0

Sorry if this is a "noob" mistake, which I am sure it is, but I can't figure out why ModSec is ignoring my rule exception.

Situation (Debian 10): I have a ssl secured url for Monit monitoring software, that works on www.example.com:3286 , which as verified by my Apache2 error logs, triggers modsec rule id 920350 thereby blocking my access to the Monit web GUI.

I used echo "SecRuleRemoveById 920350" >> /etc/modsecurity/modsecurity.conf to append the rule exception to modsecurity.conf (went back and verified its presence). Then restarted apache. Rule ignored.

So then, I tried adding the exception directly to the vhost of www.example.com using:

<ifModule mod_security2.c>
         SecRuleRemoveById 920350
   </ifModule>

Then restarted apache, and the exception was ignored again.

What am I missing?

Improve this question

1 Answer 1

Reset to default
0

Rule 920350 is flagged when the Host header of a request is an IP address, as opposed to a host name like example.com. Are you happy to ignore when clients connect by IP address?

Your SecRuleRemoveById rule exclusion, where is it in relation to the Include directive for the Core Rule Set? That is probably the key, here.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .