Topic: mod_security new install just passes code

[rbramble]

Hello,
I have just stumbled across mod_security,
It looks like it is working.

I have a webserver that is running Apache 2.2.4 and PHP and mysql etc.
It was made with web-developer 1.95.
Error logs show that mod_security is running but the site was injected with SQL errors.

I want to setup a new one but need to know that this one is protected.
I am using Wampserver 2.0i and it is running Apache 2.2.11. (mod_security 2.5.9)

Doing a info.php shows that mod_security is running and installed,
however when I go to http://myserver-name/?highlight=%27 (from the localhost) it just allows it to go through.

I used the modsecurity.conf-minimal and it just allowed through to the page.
When I used the very quick start as my conf it blocked the traffic.

How do I go about setting this up and getting a basic set of rules to block the very bad stuff and get this site setup securely?


Ron

[glsmith]

You should have a folder there that came with Mod Security called "rules," inside there is a bunch of different files with rules for everything under the sun.

If you don't find them, you can always download them from Breech.
http://www.modsecurity.org/download/modsecurity-core-rules_2.5-1.6.1.tar.gz

You can then make a folder in /conf ... say core-rules and include them into your Apache config.

Include conf/core-rules/*.conf

to get them all of just Include the ones you want. The core rules do give off false positives, so over time you may need to modify an existing one, remove an existing or possibly add something of your own.


Documentation on mod_sec is here is it did not come with WAMP

http://www.modsecurity.org/documentation/modsecurity-apache/2.5.9/modsecurity2-apache-reference.html

[rbramble]

I followed this information from this fourum
http://www.apachelounge.com/viewtopic.php?t=1281

I created a modsecurity.conf and called it from the http.conf and then loaded the rules from http://www.gotroot.com/mod_security+rules

I loaded each rule that I could find 1 at a time.
How do I know this will catch the bad stuff now?
Mod_Security is running but I need to know that it will be running and secure the network.

[glsmith]

try throwing bad stuff at it.

As of this point i cannot say anything about the gotroot rules cause i've never used them. I am confident with the breech core rules as I have used them and I see the polution they leave in my error log. The lastest round of crap being thrown at me is

[Wed Aug 12 05:53:37 2009] [error] [client 94.102.63.13] ModSecurity: Warning. Pattern match "(?:[\\\\(\\)\\%#]|--)" at REQUEST_HEADERS:User-Agent. [file "/usr/Apache/core_rules/modsecurity_crs_40_generic_attacks.conf"] [line "78"] [id "959905"] [msg "SQL Injection Attack"] [data "update"] [severity "CRITICAL"] [tag "WEB_ATTACK/SQL_INJECTION"] [hostname "www.mydomain.com"] [uri "/YaBB.pl"] [unique_id "SoK7UQoAAAIAAAgQ4i8AAAA-"]

You should be able to figure out what you need to try by looking at a rule, for instance the PHPbb one would be easy, send some \x27 in the query and see what all happens. Hopefully I do not set of mod_sec here when I post this.

The hard part is, you almost have to be a hacker to know how to guard against other hackers and run exploit poc's against your own server.