Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I run an Apache webserver with lots of PHP-sites of several customers.

I tried install apache-mod_security2 after this (german) tutorial that is using these rulesets: http://www.modsecurity.org/download/modsecurity-core-rules_2.5-1.6.1.tar.gz

but if I enable that, nearly all pages have lots of warnings.

I know, it would be best, to adapt all sites, so no warnings are thrown anymore, but that is just too much work for one admin, so I would like to pull those rules down to only the obvious critical Attacks.

share|improve this question

2 Answers 2

I know your pain; unfortunately, there really is not much you can do if you're using the core rule set.

You will need to whitelist rules using SecRuleRemoveById. This can obviously get cumbersome. So, what we do in our infrastructure is note what rules are whitelisted for what CMS and whitelist all those rules based on the CMS' that are being ran on the server.

I've been told that TrustWave has specific rules that apply to specific CMS'.

share|improve this answer
    
It would be great to get a ruleset that covers most standard-attacks, but at TrustWave one 200$ license must be purchased for each web site domain! I could not afford that for a server with about 500 domains. Are there any other free rulesets? –  rubo77 Feb 4 '13 at 7:44
    
Yea OWASP CRS if you don't know of that already? owasp.org/index.php/… –  josten Feb 4 '13 at 18:27

For Properly Configuring CRS with Mod Security you need to Configure:

  1. Mode of Operation (Traditional vs. Anomaly Scoring)
  2. Setting Anomaly Scoring Severity Levels
  3. Setting Anomaly Scoring Threshold Levels (Blocking)
  4. Enable/Disable Blocking
  5. Choose where to log events (Configuration ModSecurity Log Collecter (Mlogc))

Source

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.