. So that's what I would recommend. The bottleneck is not a problem, just make sure you architect for high availability, make sure logging is reasonable, and that the proxies have enough resources.

Advantages:

  * Easily put ALL of your rules into a single VCS repository and then load that into the proxies via chef etc.
  * Harden the reverse proxies without worrying about making your devs angry because you broke something enabling PaX >:)
  * Have a legacy application that requires an older kernel version? you need not worry about having to set up mod-security on some dinosaur like an old version of Oracle Linux or something.
  * Forward requests temporarily somewhere else even if the application server is down because the devs borked it on the last update.
  * Use a single IP/CNAME for EVERYTHING :D
  * Use a single SSL SAN cert and terminate it at the proxies; now you can use compression on the back end and save some CPU by not encrypting things for no good reason, as well as using advanced proxy functionality like mod_proxy_html.
  * Set caching headers for certain kinds of assets (.jpg etc.) regardless of what the devs want/forgot to do automatically for everything.


In summary, you can just create whatever your dev's want/need in the back-end while maintaining absolute control over your mod security install to ensure that it is up to date and running well. This also gives you the opportunity to use the same proxies for things like Varnish and other performance magic. There are probably more advantages, but if you can swing it, keep them separate, you can be much more agile that way.

-- 
Jacob Margason
Application Server Administrator
VUIT Linux Applications | Vanderbilt University
615.380.1013 | j.m...@va...



On 12/11/2015 01:37 PM, Guillermo Caminer wrote:
> Hi list!
>
> What would be best, in a multiple WebServer environment: use one ModSec instance per Web Server, or
> use one instance in a reverse proxy in front of all the Web Servers? Each has it owns cons and pros:
> multiple instances requires higher administration work, but would be more efficient. In the other
> hand, having one instance in a reverse proxy could create a bottle-neck but will ease administration.
>
> What do you think?
>
> Thanks in advance?
>
> ------------------------------------------------------------------------------
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Hi list!

What would be best, in a multiple WebServer environment: use one ModSec instance per Web Server, or
use one instance in a reverse proxy in front of all the Web Servers? Each has it owns cons and pros:
multiple instances requires higher administration work, but would be more efficient. In the other
hand, having one instance in a reverse proxy could create a bottle-neck but will ease administration.

What do you think?

Thanks in advance?

Thank you clarification Reindl :)

Chaim Sanders
Security Researcher, SpiderLabs

Trustwave | SMART SECURITY ON DEMAND
www.trustwave.com

-----Original Message-----
From: Reindl Harald [mailto:h.r...@th...]
Sent: Thursday, December 10, 2015 1:05 PM
To: mod...@li...
Subject: Re: [mod-security-users] Problem with SecRemoteRules



Am 10.12.2015 um 18:31 schrieb Chaim Sanders:
> This looks like a separate problem, in the future please change
> subject lines.

no - don't use reply at all on a mailing-list when you start a different question - changing the subject breaks the thread identical


________________________________

This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is strictly prohibited. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format.

Am 10.12.2015 um 18:31 schrieb Chaim Sanders:
> This looks like a separate problem, in the future please change subject
> lines.

no - don't use reply at all on a mailing-list when you start a different 
question - changing the subject breaks the thread identical

Bienvenu,
This looks like a separate problem, in the future please change subject lines. We can in fact help you however this platform has precompiled binaries available. See the fine folks over at ApacheHaus for details (https://www.apachehaus.com/cgi-bin/download.plx)

Chaim Sanders
Security Researcher, SpiderLabs

Trustwave | SMART SECURITY ON DEMAND
www.trustwave.com<http://www.trustwave.com/>

From: Bienvenu Ngoma [mailto:bev...@gm...]
Sent: Thursday, December 10, 2015 5:25 AM
To: mod...@li...
Subject: Re: [mod-security-users] Problem with SecRemoteRules

Hello,

I need to configure mod_security in Apache 2 on windows, cn you help me please?

