mod-security-users Mailing List for ModSecurity (Page 2)

Dear All,

I am using Apache/2.4.62 on Debian with the modsecurity-crs package 
which is Producer ModSecurity for Apache/2.9.7
and I am using a clone of https://github.com/coreruleset/coreruleset.git

In the default Apache virtual host definition I have the following 
settings:

     <IfModule security2_module>
         SecAction "id:10102,phase:1,drop,nolog,noauditlog"
     </IfModule>

This works fine till Rule Set OWASP_CRS/3.3.7
All requests are dropped and no log is generated. Also older versions 
than 3.3.7 are doing the job well.

Recently I changed to OWASP_CRS/4.9.0-dev
I realised that this rule isn't working as before. It still drops the 
requests but "nolog" or "noauditlog" isn't working, so to say, I get log 
entries which I don't want to have. I checked out version 4.0, it's 
still the same.
To switch back to latest version of 3 is an easy and fast step but maybe 
there is a way to do the same with version 4.
Any ideas where I can look deeper into this issue ?  Any help would be 
appreciated.

Kind regards
Hans

-- 

Hi Robert, Hi Ervin,

many thanks for your information.
I don't have any issues with statistics. But as it is not used any more 
I switched off as recommended.

Kind regards
Hans

-- 


On 02.11.24 10:29, Ervin Hegedüs wrote:
> Hi Hans,
>
> as Robert explained, this is because ModSecurity has a feature (see 
> the blogpost).
>
> Please note that there is an intention that we would like to stop 
> using this variable. It's been set to "Off" for a while, see 
> https://github.com/owasp-modsecurity/ModSecurity/issues/3085.
>
> You need to update this in your config file (especially since 
> TrustWave transferred the project to OWASP these DNS queries don't 
> work at all).
>
>
>
> Thanks,
>
>
> a.
>
>
> On Fri, Nov 1, 2024 at 9:37 PM Hans Mayer via mod-security-users 
> <mod...@li...> wrote:
>
>
>     Dear All,
>
>     I am using Apache/2.4.62 on Debian with the modsecurity-crs package
>     which is Producer ModSecurity for Apache/2.9.7 and Rule Set
>     OWASP_CRS/4.9.0-dev
>
>     Each time I restart Apache I find a strange log entry in BINDs
>     query log.
>     The system is looking for a name
>     GIXDSLRXFRAXAYLDNBSSYMJOG4XDELZR.FY3S4MRMGEYC4NBSF4WEY5LBEA2S4MJM.GIXDSLRRGQWGGMY.1730491019.status.modsecurity.org
>     <http://GIXDSLRXFRAXAYLDNBSSYMJOG4XDELZR.FY3S4MRMGEYC4NBSF4WEY5LBEA2S4MJM.GIXDSLRRGQWGGMY.1730491019.status.modsecurity.org>
>     as A resource record which does not exists.
>     The query is almost the same except the number ( 1730491019 ) wich is
>     the Unix time.
>     Also this string GIXDSLRRGQWGGMY is different on different servers.
>
>     Any idea for what this should be useful ? Does it make sense ?
>     Which part is actually doing this ?
>
>     Kind regards
>     Hans
>
>     -- 
>
>
>
>     _______________________________________________
>     mod-security-users mailing list
>     mod...@li...
>     https://lists.sourceforge.net/lists/listinfo/mod-security-users
>     Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>     http://www.modsecurity.org/projects/commercial/rules/
>     http://www.modsecurity.org/projects/commercial/support/
>

Hi Hans,

as Robert explained, this is because ModSecurity has a feature (see the
blogpost).

Please note that there is an intention that we would like to stop using
this variable. It's been set to "Off" for a while, see
https://github.com/owasp-modsecurity/ModSecurity/issues/3085.

You need to update this in your config file (especially since TrustWave
transferred the project to OWASP these DNS queries don't work at all).



Thanks,


a.


On Fri, Nov 1, 2024 at 9:37 PM Hans Mayer via mod-security-users <
mod...@li...> wrote:

>
> Dear All,
>
> I am using Apache/2.4.62 on Debian with the modsecurity-crs package
> which is Producer ModSecurity for Apache/2.9.7 and Rule Set
> OWASP_CRS/4.9.0-dev
>
> Each time I restart Apache I find a strange log entry in BINDs query log.
> The system is looking for a name
>
> GIXDSLRXFRAXAYLDNBSSYMJOG4XDELZR.FY3S4MRMGEYC4NBSF4WEY5LBEA2S4MJM.GIXDSLRRGQWGGMY.1730491019.status.modsecurity.org
> as A resource record which does not exists.
> The query is almost the same except the number ( 1730491019 ) wich is
> the Unix time.
> Also this string GIXDSLRRGQWGGMY is different on different servers.
>
> Any idea for what this should be useful ? Does it make sense ?
> Which part is actually doing this ?
>
> Kind regards
> Hans
>
> --
>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Looks like this has been around for quite a while:

