主页 / server / 问题

问题[mod-security](server)

Martin Hope
Rahul Thakkar
Asked: 2024-04-10 19:46:56 +0800 CST
  • 5

我已经在 ubuntu 22.04 中使用安装了 apache 的 mod 安全模块。

sudo apt-get install libapache2-mod-security2
sudo a2enmod security2
sudo systemctl restart apache2

这将安装安全模块版本 2.9.5 和核心规则集版本 3.3.2。

我设置

SecRuleEngine On 在 /etc/modsecurity/modsecurity.conf 中

并仅保留从核心规则集中启用的两个conf，其余所有conf我已临时移动。

  1. /usr/share/modsecurity-crs/REQUEST-933-APPLICATION-ATTACK-PHP.conf
  2. /usr/share/modsecurity-crs/REQUEST-949-BLOCKING-EVALUATION.conf

因为，我的目标是通过观察来一一制定规则，没有任何误报/我的应用程序需要被阻止。

但它并没有阻止请求，而是只是记录在 mod 安全审核日志中。

我不确定我在这里缺少什么，其余的一切都处于默认设置。

我可以根据需要分享更多详细信息。

有人可以帮我弄这个吗？

mod-security
Martin Hope
Nishu Ali
Asked: 2022-01-12 20:49:27 +0800 CST
  • 0

我在我的一个服务器中的一个子域“pma”和一个名为“app”的目录中有一个 phpMyAdmin 的副本（从 zip 存档手动安装，而不是通过 yum），我将其用于与数据库相关的管理并且它正在工作好几个月。几天前，我的本地 IP 在尝试登录时被阻止，并且经过大量挖掘在 /var/log/apache2/error_log 中找到的以下日志（出于明显的原因，用 <PLACEHOLDER_TEXT> 替换了我的本地 IP 和服务器域）

[Fri Jan 07 11:37:54.198143 2022] [:error] [pid 60361] [client <IP_ADDRESS>:60532] [client <IP_ADDRESS>] ModSecurity: Access denied with code 403 (phase 2). Pattern match "[\\\\x22'\\\\/`]on[a-z]{1,}?\\\\/{0,}=" at REQUEST_COOKIES:pmaAuth-1. [file "/var/cpanel/cwaf/rules/07_XSS_XSS.conf"] [line "162"] [id "212760"] [rev "2"] [msg "COMODO WAF: IE XSS Filters - Attack Detected.||www.pma.<DOMAIN_NAME>|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "www.pma.<DOMAIN_NAME>"] [uri "/app/themes/pmahomme/img/ajax_clock_small.gif"] [unique_id "Yde1ktSwsuOu5OLfWtOp8QAAAAA"], referer: http://www.pma.<DOMAIN_NAME>/app/themes/pmahomme/css/theme.css?v=5.1.1&nocache=1161605458ltr&server=1
[Fri Jan 07 11:37:54.198701 2022] [:error] [pid 60364] [client <IP_ADDRESS>:60535] [client <IP_ADDRESS>] ModSecurity: Access denied with code 403 (phase 2). Pattern match "[\\\\x22'\\\\/`]on[a-z]{1,}?\\\\/{0,}=" at REQUEST_COOKIES:pmaAuth-1. [file "/var/cpanel/cwaf/rules/07_XSS_XSS.conf"] [line "162"] [id "212760"] [rev "2"] [msg "COMODO WAF: IE XSS Filters - Attack Detected.||www.pma.<DOMAIN_NAME>|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "www.pma.<DOMAIN_NAME>"] [uri "/app/index.php"] [unique_id "Yde1kjnCs4t3VK1sKGhIPAAAAAE"]
[Fri Jan 07 11:37:54.215776 2022] [core:error] [pid 60361] [client <IP_ADDRESS>:60532] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace., referer: http://www.pma.<DOMAIN_NAME>/app/themes/pmahomme/css/theme.css?v=5.1.1&nocache=1161605458ltr&server=1
[Fri Jan 07 11:37:54.235059 2022] [core:error] [pid 60364] [client <IP_ADDRESS>:60535] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error. Use 'LimitInternalRecursion' to increase the limit if necessary. Use 'LogLevel debug' to get a backtrace.
[Fri Jan 07 11:37:54.238782 2022] [:error] [pid 60364] [client <IP_ADDRESS>:60535] [client <IP_ADDRESS>] ModSecurity: Audit log: Failed to lock global mutex: Permission denied [hostname "www.pma.<DOMAIN_NAME>"] [uri "/home/<USER_NAME>/public_html/index.php"] [unique_id "Yde1kjnCs4t3VK1sKGhIPAAAAAE"]
[Fri Jan 07 11:37:54.238830 2022] [:error] [pid 60361] [client <IP_ADDRESS>:60532] [client <IP_ADDRESS>] ModSecurity: Audit log: Failed to lock global mutex: Permission denied [hostname "www.pma.<DOMAIN_NAME>"] [uri "/home/<USER_NAME>/public_html/index.php"] [unique_id "Yde1ktSwsuOu5OLfWtOp8QAAAAA"], referer: http://www.pma.<DOMAIN_NAME>/app/themes/pmahomme/css/theme.css?v=5.1.1&nocache=1161605458ltr&server=1
[Fri Jan 07 11:37:54.244507 2022] [:error] [pid 60364] [client <IP_ADDRESS>:60535] [client <IP_ADDRESS>] ModSecurity: Audit log: Failed to unlock global mutex: Permission denied [hostname "www.pma.<DOMAIN_NAME>"] [uri "/home/<USER_NAME>/public_html/index.php"] [unique_id "Yde1kjnCs4t3VK1sKGhIPAAAAAE"]
[Fri Jan 07 11:37:54.244559 2022] [:error] [pid 60361] [client <IP_ADDRESS>:60532] [client <IP_ADDRESS>] ModSecurity: Audit log: Failed to unlock global mutex: Permission denied [hostname "www.pma.<DOMAIN_NAME>"] [uri "/home/<USER_NAME>/public_html/index.php"] [unique_id "Yde1ktSwsuOu5OLfWtOp8QAAAAA"], referer: http://www.pma.<DOMAIN_NAME>/app/themes/pmahomme/css/theme.css?v=5.1.1&nocache=1161605458ltr&server=1

