Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I asked my host to switch on the log file, and it have increasing a lot since then. Its have been increasing with 700 mb for the last week. It’s filled with error messages related to Mod Security.

Most of them look like this:

[Thu Jun 20 16:49:01 2013] [error] [client 157.55.33.88] ModSecurity: Warning. Match of "within %{tx.allowed_methods}" against "REQUEST_METHOD" required. [file "/etc/httpd/conf.d/modsecurity-crs/base_rules/modsecurity_crs_30_http_policy.conf"] [line "30"] [id "960032"] [msg "Method is not allowed by policy"] [data "GET"] [severity "CRITICAL"] [tag "POLICY/METHOD_NOT_ALLOWED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A6"] [tag "OWASP_AppSensor/RE1"] [tag "PCI/12.1"] [hostname "www.url.se"] [uri "/page-pr-2317.html"] [unique_id "UcMWXcCoEXsAAE4QF8QAAAAh"]

[Thu Jun 20 16:49:01 2013] [error] [client 157.55.33.88] ModSecurity: Warning. Match of "within %{tx.allowed_http_versions}" against "REQUEST_PROTOCOL" required. [file "/etc/httpd/conf.d/modsecurity-crs/base_rules/modsecurity_crs_30_http_policy.conf"] [line "77"] [id "960034"] [msg "HTTP protocol version is not allowed by policy"] [data "HTTP/1.1"] [severity "CRITICAL"] [tag "POLICY/PROTOCOL_NOT_ALLOWED"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A6"] [tag "PCI/6.5.10"] [hostname "www.url.se"] [uri "/page-pr-2317.html"] [unique_id "UcMWXcCoEXsAAE4QF8QAAAAh"]

[Thu Jun 20 16:49:02 2013] [error] [client 95.211.116.112] ModSecurity: Warning. Match of "within %{tx.allowed_methods}" against "REQUEST_METHOD" required. [file "/etc/httpd/conf.d/modsecurity-crs/base_rules/modsecurity_crs_30_http_policy.conf"] [line "30"] [id "960032"] [msg "Method is not allowed by policy"] [data "GET"] [severity "CRITICAL"] [tag "POLICY/METHOD_NOT_ALLOWED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A6"] [tag "OWASP_AppSensor/RE1"] [tag "PCI/12.1"] [hostname "www.url.se"] [uri "/images/image.jpg"] [unique_id "UcMWXsCoEXsAACkYfrAAAAAN"]

[Thu Jun 20 16:49:02 2013] [error] [client 95.211.116.112] ModSecurity: Warning. Match of "within %{tx.allowed_http_versions}" against "REQUEST_PROTOCOL" required. [file "/etc/httpd/conf.d/modsecurity-crs/base_rules/modsecurity_crs_30_http_policy.conf"] [line "77"] [id "960034"] [msg "HTTP protocol version is not allowed by policy"] [data "HTTP/1.1"] [severity "CRITICAL"] [tag "POLICY/PROTOCOL_NOT_ALLOWED"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A6"] [tag "PCI/6.5.10"] [hostname "www.url.se"] [uri "/images/image.jpg"] [unique_id "UcMWXsCoEXsAACkYfrAAAAAN"]

[Tue Jun 25 20:18:18 2013] [error] [client 85.224.51.23] ModSecurity: Warning. Match of "within %{tx.allowed_methods}" against "REQUEST_METHOD" required. [file "/etc/httpd/conf.d/modsecurity-crs/base_rules/modsecurity_crs_30_http_policy.conf"] [line "30"] [id "960032"] [msg "Method is not allowed by policy"] [data "GET"] [severity "CRITICAL"] [tag "POLICY/METHOD_NOT_ALLOWED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A6"] [tag "OWASP_AppSensor/RE1"] [tag "PCI/12.1"] [hostname "www.url.se"] [uri "/images/image2.gif"] [unique_id "Ucne6sCoEXsAAHXDKMwAAAA9"]

[Tue Jun 25 20:17:58 2013] [error] [client 81.234.144.108] ModSecurity: Warning. Match of "within %{tx.allowed_methods}" against "REQUEST_METHOD" required. [file "/etc/httpd/conf.d/modsecurity-crs/base_rules/modsecurity_crs_30_http_policy.conf"] [line "30"] [id "960032"] [msg "Method is not allowed by policy"] [data "POST"] [severity "CRITICAL"] [tag "POLICY/METHOD_NOT_ALLOWED"] [tag "WASCTC/WASC-15"] [tag "OWASP_TOP_10/A6"] [tag "OWASP_AppSensor/RE1"] [tag "PCI/12.1"] [hostname "www.url.se"] [uri "/page2-p-500.html"] [unique_id "Ucne1sCoEXkAAE@LBx8AAABK"]

I asked my host and they told me that some of the error massage might depend on the visitor use old browsers that don’t have the protocol HTTP/1.1.