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/introducing-modsecurity-status-reporting/

Sincerely,
Robert Paprocki
c. 949.345.5709


On Fri, Nov 1, 2024 at 1:36 PM Hans Mayer via mod-security-users <
mod...@li...> wrote:

>
> Dear All,
>
> I am using Apache/2.4.62 on Debian with the modsecurity-crs package
> which is Producer ModSecurity for Apache/2.9.7 and Rule Set
> OWASP_CRS/4.9.0-dev
>
> Each time I restart Apache I find a strange log entry in BINDs query log.
> The system is looking for a name
>
> GIXDSLRXFRAXAYLDNBSSYMJOG4XDELZR.FY3S4MRMGEYC4NBSF4WEY5LBEA2S4MJM.GIXDSLRRGQWGGMY.1730491019.status.modsecurity.org
> as A resource record which does not exists.
> The query is almost the same except the number ( 1730491019 ) wich is
> the Unix time.
> Also this string GIXDSLRRGQWGGMY is different on different servers.
>
> Any idea for what this should be useful ? Does it make sense ?
> Which part is actually doing this ?
>
> Kind regards
> Hans
>
> --
>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Dear All,

I am using Apache/2.4.62 on Debian with the modsecurity-crs package 
which is Producer ModSecurity for Apache/2.9.7 and Rule Set  
OWASP_CRS/4.9.0-dev

Each time I restart Apache I find a strange log entry in BINDs query log.
The system is looking for a name
GIXDSLRXFRAXAYLDNBSSYMJOG4XDELZR.FY3S4MRMGEYC4NBSF4WEY5LBEA2S4MJM.GIXDSLRRGQWGGMY.1730491019.status.modsecurity.org
as A resource record which does not exists.
The query is almost the same except the number ( 1730491019 ) wich is 
the Unix time.
Also this string GIXDSLRRGQWGGMY is different on different servers.

Any idea for what this should be useful ? Does it make sense ?
Which part is actually doing this ?

Kind regards
Hans

-- 

The OWASP CRS team is pleased to announce the release of two new CRS
versions: v4.8.0 and v3.3.7.

For downloads and installation instructions, please refer to the
Installation page:
https://coreruleset.org/docs/deployment/install/

These are security releases which fix a recently discovered partial
request body bypass of CRS. On some platforms running CRS v3.3.6 and
earlier on the v3 release line or v4.7.0 and earlier on the v4 release
line, it is possible to submit a specially crafted multipart or JSON
request whose body content will bypass the inspection of the majority
of CRS rules on a default installation. CRS users are strongly
encouraged to update to a fixed version to resolve this issue.

-- Bypass details --

This bypass was possible due to the fact that the default list of
allowed request content types in CRS (both v3 and v4) included the
content type multipart/related, which cannot be processed by current
free & open-source WAF engine implementations, and the content types
application/cloudevents+json and application/cloudevents-batch+json,
which are not processed by default. This created a situation where a
request with body content would be allowed by CRS but the request body
could not, or would not, be processed by the engine. Many CRS rules
thus lost the ability to perform meaningful inspection of such
requests, in the absence of processed and parsed request body content.
In particular, the ARGS collection (and related collections) was not
populated by the engine: many CRS rules rely on inspecting the
contents of this important collection.

The newly released fixed versions remove the offending content types
from the default list of allowed request content types. New advice is
also provided on how to handle additional JSON content types beyond
the standard application/json content type.

Users making use of additional JSON content types, for example
application/cloudevents+json, should follow the new advice and ensure
that an appropriate rule is in place to enable JSON request body
processing for these content types. Most affected users can uncomment
and use optional rule 200006 in the file
"modsecurity.conf-recommended" to achieve this.

Note that the official CRS Docker container images[1], by default,
already correctly handle extended JSON types and are therefore not
affected by the JSON part of this problem.

-- For users unable to update --

Any users unable to update to a fixed version of CRS are strongly
encouraged to implement the fix steps themselves by removing the
content types multipart/related, application/cloudevents+json, and
application/cloudevents-batch+json from the variable
tx.allowed_request_content_type as set in the files crs-setup.conf and
REQUEST-901-INITIALIZATION.conf. The advice on JSON processing should
also be followed.

-- Other release changes --

Aside from the security fix, the v4.8.0 release also includes a few
other minor changes and improvements as part of the normal release
cycle for CRS v4. The full changes included in v4.8.0 can be found on
the GitHub release page[2].

Please feel free to contact us with any questions or concerns about
this release via the usual channels: directly via the CRS GitHub
repository, in our Slack channel (#coreruleset on owasp.slack.com), or
via the mailing list.