虽然我对 SSH 和 CLI 没问题，但我不是核心服务器管理员，我花了一些时间和 ISP 和托管服务提供商的帮助来解决 CSF/LFD 中的 IP 禁令问题，但我正在尝试了解实际问题，以便将来避免。任何人都可以破译原因吗？谢谢！

firewall mod-security phpmyadmin
Martin Hope
David
Asked: 2021-04-27 18:19:40 +0800 CST
  • 0

我试图限制特定主机（例如 AWS）访问我的网络服务器。我尝试了这些的不同变体，但它不起作用。

# Block AWS
SecRule REQUEST_HEADERS:Host ".*\.amazonaws\.com.*" \
"msg:'AWS blocked',id:10007,log,t:lowercase,drop,phase:1"

我试过了：

SecRule REQUEST_HEADERS:Host ".*\.amazonaws\.com.*"
SecRule REQUEST_HEADERS:Host "@rx ^.*\.amazonaws\.com.*$"
SecRule REQUEST_HEADERS:Host "@contains amazonaws.com"

以上都不起作用，所以我得出的结论是我的标头查询语法有问题。这是我尝试匹配排除的主机字符串的示例：主机：ec2-12-34-56-78.compute-1.amazonaws.com

firewall web-application-firewall mod-security
Martin Hope
Jimmy Chi Kin Chau
Asked: 2020-11-07 17:01:25 +0800 CST
  • 0

我租了一台准系统服务器，安装了 Centos 7，然后安装了 centos web 面板，服务器设置为仅 apache，使用 apache 2.4.4x 和 php 7。

我在其中一个虚拟主机上建立了一个wordpress站点，经过一段时间的编辑，当我试图在我的手机上查看该站点时，我发现它看到了403禁止。我还检查了不同站点中的一些不同计算机，奇怪的是似乎只有我用来编辑站点的浏览器才能查看它。

我正在使用 Chrome 我一直在使用 firefox 进行编辑，我再次尝试了 firefox，它可以工作。但是在我将firefox刷新为出厂设置后，它也给出了403，我尝试在隐身模式下使用Chrome，它没有重现问题。

我已将所有文件设置为 644，将所有目录设置为 755

并且使用我的手机，无论我使用的是wifi还是移动网络，都是403

我在 index.html 中使用元刷新将流量重定向到 site/ 的 wordpress 网站

以下是返回 403 时的日志摘录

==> example.com.log <==
YYY.YYY.232.181 - - [07/Nov/2020:08:31:38 +0800] "GET / HTTP/1.1" 200 853 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0"

