Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm trying to get my users lat and lng from their address using google's geocoding api but when mod security is enabled it prevents it and the script timesout. How can I add an exception by ip or domain for this or just remove whatever configuration that makes mod_security do this? I am using the OWASP ModSecurity Core Rule Set Project

UPDATE:

[Sun Jun 26 13:13:14 2011] [error] [client 174.252.196.188]
 ModSecurity: Unable to retrieve collection (name "ip", key "174.252.196.188_fc2ccdca4bf1fc8585b77c1444811dedd59da612").
 Use SecDataDir to define data directory first. [hostname mydomain.com"] [uri "/admin/geocoding.php"]
 [unique_id "EIpfP38AAAEAAA2eAT0AAAAK"]

I added the line

SecDataDir /var/log/apache/modsec_SecDataDir

but now I don't get anything in the error log but the same behaviour!

share|improve this question
    
What's in the logs for those requests? –  Bill Weiss Jun 26 '11 at 3:51
    
@Bill Weiss I added the log line to the question –  Neo Jun 26 '11 at 21:00
add comment

1 Answer

If you can provide the lines in your log file showing what rule is causing the block it would be helpful.
An option would be to use SecRuleRemoveByID to disable the rule that is causing your block. Alternatively you can white list IP address using a number of different techniches which are listed here

share|improve this answer
    
I added the line of log file showing the event! –  Neo Jun 26 '11 at 21:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.