Sincerely,
Andrew Howe on behalf of the CRS development team

---
[1]: https://github.com/coreruleset/modsecurity-crs-docker
[2]: https://github.com/coreruleset/coreruleset/releases/tag/v4.8.0

Dear ModSecurity users,

ModSecurity is announcing the release of version 2.9.8.

This version includes a bug fixes and new features.

See CHANGELOG[1] and new blog post[2].

Additional information on the release, including the source (and
hashes/signatures), is available at:
https://github.com/SpiderLabs/ModSecurity/releases/tag/v2.9.8

Thanks to everybody who helped in this process: reporting issues, making
comments and suggestions, sending patches, etc.



Regards:

Marc Stern and Ervin Hegedüs


1: https://github.com/owasp-modsecurity/ModSecurity/blob/v2.9.8/CHANGES
2: https://modsecurity.org/20240903/new-versions-2024-september/

Dear ModSecurity users,

ModSecurity is announcing the release of version 3.0.13.

This version includes a bug fixes and new features.

See CHANGELOG[1] and new blog post[2].

Additional information on the release, including the source (and
hashes/signatures), is available at:
https://github.com/SpiderLabs/ModSecurity/releases/tag/v3.0.13

Thanks to everybody who helped in this process: reporting issues, making
comments and suggestions, sending patches, etc.



Regards:

Marc Stern and Ervin Hegedüs


1: https://github.com/owasp-modsecurity/ModSecurity/blob/v3.0.13/CHANGES
2: https://modsecurity.org/20240903/new-versions-2024-september/

Hey Christian,

Many thanks for your valuable information.

Best regards,

Hans


-- 



On 28.03.24 10:40, Christian Folini wrote:
> Hey Hans,
>
> This is all a bit complicated.
>
> ModSecurity has a 2.9.x release line as well as a ModSecurity 3.0.x release
> line.
>
> 2.9.x is aimed for Apache, 3.0.x for Nginx. But expanding the 3.0 support to
> other webservers is a priority for the OWASP ModSecurity project.
>
> CRS favors the use of ModSec 2.9 on Apache since ModSecurity 3 has a few
> implementation gaps and a performance problem. This is also being addressed
> this year.
>
> Best regards,
>
> Christian
>
>
>
> On Tue, Mar 26, 2024 at 10:18:09PM +0100, Hans Mayer via mod-security-users wrote:
>> Hi Christian,
>>
>> many thanks for your swift reply. I will give it a try.
>>
>> So, 2.9 is the latest production ready modsec.
>>
>> For version 3 at
>> https://github.com/owasp-modsecurity/ModSecurity-apache/tree/master I see
>> the recommendation to use v 2.9.x
>>
>> I am wondering because V 3 is also several years old.
>>
>>
>> Best,
>>
>> Hans
>>
>> -- 
>>
>>
>>
>> On 26.03.24 08:44, Christian Folini wrote:
>>> Good morning Hans,
>>>
>>> On Mon, Mar 25, 2024 at 10:12:50PM +0100, Hans Mayer via mod-security-users wrote:
>>>> I am using Apache/2.4.57 on Debian bookworm with the modsecurity-crs
>>>> package.
>>>>
>>>> In the logs I see: Producer: ModSecurity for Apache/2.9.7 ; OWASP_CRS/3.3.5
>>>>
>>>> At github there is already version 4 available from the coreruleset.
>>>>
>>>> Would this work with the existing /usr/lib/apache2/modules/mod_security2.so
>>> Yes it would.
>>>
>>> More documentation at
>>> https://coreruleset.org/20240214/let-crs-4-be-your-valentine/
>>>
>>> Please be aware that this is a major new release and the transition takes
>>> a bit of planning and testing. There will be new false positives usually.
>>>
>>> Best,
>>>
>>> Christian
>>>
>>>
>>
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Hey Hans,

This is all a bit complicated.

ModSecurity has a 2.9.x release line as well as a ModSecurity 3.0.x release
line.

2.9.x is aimed for Apache, 3.0.x for Nginx. But expanding the 3.0 support to
other webservers is a priority for the OWASP ModSecurity project.

CRS favors the use of ModSec 2.9 on Apache since ModSecurity 3 has a few
implementation gaps and a performance problem. This is also being addressed
this year.