==> example.com.error.log <==
[Sat Nov 07 08:31:39.815669 2020] [:error] [pid 18537:tid 140088488527616] [client YYY.YYY.232.181:51246] [client YYY.YYY.232.181] ModSecurity: Access denied with code 403 (phase 2). Pattern match "([\\\\~\\\\!\\\\@\\\\#\\\\$\\\\%\\\\^\\\\&\\\\*\\\\(\\\\)\\\\-\\\\+\\\\=\\\\{\\\\}\\\\[\\\\]\\\\|\\\\:\\\\;\\"\\\\'\\\\\\xc2\\xb4\\\\\\xe2\\x80\\x99\\\\\\xe2\\x80\\x98\\\\`\\\\<\\\\>].*?){8,}" at REQUEST_COOKIES:__gads. [file "/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "157"] [id "981172"] [rev "2"] [msg "Restricted SQL Character Anomaly Detection Alert - Total # of special characters exceeded"] [data "Matched Data: = found within REQUEST_COOKIES:__gads: ID=27dbb135f45c1fd9-22c5888d8fc4000e:T=1604709099:RT=1604709099:S=ALNI_MaW2UgLrOqyys2zp1yt_idCh-PXJg"] [ver "OWASP_CRS/2.2.9"] [maturity "9"] [accuracy "8"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"] [hostname "www.example.com"] [uri "/favicon.ico"] [unique_id "X6Xq62SIpp9t4B3qVX2@-QAAAMU"]

==> example.com.log <==
YYY.YYY.232.181 - - [07/Nov/2020:08:31:39 +0800] "GET /favicon.ico HTTP/1.1" 403 220 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0"

==> example.com.error.log <==
[Sat Nov 07 08:31:45.131170 2020] [:error] [pid 18537:tid 140088293922560] [client YYY.YYY.232.181:51273] [client YYY.YYY.232.181] ModSecurity: Access denied with code 403 (phase 2). Pattern match "([\\\\~\\\\!\\\\@\\\\#\\\\$\\\\%\\\\^\\\\&\\\\*\\\\(\\\\)\\\\-\\\\+\\\\=\\\\{\\\\}\\\\[\\\\]\\\\|\\\\:\\\\;\\"\\\\'\\\\\\xc2\\xb4\\\\\\xe2\\x80\\x99\\\\\\xe2\\x80\\x98\\\\`\\\\<\\\\>].*?){8,}" at REQUEST_COOKIES:__gads. [file "/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "157"] [id "981172"] [rev "2"] [msg "Restricted SQL Character Anomaly Detection Alert - Total # of special characters exceeded"] [data "Matched Data: = found within REQUEST_COOKIES:__gads: ID=27dbb135f45c1fd9-22c5888d8fc4000e:T=1604709099:RT=1604709099:S=ALNI_MaW2UgLrOqyys2zp1yt_idCh-PXJg"] [ver "OWASP_CRS/2.2.9"] [maturity "9"] [accuracy "8"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"] [hostname "www.example.com"] [uri "/site"] [unique_id "X6Xq8WSIpp9t4B3qVX2@-gAAANQ"]

==> example.com.log <==
YYY.YYY.232.181 - - [07/Nov/2020:08:31:45 +0800] "GET /site HTTP/1.1" 403 213 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0"

==> example.com.error.log <==
[Sat Nov 07 08:31:45.222926 2020] [:error] [pid 18537:tid 140088403027712] [client YYY.YYY.232.181:51273] [client YYY.YYY.232.181] ModSecurity: Access denied with code 403 (phase 2). Pattern match "([\\\\~\\\\!\\\\@\\\\#\\\\$\\\\%\\\\^\\\\&\\\\*\\\\(\\\\)\\\\-\\\\+\\\\=\\\\{\\\\}\\\\[\\\\]\\\\|\\\\:\\\\;\\"\\\\'\\\\\\xc2\\xb4\\\\\\xe2\\x80\\x99\\\\\\xe2\\x80\\x98\\\\`\\\\<\\\\>].*?){8,}" at REQUEST_COOKIES:__gads. [file "/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "157"] [id "981172"] [rev "2"] [msg "Restricted SQL Character Anomaly Detection Alert - Total # of special characters exceeded"] [data "Matched Data: = found within REQUEST_COOKIES:__gads: ID=27dbb135f45c1fd9-22c5888d8fc4000e:T=1604709099:RT=1604709099:S=ALNI_MaW2UgLrOqyys2zp1yt_idCh-PXJg"] [ver "OWASP_CRS/2.2.9"] [maturity "9"] [accuracy "8"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"] [hostname "www.example.com"] [uri "/favicon.ico"] [unique_id "X6Xq8WSIpp9t4B3qVX2@-wAAAMc"]