They also told me that the settings in mod_security should allow GET, HEAD, POST and OPTIONS, but for some reason it gives error message for this anyway. They haven’t told me why, and it doesn’t look like that are going to investigate it. I saw that one of the IP belongs to Bingbot.

I havent run into any error message myself on the acctual site, but I can see my IP in the error log.

I don’t know much about mod_security so I need some in guidance. I found a similar question at http://serverfault.com/questions/394052/broken-urls-after-enabling-mod-security

But since Im on a shared host I can’t change any settings. I can only turn on and of mod_security.

So can anyone tell me what might cause these error massages?

Should I turn of mod_security?

share|improve this question

3 Answers 3

ModSecurity is a kind of Web-level firewall (so, at least, claims the manual). Its point is to allow you to establish filters for requests tailored to your specific application. Being able to turn it on and off but not to alter its configuration nullifies its benefits. So my advice would be to deactivate it. It is like having a steel door on your house, but giving the key to a doorkeeper who will decide when it is open and when it is closed without consulting you.

In your situation, "something" in the ModSecurity configuration makes it uncomfortable, but only to the point of emitting warnings, which thus make the logs grow but do not block requests -- explaining why, from your browser, things seem fine.

share|improve this answer

ModSecurity-CRS Rules will not work until we have fine tuned rules according to our requirements. The Log entries give us three piece of information.

  1. tx.allowed_methods
  2. tx.allowed_http_versions
  3. modsecurity-crs/base_rules/modsecurity_crs_30_http_policy.conf

So what are tx.allowed_methods and tx.allowed_http_version these are the transactions variables we are using to define allowed HTTP methods and version for our application and modsecurity_crs_30_http_policy.conf will use these variables for policy implementation.

We need to initialize these variables and following rules define these variables

SecAction "phase:1,t:none,nolog,pass, \
setvar:'tx.allowed_methods=GET HEAD POST OPTIONS', \
setvar:'tx.allowed_request_content_type=application/x-www-form-urlencoded
multipart/form-data text/xml application/xml', \
setvar:'tx.allowed_http_versions=HTTP/0.9 HTTP/1.0 HTTP/1.1', \
setvar:'tx.restricted_extensions=.asa .asax .ascx .axd .backup .bak .bat
.cdx .cer .cfg .cmd .com .config .conf .cs .csproj .csr .dat .db .dbf .dll
.dos .htr .htw .ida .idc .idq .inc .ini .key .licx .lnk .log .mdb .old .pass .pdb .pol .printer .pwd .resources .resx .sql .sys .vb .vbs .vbproj
 .vsdisco .webinfo .xsd .xsx', \
setvar:'tx.restricted_headers=Proxy-Connection Lock-Token Content-Range 

The Second rule uses these define variables in the rules.

SecRule REQUEST_BASENAME "\.(.*)$" "chain,capture,setvar:tx.extension=.%{tx.1}/,phase:2,t:none,t:urlDecodeUni,t:lowercase,block,msg:'URL file extension is restricted by policy',severity:'2',rev:'2',ver:'OWASP_CRS/2.2.9',maturity:'9',accuracy:'9',id:'960035',tag:'OWASP_CRS/POLICY/EXT_RESTRICTED',tag:'WASCTC/WASC-15',tag:'OWASP_TOP_10/A7',tag:'PCI/6.5.10',logdata:'%{TX.0}'"
        SecRule TX:EXTENSION "@within %{tx.restricted_extensions}" "t:none,setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.warning_anomaly_score},setvar:tx.%{rule.id}-OWASP_CRS/POLICY/EXT_RESTRICTED-%{matched_var_name}=%{matched_var}"
share|improve this answer

From your question it looks like this question is for an Apache server. I'm an expert on IIS, but don't know Apache, so I can just speculate some things here. Many things are the same though.

The ModSecurity is some kind of firewall, as Thomas already pointed out. And you said you can't change the configuration. Well, you can ask the provider to give you the exact configuration. With that information you can decide if this rule set is adequate for you or not. If not, then turn it off.

From the log file, it seems that there are plenty of false-positive detections (not sure about your site load). Either these are all attacks or the rule set is totally wrong and it's blocking many legitimate requests.

Try to get the exact configuration and try to understand the exact meaning of each configuration line. If you spot any error, talk with the provider. They probably want to fix wrong configurations for their other clients too.

Actually this kind of question is not much security related, I think it would better fit to serverfault or so, but I see you posted the same question there already and it was closed (on hold) as "off-topic", because they say if you cannot reconfigure it, it's not administration-related. (I don't fully agree with that, but anyway.)

share|improve this answer
    
Thank you both @ThomasPornin and http for your answers, I really do appreciate it. I have been on my host but they will not look into this at all. They have been bit of a pain lately so Im actually thinking of switching host. I will ask for the configuration. But I think they use the default configurations, since they told me that it has to be the default due to upgrades. –  Fredrik Johansson Jul 9 '13 at 0:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.