Best regards,

Christian



On Tue, Mar 26, 2024 at 10:18:09PM +0100, Hans Mayer via mod-security-users wrote:
> 
> Hi Christian,
> 
> many thanks for your swift reply. I will give it a try.
> 
> So, 2.9 is the latest production ready modsec.
> 
> For version 3 at
> https://github.com/owasp-modsecurity/ModSecurity-apache/tree/master I see
> the recommendation to use v 2.9.x
> 
> I am wondering because V 3 is also several years old.
> 
> 
> Best,
> 
> Hans
> 
> -- 
> 
> 
> 
> On 26.03.24 08:44, Christian Folini wrote:
> > Good morning Hans,
> > 
> > On Mon, Mar 25, 2024 at 10:12:50PM +0100, Hans Mayer via mod-security-users wrote:
> > > I am using Apache/2.4.57 on Debian bookworm with the modsecurity-crs
> > > package.
> > > 
> > > In the logs I see: Producer: ModSecurity for Apache/2.9.7 ; OWASP_CRS/3.3.5
> > > 
> > > At github there is already version 4 available from the coreruleset.
> > > 
> > > Would this work with the existing /usr/lib/apache2/modules/mod_security2.so
> > Yes it would.
> > 
> > More documentation at
> > https://coreruleset.org/20240214/let-crs-4-be-your-valentine/
> > 
> > Please be aware that this is a major new release and the transition takes
> > a bit of planning and testing. There will be new false positives usually.
> > 
> > Best,
> > 
> > Christian
> > 
> > 
> 
> 
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Hi Christian,

many thanks for your swift reply. I will give it a try.

So, 2.9 is the latest production ready modsec.

For version 3 at 
https://github.com/owasp-modsecurity/ModSecurity-apache/tree/master I 
see the recommendation to use v 2.9.x

I am wondering because V 3 is also several years old.


Best,

Hans

-- 



On 26.03.24 08:44, Christian Folini wrote:
> Good morning Hans,
>
> On Mon, Mar 25, 2024 at 10:12:50PM +0100, Hans Mayer via mod-security-users wrote:
>> I am using Apache/2.4.57 on Debian bookworm with the modsecurity-crs
>> package.
>>
>> In the logs I see: Producer: ModSecurity for Apache/2.9.7 ; OWASP_CRS/3.3.5
>>
>> At github there is already version 4 available from the coreruleset.
>>
>> Would this work with the existing /usr/lib/apache2/modules/mod_security2.so
> Yes it would.
>
> More documentation at
> https://coreruleset.org/20240214/let-crs-4-be-your-valentine/
>
> Please be aware that this is a major new release and the transition takes
> a bit of planning and testing. There will be new false positives usually.
>
> Best,
>
> Christian
>
>

Good morning Hans,

On Mon, Mar 25, 2024 at 10:12:50PM +0100, Hans Mayer via mod-security-users wrote:
> I am using Apache/2.4.57 on Debian bookworm with the modsecurity-crs
> package.
> 
> In the logs I see: Producer: ModSecurity for Apache/2.9.7 ; OWASP_CRS/3.3.5
> 
> At github there is already version 4 available from the coreruleset.
> 
> Would this work with the existing /usr/lib/apache2/modules/mod_security2.so

Yes it would.

More documentation at
https://coreruleset.org/20240214/let-crs-4-be-your-valentine/

Please be aware that this is a major new release and the transition takes
a bit of planning and testing. There will be new false positives usually.

Best,

Christian


-- 
Neither a man nor a crowd nor a nation can be trusted to act humanely 
or to think sanely under the influence of a great fear.
-- Bertrand Russell

I am using Apache/2.4.57 on Debian bookworm with the modsecurity-crs 
package.

In the logs I see: Producer: ModSecurity for Apache/2.9.7 ; OWASP_CRS/3.3.5

At github there is already version 4 available from the coreruleset.

Would this work with the existing /usr/lib/apache2/modules/mod_security2.so

Or is there anywhere a documentation about this ?


// Hans


-- 

Hey ASPA Engineering,

Please do not use this mailinglist for marketing purposes.

I was ready to pick apart your offering but then I saw that you
misspelled "Introduction" on your website and I do not think it
fair to dig too deep.

What is interesting, though, is that you are remarkably silent about
the rule set your selling / licensing despite a lot of documentation
about your offering.

Care to name that?