==> example.com.log <==
YYY.YYY.232.181 - - [07/Nov/2020:08:31:45 +0800] "GET /favicon.ico HTTP/1.1" 403 220 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0"
YYY.YYY.232.181 - - [07/Nov/2020:08:32:06 +0800] "GET / HTTP/1.1" 304 - "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36"
YYY.YYY.232.181 - - [07/Nov/2020:08:32:06 +0800] "GET /favicon.ico HTTP/1.1" 404 209 "https://www.example.com/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36"
YYY.YYY.232.181 - - [07/Nov/2020:08:32:12 +0800] "GET /site/ HTTP/1.1" 200 58190 "https://www.example.com/" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36"
wordpress apache-2.4 mod-security
Martin Hope
MarkHelms
Asked: 2020-08-09 05:46:24 +0800 CST
  • 0

我全新安装了 CentOS 8。我从 repo 安装了 Apache 2.4.37。然后安装最新的 ModSecurity：

dnf install mod_security -y

检查安装

dnf info mod_security

结果：

Name         : mod_security
Version      : 2.9.2

所需的 Apache 模块可用/已加载：

apachectl -M | grep security -> security2_module (shared)
apachectl -M | grep unique -> unique_id_module (shared)

从 repo 安装核心规则集：

dnf install mod_security_crs

它会自动将规则链接到 apache 文件夹中

/etc/httpd/modsecurity.d/activated_rules

规则已经检查/到位。

主配置文件

/etc/httpd/conf.d/mod_security.conf

包括必要的进一步配置文件，包括规则配置文件本身：

IncludeOptional /etc/httpd/modsecurity.d/crs-setup.conf
IncludeOptional /etc/httpd/modsecurity.d/activated_rules/*.conf
IncludeOptional /etc/httpd/modsecurity.d/local_rules/*.conf

（路径已经过双重检查）并激活规则引擎：

SecRuleEngine On

规则配置文件modsecurity.d/crs-setup.conf（包含在 中mod_security.conf，见上文）提供

SecDefaultAction "phase:1,log,auditlog,deny,status:403"
SecDefaultAction "phase:2,log,auditlog,deny,status:403"

Apache httpd.conf 调用 ModSecurity：

SecStatusEngine On

重新启动 ( apachectl restart) 表明 ModSecurity 已成功加载：

ModSecurity: StatusEngine call successfully sent. <-- including LUA etc.

使用受操纵的 URL 进行测试，例如脚本插入：

/?q=%22%3E%3Cscript%3Ealert(1)%3C/script%3E%27

在 ModSecurity 方面没有表现出任何反应。ModSecuritie 的审计和调试日志文件中根本没有条目（调试级别设置为 3），Apache 的日志文件中没有错误。

centos mod-security
Martin Hope
Kaspacainoombro
Asked: 2020-06-21 22:19:23 +0800 CST
  • 1

随机地，modsecurity 会阻止合法客户端请求，给出错误 403。这是 modsec_audit.log 的段落：

    ---d6e99f36-A--
[21/Jun/2020:07:14:45 +0100] Xu761X8AAAEAADI1YrAAAABQ xxx.xxx.xxx.xxx 60036 xxx.xxx.xxx.xxx 443
--d6e99f36-B--
GET /s/p.json?eyJ0IjoyLjksImYiOnsiZmxpX3BsIjoiYXNwZXJzb3IiLCJmbGlfZyI6LTEsImZsaV9jIjotMSwiZmxpX20iOjAsImZsaV9hIjoyMDE1fSwiY3NyZiI6ImE5MDMwMDkxLTBlZjg$
Host: fneon.eu
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:77.0) Gecko/20100101 Firefox/77.0
Accept: */*
Accept-Language: pt-PT,pt;q=0.8,en;q=0.5,en-US;q=0.3
Accept-Encoding: gzip, deflate, br
Referer: https://example.com/
Content-Type: application/json,charset=UTF-8
DNT: 1
Connection: keep-alive
Cookie: jwt=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIyYzMwOGQwYTc5NGEyZWU2MjMxYzI2M2EyYWMzNjkwMCIsImV4cCI6MTU5MzY0NDQwMCwiaWF0IjoxNTkyNzE5ODg1$
Pragma: no-cache
Cache-Control: no-cache

--d6e99f36-F--
HTTP/1.1 403 Forbidden
X-FRAME-OPTIONS: DENY
X-Content-Type-Options: nosniff
Content-Length: 199
Keep-Alive: timeout=5, max=89
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

--d6e99f36-E--
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access this resource.</p>
</body></html>

