Mod_security [Suse10.0] >> apache herstart telkens.

[spirit010]

Hallo,

sinds het installeren van Mod_security restart apache iedere 40 minuten automatisch.

ik gebruik op dit moment de volgende regels:

# -----------------------------------------------------------------------------
#  Start Rules (Gerneric)
# -----------------------------------------------------------------------------

# Enforce proper HTTP requests
SecFilterSelective THE_REQUEST "!HTTP\/(0\.9|1\.0|1\.1)$"

# check for bad meta characters in User-Agent field
SecFilterSelective HTTP_USER_AGENT ".*\'"

# Require Content-Length to be provided with every POST request
SecFilterSelective REQUEST_METHOD "^POST$" chain
SecFilterSelective HTTP_Content-Length "^$"

# Don't accept transfer encodings we know we don't handle (and you don't need it anyway)
SecFilterSelective HTTP_Transfer-Encoding "!^$"

# Don't accept chunked encodings
SecFilterSelective HTTP_Transfer-Encoding "chunked"

# must have a useragent string
SecFilterSelective "HTTP_USER_AGENT|HTTP_HOST" "^$"

# Again, this is better protected by removing these functions in php.ini
SecFilterSelective ARGS "(system|exec|passthru|popen|shell_exec|proc_open|fopen|fwrite)\s*\("

# Prevent path traversal (..) attacks
SecFilter "\.\./"

# generic recursion signature
SecFilterSelective THE_REQUEST "\.\./\.\./"

# generic attack sig
SecFilterSelective THE_REQUEST "cd\x20*\;(cd|\;|echo|perl|python|rpm|yum|apt-get|emerge|lynx|links|mkdir|elinks|cmd|pwd|wget|id|uname|cvs|svn|(s|r)(cp|sh)|rexec|smbclient|t?ftp|ncftp|curl|telnet|gcc|cc|g\+\+|\./)"

# generic filter to prevent SQL injection attacks
SecFilter "[[:space:]]+(select|grant|delete|insert|drop|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]+[[:space:]]+(from|into|table|database|index|view)[[:space:]]+[A-Z|a-z|0-9|\*| |\,]"

# generic PHP remote file inclusion attack
SecFilter "\.php\?" chain
SecFilter "(http|https|ftp)\:/" chain
SecFilter "cmd=(cd|\;|perl|python|rpm|yum|apt-get|emerge|lynx|links|mkdir|elinks|cmd|pwd|wget|id|uname|cvs|svn|(s|r)(cp|sh)|rexec|smbclient|t?ftp|ncftp|curl|telnet|gcc|cc|g\+\+|\./)"

# generic sig for more bad PHP functions
SecFilterSelective THE_REQUEST "chr\(([0-9]{1,3})\)"
SecFilterSelective THE_REQUEST "chr\([0-9a-fA-Fx]+\)"

# SQL injection attacks
SecFilter "delete[[:space:]]+from"
SecFilter "insert[[:space:]]+into"
SecFilter "select.+from"

# SQL injection in cookies
SecFilterSelective COOKIE_sessionid ".*(select|grant|delete|insert|drop|do|alter|replace|truncate|update|create|rename|describe)[[:space:]]+[A-Z|a-z|0-9|\*||\,]+[[:space:]]+(from|into|table|database|index|view)"

# -----------------------------------------------------------------------------
#  Start Rules (experimental)
# -----------------------------------------------------------------------------

# experimental generic remote download sig foo IP or FQDN or foo http/https/ftp://whatever
SecFilterSelective THE_REQUEST "(perl|t?ftp|links|elinks|lynx|ncftp|(s|r)(cp|sh)|wget|curl|cvs|svn).*\x20((http|https|ftp)\:/|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|.*[A-Za-z|0-9]\.[a-zA-Z]{2,4}/)"
SecFilterSelective THE_REQUEST "( |\;|/|\'|,|\&|\=|\.)((s|r)(sh|cp)) *(.*\@.*|(http|https|ftp)\:/|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|.*[A-Za-z|0-9]\.[a-zA-Z]{2,4}/)"