Regs,

Christian Folini

On Sat, Mar 23, 2024 at 05:49:17PM +0330, ASPA Engineering wrote:
> Why not use integrated platforms like ngmod.com?
> 
> Are you tired of dealing with ModSecurity scripting and command-line
> interfaces? Do you need a user-friendly tool to easily configure and deploy
> Nginx with ModSecurity through a graphical interface? Look no further than
> ngmod.com, where we provide an all-in-one platform that automates Nginx and
> ModSecurity configuration.
> 
> Say goodbye to false positives with our built-in pruning wizard, which
> adjusts settings based on your web application's statistics. Our
> comprehensive logging system captures events triggered by ModSecurity,
> ensuring that you have detailed information at your fingertips.
> Additionally, every user transaction is logged in the access log, even if
> it's not flagged as malicious.
> 
> But that's not all. Our platform features an advanced analyzer that
> generates statistical diagrams, giving you valuable insights into your
> website's security and performance.
> 
> The best part? It's absolutely free to get started, and we value your
> feedback. Simply register at waf.ngmod.com and reach out to us via email.
> We can't wait to hear from you and help you streamline your Nginx and
> ModSecurity configuration process.
> 
> On Wed, Mar 20, 2024, 23:25 Hans Mayer via mod-security-users <
> mod...@li...> wrote:
> 
> >
> >
> > Dear All,
> >
> > not sure if everyone realised that there is a new fork of waf-fle
> >
> > https://github.com/LucaRastrelli/waf-fle
> >
> > It supports PHP 8.2 and MySQL 8
> >
> > Sorry for this slightly off-topic message, but there is no dedicated
> > waf-fle mailing list and mod-sec without any useful possibility to view
> > the logs makes no sense.
> >
> > // Hans
> >
> > --
> >
> >
> > On 07.02.24 23:15, Hans Mayer via mod-security-users wrote:
> > >
> > > Dear All,
> > >
> > > Over years I am using modsec and Apache with mlogc sending the alerts
> > > to waf-fle.
> > >
> > > With the last upgrade to Debian bookworm and PHP 8.2 waf-fle by
> > > klaubert doesn't work any more.
> > >
> > > Actually I am wondering how long it was running as the last update is
> > > 10 years ago.
> > >
> > > Now I am looking for an alternative to view the alert logs.
> > >
> > > I liked waf-fle as it didn't use a lot of resources. Is there
> > > something similar available ?
> > >
> > >
> > > // Hans
> > >
> >
> >
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
> >


> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Why not use integrated platforms like ngmod.com?

Are you tired of dealing with ModSecurity scripting and command-line
interfaces? Do you need a user-friendly tool to easily configure and deploy
Nginx with ModSecurity through a graphical interface? Look no further than
ngmod.com, where we provide an all-in-one platform that automates Nginx and
ModSecurity configuration.

Say goodbye to false positives with our built-in pruning wizard, which
adjusts settings based on your web application's statistics. Our
comprehensive logging system captures events triggered by ModSecurity,
ensuring that you have detailed information at your fingertips.
Additionally, every user transaction is logged in the access log, even if
it's not flagged as malicious.

But that's not all. Our platform features an advanced analyzer that
generates statistical diagrams, giving you valuable insights into your
website's security and performance.

The best part? It's absolutely free to get started, and we value your
feedback. Simply register at waf.ngmod.com and reach out to us via email.
We can't wait to hear from you and help you streamline your Nginx and
ModSecurity configuration process.

On Wed, Mar 20, 2024, 23:25 Hans Mayer via mod-security-users <
mod...@li...> wrote:

>
>
> Dear All,
>
> not sure if everyone realised that there is a new fork of waf-fle
>
> https://github.com/LucaRastrelli/waf-fle
>
> It supports PHP 8.2 and MySQL 8
>
> Sorry for this slightly off-topic message, but there is no dedicated
> waf-fle mailing list and mod-sec without any useful possibility to view
> the logs makes no sense.
>
> // Hans
>
> --
>
>
> On 07.02.24 23:15, Hans Mayer via mod-security-users wrote:
> >
> > Dear All,
> >
> > Over years I am using modsec and Apache with mlogc sending the alerts
> > to waf-fle.
> >
> > With the last upgrade to Debian bookworm and PHP 8.2 waf-fle by
> > klaubert doesn't work any more.
> >
> > Actually I am wondering how long it was running as the last update is
> > 10 years ago.
> >
> > Now I am looking for an alternative to view the alert logs.
> >
> > I liked waf-fle as it didn't use a lot of resources. Is there
> > something similar available ?
> >
> >
> > // Hans
> >
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Many thanks. I understand this rule at the end of  Apache config is 
available for all virtuel servers.