_____________________________________________________________________________
Bienvenu NGOMA

Tél: +243 81 192 9554
e-mail: bev...@gm...<mailto:bev...@gm...>
skype: bvngoma

Kinshasa
République Démocratique du Congo

On Thu, Dec 10, 2015 at 9:54 AM, Amos Beh <amo...@iz...<mailto:amo...@iz...>> wrote:
Hi all,

ModSecurity: Loaded 0 rules from: 'https://dashboard.modsecurity.org/rules/download/plain<http://scanmail.trustwave.com/?c=4062&d=otPp1tjUeqCEJGH_DY7fteI5a_PmgUyT7X8dGOfkMg&s=5&u=https%3a%2f%2fround-lake.dustinice.workers.dev%3a443%2fhttps%2fdashboard%2emodsecurity%2eorg%2frules%2fdownload%2fplain>'.
ModSecurity: Problems loading external resources: Failed to download: "https://dashboard.modsecurity.org/rules/download/plain<http://scanmail.trustwave.com/?c=4062&d=otPp1tjUeqCEJGH_DY7fteI5a_PmgUyT7X8dGOfkMg&s=5&u=https%3a%2f%2fround-lake.dustinice.workers.dev%3a443%2fhttps%2fdashboard%2emodsecurity%2eorg%2frules%2fdownload%2fplain>" error: Problem with the SSL CA cert (path? access rights?).

I have enabled SecRemoteRules to download rules, but having this error.

Any idea on this?
Amazon Linux 2015.09
Apache 2.2.31
Mod_security 2.9

--
Best regards,

Amos Beh
Senior System Consultant





[Image removed by sender. iZeno Pte Ltd]<http://scanmail.trustwave.com/?c=4062&d=otPp1tjUeqCEJGH_DY7fteI5a_PmgUyT7XgWSOCxMA&s=5&u=https%3a%2f%2fround-lake.dustinice.workers.dev%3a443%2fhttp%2fwww%2eizeno%2ecom>

iZeno Pte Ltd  |   72 Bendemeer Road Luzerne #05-28 Singapore 339941
M  (65) 9853 9084  |  T   (65) 6100 2788  |  www.izeno.com<http://scanmail.trustwave.com/?c=4062&d=otPp1tjUeqCEJGH_DY7fteI5a_PmgUyT7XgWSOCxMA&s=5&u=https%3a%2f%2fround-lake.dustinice.workers.dev%3a443%2fhttp%2fwww%2eizeno%2ecom>

[Image removed by sender. facebook]<http://scanmail.trustwave.com/?c=4062&d=otPp1tjUeqCEJGH_DY7fteI5a_PmgUyT7S1MHLezNQ&s=5&u=https%3a%2f%2fround-lake.dustinice.workers.dev%3a443%2fhttps%2fwww%2efacebook%2ecom%2fiZenoPL>

Red Hat Certified Engineer (100-176-239) |
AWS Certified Solutions Architect – Professional Level (AWS-PSA-1445)





[Image removed by sender. iZeno Pte Ltd]<http://scanmail.trustwave.com/?c=4062&d=otPp1tjUeqCEJGH_DY7fteI5a_PmgUyT7XgWSOCxMA&s=5&u=https%3a%2f%2fround-lake.dustinice.workers.dev%3a443%2fhttp%2fwww%2eizeno%2ecom>

This communication contains information which may be confidential or privileged. The information is intended solely for the use of the individual or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this communication in error, please notify me by telephone immediately.




------------------------------------------------------------------------------

_______________________________________________
mod-security-users mailing list
mod...@li...<mailto:mod...@li...>
https://lists.sourceforge.net/lists/listinfo/mod-security-users<http://scanmail.trustwave.com/?c=4062&d=otPp1tjUeqCEJGH_DY7fteI5a_PmgUyT7S1MGbPhMw&s=5&u=https%3a%2f%2fround-lake.dustinice.workers.dev%3a443%2fhttps%2flists%2esourceforge%2enet%2flists%2flistinfo%2fmod-security-users>
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/<http://scanmail.trustwave.com/?c=4062&d=otPp1tjUeqCEJGH_DY7fteI5a_PmgUyT7X8eTeq1Nw&s=5&u=https%3a%2f%2fround-lake.dustinice.workers.dev%3a443%2fhttp%2fwww%2emodsecurity%2eorg%2fprojects%2fcommercial%2frules%2f>
http://www.modsecurity.org/projects/commercial/support/<http://scanmail.trustwave.com/?c=4062&d=otPp1tjUeqCEJGH_DY7fteI5a_PmgUyT7X4aH-bhYg&s=5&u=https%3a%2f%2fround-lake.dustinice.workers.dev%3a443%2fhttp%2fwww%2emodsecurity%2eorg%2fprojects%2fcommercial%2fsupport%2f>


________________________________

This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is strictly prohibited. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format.