# XSS atacks (HTML/Javascript injection)
# SecFilter "<(.|\n)+>"
# deactivated since it causes problems with Serendipity when creating new entries
# this is the error message: mod_security-message: Access denied with code 406. Pattern match "<(.|\n)+>" at POST_PAYLOAD.
# ff@nodomain.cc, 02.08.2005 

en in de httpd.conf heb ik het volgende toegevoegd:

<IfModule mod_security.c>

    # Only inspect dynamic requests
    # (YOU MUST TEST TO MAKE SURE IT WORKS AS EXPECTED)
    # SecFilterEngine DynamicOnly

    # Turn the filtering engine On or Off
    SecFilterEngine On

    # Reject requests with status 404
    SecFilterDefaultAction "deny,log,status:404"

    # Some sane defaults
    SecServerResponseToken Off
    SecFilterScanPOST Off
    SecFilterCheckURLEncoding On
    SecFilterCheckCookieFormat On
    SecFilterCheckUnicodeEncoding Off

    # If you want to scan the output, uncomment these
    # SecFilterScanOutput On
    # SecFilterOutputMimeTypes "(null) text/html text/plain"

    # Accept almost all byte values
    SecFilterForceByteRange 1 255

    # Only record the interesting stuff
    SecAuditEngine RelevantOnly
    SecAuditLog /var/log/apache2/audit_log

    # You normally won't need debug logging
    SecFilterDebugLevel 0
    SecFilterDebugLog /var/log/apache/modsec_debug_log

    # Include rules
    Include /etc/apache2/modsecurity/filter.conf

</IfModule> 

Iemand een idee?

[mrleejohn]

Idee.... kijk eens in de logs.

[spirit010]

Wat denk je dat ik dat niet gedaan heb!! Staat dus niets bijzonders in.

apache error_log

[Wed Oct 04 16:08:26 2006] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec2)
[Wed Oct 04 16:08:26 2006] [notice] mod_security/1.9.4 configured
[Wed Oct 04 16:08:26 2006] [notice] mod_python: Creating 32 session mutexes based on 150 max processes and 0 max threads.
[Wed Oct 04 16:08:26 2006] [notice] Apache/2.0.54 (Linux/SUSE) configured -- resuming normal operations 

[Wido]

Draai je nog een control panel?

[mrleejohn]

Die apache restarts moeten ergens in de logs staan. Kijk eens in cron of idd evt in je webadmin-package.

[spirit010]

Draai je nog een control panel?

plesk draai ik.

Die apache restarts moeten ergens in de logs staan.

ja dat zou je denken idd. Ik kan iig niets vinden dat het gelogt word

[mrleejohn]

Ennuh.... hoe weet je dan dat ie restart?

[spirit010]

In het log gedeelte in mijn eerste post zie je dat Mod_suexec etc telkens geladen wordt, kreeg telkens meldingen van watchdog (psa)

Kan mijn voorgaande post niet meer editten.

Maar naar een reboot draait alles zoals het hoort, apache restart niet meer!

[mrleejohn]

> In het log gedeelte in mijn eerste post zie je dat Mod_suexec etc telkens geladen wordt

Betekent niet dat apache herstart

> Maar naar een reboot draait alles zoals het hoort, apache restart niet meer!

Windows-oplossing

[spirit010]

kan zijn, echter geeft apache diezelfde logs als je apache herstart, en van Watchdog kreeg ik meldingen dat apache down was en daarom herstart is.

(Ja ja ik weet watchdog is *** ) Hoe dan ook het probleem is verholpen door de Windhoos oplossing

--edit--

Heeft er iemand nog aanvullingen op deze regels, tips wat en waarom ik juist nog wat anders erin moetzetten zijn ook welkom?!