// Hans

-- 



On 21.03.24 18:59, az...@po... wrote:
> Doesn't very matter where you put it as far as it goes AFTER the 
> mod_security is loaded, for example at the end of apache2.conf .
>
>
>
>
>
> Citát Hans Mayer <mo...@ma...>:
>
>> Hi azurit,
>>
>> Your suggestion  sounds to be ok for me.
>>
>> Where should I place such a rule ?
>>
>>
>> Kind regards
>>
>> Hans
>>
>> -- 
>>
>>
>>
>> On 21.03.24 13:20, az...@po... wrote:
>>> Hi Hans,
>>>
>>> you can create a rule in phase 5 (logging) and use 
>>> WEBSERVER_ERROR_LOG variable for this purpose, see 
>>> https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-(v2.x)#user-content-WEBSERVER_ERROR_LOG 
>>> . Check this for an inspiration:
>>> https://github.com/azurit/modsecurity-false-positive-report-plugin
>>>
>>> azurit
>>>
>>>
>>>
>>> Citát Franziska Buehler <fra...@gm...>:
>>>
>>>> Hi Hans!
>>>>
>>>> To me, it's not clear what you're trying to achieve.
>>>> You would probably have to write a new rule that checks whether 
>>>> rules have
>>>> matched and therefore the blocking variables inbound or outbound (e.g.
>>>> tx.blocking_inbound_anomaly_score) are set. And then you "exec:" 
>>>> and call
>>>> your script in this new rule.
>>>> You can't test for individual rules, or at least I don't see how 
>>>> that could
>>>> work right now.
>>>>
>>>> Best,
>>>> Franziska
>>>> # CRS dev-on-duty
>>>>
>>>> Am Mi., 20. März 2024 um 21:03 Uhr schrieb Hans Mayer via
>>>> mod-security-users <mod...@li...>:
>>>>
>>>>>
>>>>> Dear All,
>>>>>
>>>>> I am using Apache/2.4.57 on Debian with the modsecurity-crs package
>>>>> which is Producer ModSecurity for Apache/2.9.3 and Rule Set
>>>>> OWASP_CRS/3.3.0
>>>>>
>>>>> With self written rules I have the possibility to execute a script 
>>>>> with
>>>>> the "exec:" statement.
>>>>>
>>>>> Is there a way to execute a script for all these predefined rules if
>>>>> they are triggered ?
>>>>>
>>>>>
>>>>> Kind regards
>>>>>
>>>>> Hans
>>>>>
>>>>> -- 
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> mod-security-users mailing list
>>>>> mod...@li...
>>>>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>>>>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>>>>> http://www.modsecurity.org/projects/commercial/rules/
>>>>> http://www.modsecurity.org/projects/commercial/support/
>>>>>
>>>
>>>
>>>
>>>
>>>
>>> _______________________________________________
>>> mod-security-users mailing list
>>> mod...@li...
>>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>>> http://www.modsecurity.org/projects/commercial/rules/
>>> http://www.modsecurity.org/projects/commercial/support/
>
>

Doesn't very matter where you put it as far as it goes AFTER the  
mod_security is loaded, for example at the end of apache2.conf .





Citát Hans Mayer <mo...@ma...>:

> Hi azurit,
>
> Your suggestion  sounds to be ok for me.
>
> Where should I place such a rule ?
>
>
> Kind regards
>
> Hans
>
> -- 
>
>
>
> On 21.03.24 13:20, az...@po... wrote:
>> Hi Hans,
>>
>> you can create a rule in phase 5 (logging) and use  
>> WEBSERVER_ERROR_LOG variable for this purpose, see  
>> https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-(v2.x)#user-content-WEBSERVER_ERROR_LOG . Check this for an  
>> inspiration:
>> https://github.com/azurit/modsecurity-false-positive-report-plugin
>>
>> azurit
>>
>>
>>
>> Citát Franziska Buehler <fra...@gm...>:
>>
>>> Hi Hans!
>>>
>>> To me, it's not clear what you're trying to achieve.
>>> You would probably have to write a new rule that checks whether rules have
>>> matched and therefore the blocking variables inbound or outbound (e.g.
>>> tx.blocking_inbound_anomaly_score) are set. And then you "exec:" and call
>>> your script in this new rule.
>>> You can't test for individual rules, or at least I don't see how that could
>>> work right now.
>>>
>>> Best,
>>> Franziska
>>> # CRS dev-on-duty
>>>
>>> Am Mi., 20. März 2024 um 21:03 Uhr schrieb Hans Mayer via
>>> mod-security-users <mod...@li...>:
>>>
>>>>
>>>> Dear All,
>>>>
>>>> I am using Apache/2.4.57 on Debian with the modsecurity-crs package
>>>> which is Producer ModSecurity for Apache/2.9.3 and Rule Set
>>>> OWASP_CRS/3.3.0
>>>>
>>>> With self written rules I have the possibility to execute a script with
>>>> the "exec:" statement.
>>>>
>>>> Is there a way to execute a script for all these predefined rules if
>>>> they are triggered ?
>>>>
>>>>
>>>> Kind regards
>>>>
>>>> Hans
>>>>
>>>> -- 
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> mod-security-users mailing list
>>>> mod...@li...
>>>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>>>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>>>> http://www.modsecurity.org/projects/commercial/rules/
>>>> http://www.modsecurity.org/projects/commercial/support/
>>>>
>>
>>
>>
>>
>>
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/

Hi azurit,

Your suggestion  sounds to be ok for me.

Where should I place such a rule ?