--d6e99f36-H--
Apache-Error: [file "mod_evasive20.c"] [line 259] [level 3] client denied by server configuration: %s
Apache-Handler: proxy-server
Stopwatch: 1592720085355364 815 (- - -)
Stopwatch2: 1592720085355364 815; combined=42, p1=35, p2=0, p3=1, p4=0, p5=5, sr=0, sw=1, l=0, gc=0
Response-Body-Transformed: Dechunked
Producer: ModSecurity for Apache/2.9.0 (http://www.modsecurity.org/).
Server: Apache
Engine-Mode: "ENABLED"

--d6e99f36-Z--

这是我的配置（仅更改）：

/etc/modsecurity/modsecurity.conf

SecRuleEngine On 
SecResponseBodyAccess Off 
SecRequestBodyLimit 5242880 (15Mb)

/etc/apache2/mods-enabled/evasive.conf
<IfModule mod_evasive20.c>
    DOSHashTableSize    3097
    DOSPageCount        10
    DOSSiteCount        75
    DOSPageInterval     5
    DOSSiteInterval     1
    DOSBlockingPeriod   3000
    DOSWhitelist 127.0.0.1 
    DOSWhitelist xxx.xxx.xxx.xxx 
    DOSWhitelist  xxx.xxx.xxx.xxx 
    DOSWhitelist xxx.xxx.xxx.xxx
    DOSLogDir           "/var/log/mod_evasive"
</IfModule>

/etc/apache2/conf-enabled/security.conf 
ServerTokens Prod

重现问题的一种方法是当客户端发出此类请求时：

https://example.com/s/p.json?eyJ0IjoyLjksImYiOnsiZmxpX3BsIjoiYXNwZXJzb3IiLCJmbGlfZyI6LTEsImZsaV9jIjotMSwiZmxpX20iOjAsImZsaV9hIjoyMDExfSwiY3NyZiI6ImE5MDMwMDkxLTBlZjgtNDcyOC05YjQ1LTU1MWY3M2U5YjQ5MCJ9

...在我的情况下这是一个合法的请求。谁能告诉我如何解决这个问题？谢谢你。

apache2 mod-security http-status-code-403
Martin Hope
nnyby
Asked: 2020-05-27 10:49:37 +0800 CST
  • 4

我正在使用OWASP 核心规则集 3.2.0设置ModSecurity 3.0.4和ModSecurity-nginx。

如果我有这样的规则排除，在REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf：

 SecRule REQUEST_URI "@beginsWith /api.php" \
     "id:1015,\
     phase:2,\
     pass,\
     nolog,\
     ctl:ruleRemoveById=941160"

如何将此排除限制为特定主机名？例如，wiki.example.com。

firewall web-application-firewall mod-security
Martin Hope
skwokie
Asked: 2020-05-01 11:12:24 +0800 CST
  • 1

我在操作系统中为 nginx 和 modsec 的日志设置了以下日志轮换，它适用于 nginx 的日志，但不适用于 modsec 的日志。modsec 的结果是，它为日志文件制作了一个副本，但它继续写入旧文件，如下所示：

-rw-r--r-- 1 root root 26996998524 Apr 30 12:00 modsec_debug.log.1
drwxr-xr-x 3 root root        4096 Apr 29 10:31 .
-rw-r--r-- 1 root root           0 Apr 29 10:31 modsec_debug.log

有人可以告诉我我错过了什么吗？除了'kill -USR1 cat /var/run/nginx.pid'，我应该运行其他东西吗？请注意，nginx 在容器内运行，我有这个卷映射：/var/log/nginx:/usr/local/openresty/nginx/logs

其他信息：openresty：1.13.6.2 Modsec：3.0.3 操作系统版本：Ubuntu 18.04.3 LTS

/var/log/nginx/*.log {
        daily
        missingok
        rotate 14
        compress
        delaycompress
        notifempty
        create 0640 root root
        maxsize 500M
        minsize 500M
        sharedscripts
        prerotate
                if [ -d /etc/logrotate.d/httpd-prerotate ]; then \
                        run-parts /etc/logrotate.d/httpd-prerotate; \
                fi \
        endscript
        postrotate
                docker exec www-proxy /bin/sh -c 'kill -USR1 `cat /var/run/nginx.pid`'
        endscript
}

/var/log/nginx/modsec/*.log {
        daily
        missingok
        rotate 14
        compress
        delaycompress
        notifempty
        create 0640 root root
        maxsize 500M
        minsize 500M
        sharedscripts
        prerotate
                if [ -d /etc/logrotate.d/httpd-prerotate ]; then \
                        run-parts /etc/logrotate.d/httpd-prerotate; \
                fi \
        endscript
        postrotate
                docker exec www-proxy /bin/sh -c 'kill -USR1 `cat /var/run/nginx.pid`'
        endscript
}

谢谢。

mod-security