Skip to main content
Information Security

Return to Answer

Post Undeleted by Steffen Ullrich
deleted 346 characters in body
Source Link
Steffen Ullrich
Steffen Ullrich
  • 207.6k
  • 30
  • 416
  • 481

... [tag "paranoia-level/1"]

Having only the names of the config files instead of their actual content is only barely useful, since one can only guess what the content of the config might be.

The log message shows that paranoia levelCheck SecDefaultAction in your crs-setup.conf and make sure it actually is set to 1deny and not only log (which is usually the default), i.e. something like this

SecRule REQUEST_HEADERS:Referer|REQUEST_HEADERS:User-Agent "@pmFromFile lfi-os-files.data" \
   SecDefaultAction "id"phase:9301211,\
    ...
    tag:'paranoia-level/2'log,\auditlog,deny,status:403"

The specific rule 930121 instead will block only with paranoia level 2 and higher.

To understand these paranoia levels see Working with Paranoia Levels.

... [tag "paranoia-level/1"]

The log message shows that paranoia level is set to 1.

SecRule REQUEST_HEADERS:Referer|REQUEST_HEADERS:User-Agent "@pmFromFile lfi-os-files.data" \
    "id:930121,\
    ...
    tag:'paranoia-level/2',\

The specific rule 930121 instead will block only with paranoia level 2 and higher.

To understand these paranoia levels see Working with Paranoia Levels.

Having only the names of the config files instead of their actual content is only barely useful, since one can only guess what the content of the config might be.

Check SecDefaultAction in your crs-setup.conf and make sure it actually is set to deny and not only log (which is usually the default), i.e. something like this

SecDefaultAction "phase:1,log,auditlog,deny,status:403"
Post Deleted by Steffen Ullrich
Source Link
Steffen Ullrich
Steffen Ullrich
  • 207.6k
  • 30
  • 416
  • 481

... [tag "paranoia-level/1"]

The log message shows that paranoia level is set to 1.

SecRule REQUEST_HEADERS:Referer|REQUEST_HEADERS:User-Agent "@pmFromFile lfi-os-files.data" \
    "id:930121,\
    ...
    tag:'paranoia-level/2',\

The specific rule 930121 instead will block only with paranoia level 2 and higher.

To understand these paranoia levels see Working with Paranoia Levels.