Kind regards

Hans

-- 



On 21.03.24 13:20, az...@po... wrote:
> Hi Hans,
>
> you can create a rule in phase 5 (logging) and use WEBSERVER_ERROR_LOG 
> variable for this purpose, see 
> https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-(v2.x)#user-content-WEBSERVER_ERROR_LOG 
> . Check this for an inspiration:
> https://github.com/azurit/modsecurity-false-positive-report-plugin
>
> azurit
>
>
>
> Citát Franziska Buehler <fra...@gm...>:
>
>> Hi Hans!
>>
>> To me, it's not clear what you're trying to achieve.
>> You would probably have to write a new rule that checks whether rules 
>> have
>> matched and therefore the blocking variables inbound or outbound (e.g.
>> tx.blocking_inbound_anomaly_score) are set. And then you "exec:" and 
>> call
>> your script in this new rule.
>> You can't test for individual rules, or at least I don't see how that 
>> could
>> work right now.
>>
>> Best,
>> Franziska
>> # CRS dev-on-duty
>>
>> Am Mi., 20. März 2024 um 21:03 Uhr schrieb Hans Mayer via
>> mod-security-users <mod...@li...>:
>>
>>>
>>> Dear All,
>>>
>>> I am using Apache/2.4.57 on Debian with the modsecurity-crs package
>>> which is Producer ModSecurity for Apache/2.9.3 and Rule Set
>>> OWASP_CRS/3.3.0
>>>
>>> With self written rules I have the possibility to execute a script with
>>> the "exec:" statement.
>>>
>>> Is there a way to execute a script for all these predefined rules if
>>> they are triggered ?
>>>
>>>
>>> Kind regards
>>>
>>> Hans
>>>
>>> -- 
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>> _______________________________________________
>>> mod-security-users mailing list
>>> mod...@li...
>>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>>> http://www.modsecurity.org/projects/commercial/rules/
>>> http://www.modsecurity.org/projects/commercial/support/
>>>
>
>
>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Dear Franziska,

Many thanks for your hint. It seems to be reasonable for what I want to 
achieve.

Sorry, that I didn't explain well what's my goal. But let me try again.

Whenever a rule is triggered then a script should be executed. For 
example what I have seen several times. Someone does some nasty things 
and one or more standard rules are blocking this attack. Great. But 
later on the same IP is looking around. Maybe triggering other rules or 
not. Therefore I want to block this IP in the firewall for a certain 
time. I hope this explains better.

When you say I should write a rule checking the score then this rule 
should be available for all Apache virtuell servers. Because I don't 
want to modify all Apache configs. Till now I wrote rules specific for a 
server within the Apache config. Is there a location to place a self 
written rule for all servers ?

Any help is welcome.


Kind regards

Hans


-- 




On 21.03.24 13:07, Franziska Buehler wrote:
> Hi Hans!
>
> To me, it's not clear what you're trying to achieve.
> You would probably have to write a new rule that checks whether rules 
> have matched and therefore the blocking variables inbound or outbound 
> (e.g. tx.blocking_inbound_anomaly_score) are set. And then you "exec:" 
> and call your script in this new rule.
> You can't test for individual rules, or at least I don't see how that 
> could work right now.
>
> Best,
> Franziska
> # CRS dev-on-duty
>
> Am Mi., 20. März 2024 um 21:03 Uhr schrieb Hans Mayer via 
> mod-security-users <mod...@li...>:
>
>
>     Dear All,
>
>     I am using Apache/2.4.57 on Debian with the modsecurity-crs package
>     which is Producer ModSecurity for Apache/2.9.3 and Rule Set
>     OWASP_CRS/3.3.0
>
>     With self written rules I have the possibility to execute a script
>     with
>     the "exec:" statement.
>
>     Is there a way to execute a script for all these predefined rules if
>     they are triggered ?
>
>
>     Kind regards
>
>     Hans
>
>     -- 
>
>
>
>
>
>
>
>     _______________________________________________
>     mod-security-users mailing list
>     mod...@li...
>     https://lists.sourceforge.net/lists/listinfo/mod-security-users
>     Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>     http://www.modsecurity.org/projects/commercial/rules/
>     http://www.modsecurity.org/projects/commercial/support/
>

Perfectly welcome Hans.

On Wed, Mar 20, 2024 at 08:42:13PM +0100, Hans Mayer via mod-security-users wrote:
> 
> 
> Dear All,
> 
> not sure if everyone realised that there is a new fork of waf-fle
> 
> https://github.com/LucaRastrelli/waf-fle
> 
> It supports PHP 8.2 and MySQL 8
> 
> Sorry for this slightly off-topic message, but there is no dedicated waf-fle
> mailing list and mod-sec without any useful possibility to view the logs
> makes no sense.
> 
> // Hans
> 
> -- 
> 
> 
> On 07.02.24 23:15, Hans Mayer via mod-security-users wrote:
> > 
> > Dear All,
> > 
> > Over years I am using modsec and Apache with mlogc sending the alerts to
> > waf-fle.
> > 
> > With the last upgrade to Debian bookworm and PHP 8.2 waf-fle by klaubert
> > doesn't work any more.
> > 
> > Actually I am wondering how long it was running as the last update is 10
> > years ago.
> > 
> > Now I am looking for an alternative to view the alert logs.
> > 
> > I liked waf-fle as it didn't use a lot of resources. Is there something
> > similar available ?
> > 
> > 
> > // Hans
> > 
> 
> 
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Hi Hans,

