Topic: Troubleshooting mod_security windows

[pipedevil]

Hi everybody!

I have installed mod_security2 on xampp/windows and set it up followind the README instructions.

It seems that module starts properly:

[James Blond]

That means that mod_sec is compiled with a newer version of APR than your apache is.
And mod_sec is compiled with PCRE 8.12 but your apache with 7.9.

Is mod_sec now available for xampp or did you download it here?

[pipedevil]

I've downloaded it from apachelouge.

[admin]

Did you follow the instructions in the readme and created a folder in modules and copied the two dll's ?

And did you tested it with the example in the readme ?
With only there mentioned rules.

APR is build against 2.2.19 and you are running an older version.

The warnings should not be a problem, it should work.


Steffen

[James Blond]

It would be easy to download the apache zip from this place and override the bin,include,lib and modules folder.
Ya, I know the include folder and the lib folder are not realy nessesary, but since xampp has a lot of scripts / tools to compile stuff against the includes and libs it is saver that way.

[pipedevil]

I have the same suggestion about warnings.

I strictly followed the instructions from Readme file, created "mod_security2" directory copied dll's, so file there and, "modsecurity_crs_10_config.conf" file and rules directories(including "base_rules")

Then I edited "modsecurity_crs_10_config.conf" and added following string at the end of the file:

[Steffen]

You did not follow the readme, eg: LoadFile bin/libxml2.dll , when you do this then it is not picking up the one in the created folder in modules. Do you have also a Loadfile PCRE directive ?

I asked you to test only with the mentioned rules in the readme. Not merging with other rules.

And test only with the simple config mentioned in the readme and not what you show above:

SecRuleEngine On
SecDefaultAction log,auditlog,deny,status:403,phase:2,t:lowercase,t:replaceNulls,t:compressWhitespace

SecAuditEngine RelevantOnly
SecAuditLogType Serial
SecAuditLog logs/mod_security2.log


## -- General rules --------------------

SecRule ARGS "c:/" t:normalisePathWin
SecRule ARGS "\.\./" "t:normalisePathWin,id:99999,severity:4,msg:'Drive Access'"
SecRule ARGS "d:/" t:normalisePathWin

## -- phpBB attack --------------------
SecRule ARGS:highlight "(\x27|%27|\x2527|%2527)"

Steffen

[pipedevil]

[pipedevil]

I found the tail, mod sec works fine when I enter the following address:

[Steffen]

Works here.

Only you can try is set SecRuleInheritance On in your vHost.

When it does not help, the best is you post your question at the mod_security list.

Steffen

[pipedevil]