you can create a rule in phase 5 (logging) and use WEBSERVER_ERROR_LOG  
variable for this purpose, see  
https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-(v2.x)#user-content-WEBSERVER_ERROR_LOG . Check this for an  
inspiration:
https://github.com/azurit/modsecurity-false-positive-report-plugin

azurit



Citát Franziska Buehler <fra...@gm...>:

> Hi Hans!
>
> To me, it's not clear what you're trying to achieve.
> You would probably have to write a new rule that checks whether rules have
> matched and therefore the blocking variables inbound or outbound (e.g.
> tx.blocking_inbound_anomaly_score) are set. And then you "exec:" and call
> your script in this new rule.
> You can't test for individual rules, or at least I don't see how that could
> work right now.
>
> Best,
> Franziska
> # CRS dev-on-duty
>
> Am Mi., 20. März 2024 um 21:03 Uhr schrieb Hans Mayer via
> mod-security-users <mod...@li...>:
>
>>
>> Dear All,
>>
>> I am using Apache/2.4.57 on Debian with the modsecurity-crs package
>> which is Producer ModSecurity for Apache/2.9.3 and Rule Set
>> OWASP_CRS/3.3.0
>>
>> With self written rules I have the possibility to execute a script with
>> the "exec:" statement.
>>
>> Is there a way to execute a script for all these predefined rules if
>> they are triggered ?
>>
>>
>> Kind regards
>>
>> Hans
>>
>> --
>>
>>
>>
>>
>>
>>
>>
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>>

Hi Hans!

To me, it's not clear what you're trying to achieve.
You would probably have to write a new rule that checks whether rules have
matched and therefore the blocking variables inbound or outbound (e.g.
tx.blocking_inbound_anomaly_score) are set. And then you "exec:" and call
your script in this new rule.
You can't test for individual rules, or at least I don't see how that could
work right now.

Best,
Franziska
# CRS dev-on-duty

Am Mi., 20. März 2024 um 21:03 Uhr schrieb Hans Mayer via
mod-security-users <mod...@li...>:

>
> Dear All,
>
> I am using Apache/2.4.57 on Debian with the modsecurity-crs package
> which is Producer ModSecurity for Apache/2.9.3 and Rule Set
> OWASP_CRS/3.3.0
>
> With self written rules I have the possibility to execute a script with
> the "exec:" statement.
>
> Is there a way to execute a script for all these predefined rules if
> they are triggered ?
>
>
> Kind regards
>
> Hans
>
> --
>
>
>
>
>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

Dear All,

I am using Apache/2.4.57 on Debian with the modsecurity-crs package 
which is Producer ModSecurity for Apache/2.9.3 and Rule Set  OWASP_CRS/3.3.0

With self written rules I have the possibility to execute a script with 
the "exec:" statement.

Is there a way to execute a script for all these predefined rules if 
they are triggered ?


Kind regards

Hans

-- 

Dear All,

not sure if everyone realised that there is a new fork of waf-fle

https://github.com/LucaRastrelli/waf-fle

It supports PHP 8.2 and MySQL 8

Sorry for this slightly off-topic message, but there is no dedicated 
waf-fle mailing list and mod-sec without any useful possibility to view 
the logs makes no sense.

// Hans

-- 


On 07.02.24 23:15, Hans Mayer via mod-security-users wrote:
>
> Dear All,
>
> Over years I am using modsec and Apache with mlogc sending the alerts 
> to waf-fle.
>
> With the last upgrade to Debian bookworm and PHP 8.2 waf-fle by 
> klaubert doesn't work any more.
>
> Actually I am wondering how long it was running as the last update is 
> 10 years ago.
>
> Now I am looking for an alternative to view the alert logs.
>
> I liked waf-fle as it didn't use a lot of resources. Is there 
> something similar available ?
>
>
> // Hans
>

Hi there,

I've tried to get in touch with the Comodo ModSecurity / rules team.

This is about OWASP taking over ModSecurity and talking to them as rules
vendor.

However, I can't find any useful email address and the enterprise sales
I tried did not get back to me.

Unless my memory fails me, I've never had any contact with Comodo.

So if you know anybody at Comodo or you have a contact for me, then please
share via DM. Alternatively, please tell them to get in touch with me.

Best,

Christian Folini, OWASP ModSecurity Co-Lead


-- 
You work to make a dream come true, you do not whine it into existence.
-- Arnold Schwarzenegger