i ve a strange problem
i install prestashop library on symfony (iq2i/prestashop-webservice-bundle)
i can connect to two internet websites (one is http the other https)
but on the third i got the error:
{"message":"This call to PrestaShop Web Services returned an unexpected HTTP status of:403"}
i ve this website install localy too on my computer with the same files as the remote one, and i can connect with symfony to my local website, but nope on the internet one...
i check rights, .htaccess ...
so i enable the debug and i got:
You don't have permission to access /api/products
an idea please ?
if you have got the error:
[Fri Jun 15 16:28:52 2018] [error] [client 157.108.59.137] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_HEADERS. [file "/usr/local/apache2/conf/modsecurity/base_rules/modsecurity_crs_21_protocol_anomalies.conf"] [line "65"] [id "960009"] [rev "2.1.1"] [msg "Request Missing a User Agent Header"] [severity "NOTICE"] [tag "PROTOCOL_VIOLATION/MISSING_HEADER_UA"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"]
with OVH provider
on the root folder, you ve got a filename .ovhconfig
you have to add the following line:
modsecurity == WAF === http.firewall=security
Related
My website is hosted on a virtual server that runs Apache and Plesk. I would like to integrate a chat from livezilla.de on my website. The chat server runs on my server as well.
To secure my system, I have activated plesk_modsecurity. However, that particular module bans the IP address of each user of the chat because the chat pings the server quite frequently.
Is it possible to (a) allow requests from the chat to the chat server and vice versa with no restriction while (b) any other requests are still handled by the module with the appropriate restrictions?
Or would you recommend another solution?
The following list shows some of the errors raised by the modsecurity rules.
Message: Rule 7f7e7ac18c30 [id "340159"][file "/etc/apache2/modsecurity.d/rules/tortix/modsec/50_plesk_basic_asl_rules.conf"][line "114"] - Execution error - PCRE limits exceeded (-8): (null).
Message: Rule 7f7e7abb2c60 [id "340157"][file "/etc/apache2/modsecurity.d/rules/tortix/modsec/50_plesk_basic_asl_rules.conf"][line "135"] - Execution error - PCRE limits exceeded (-8): (null).
Apache-Error: [file "apache2_util.c"] [line 273] [level 3] [client XX.XXX.XX.XXX] ModSecurity: Rule 7f7e7ac18c30 [id "340159"][file "/etc/apache2/modsecurity.d/rules/tortix/modsec/50_plesk_basic_asl_rules.conf"][line "114"] - Execution error - PCRE limits exceeded (-8): (null). [hostname "mydomain.tld"] [uri "/livezilla/server.php"] [unique_id "WzIClVXWzdsAABSrkdgAAAAE"]
Apache-Error: [file "apache2_util.c"] [line 273] [level 3] [client XX.XXX.XX.XXX] ModSecurity: Rule 7f7e7abb2c60 [id "340157"][file "/etc/apache2/modsecurity.d/rules/tortix/modsec/50_plesk_basic_asl_rules.conf"][line "135"] - Execution error - PCRE limits exceeded (-8): (null). [hostname "mydomain.tld"] [uri "/livezilla/server.php"] [unique_id "WzIClVXWzdsAABSrkdgAAAAE"]
Apache-Handler: proxy:unix:///var/www/vhosts/system/mydomain.tld/php-fpm.sock|fcgi://127.0.0.1:9000
Stopwatch: 1530004117657831 96698593 (- - -)
Stopwatch2: 1530004117657831 96698593; combined=96528507, p1=2, p2=96528499, p3=2, p4=1, p5=3, sr=0, sw=0, l=0, gc=0
Producer: ModSecurity for Apache/2.9.2 (http://www.modsecurity.org/); 201806211447.
Server: Apache
Engine-Mode: "ENABLED"
Try LocationMatch directive for ModSecurity. Browse to Tools & Settings > Web Application Firewall (ModSecurity) > Settings > Custom and add the following directives:
<LocationMatch "/livezilla/">
SecRuleEngine Off
</LocationMatch>
It will disable ModSecurity for URIs like /livezilla/server.php
my server return 405, Method Not Allowed when request to https with http_method DELETE, but request to http is ok. Can anyone please help ?
Server Environment
Apache 2.4.29
DirectAdmin 1.52.1
OS: centOS release 6.9 (Final)
Thanks
Add Error log
[Wed Jan 03 11:57:38.331926 2018] [allowmethods:error] [pid 8569] [client 171.97.62.152:59633] AH01623: client method denied by server configuration: 'DELETE' to /home/------/domains/------.com/private_html/
The sure way to fix this is to learn why Apache denies the requests in your particular case. You can learn this from its error logs.
In my case, tail -f /usr/local/apache/logs/error_log
gave this:
[Tue 2 08:39:52.570672 2018] [:error] [pid 32076:tid 140086307448576]
[client 93.125.93.77] ModSecurity: Access denied with code 501 (phase 2).
Match of "rx ^((?:(?:POS|GE)T|OPTIONS|HEAD))$" against "REQUEST_METHOD"
required. [file "/usr/local/apache/conf/modsec-imh/01_base_rules.conf"] [line
"32"] [id "960032"] [msg "Method is not allowed by policy"] [severity
"CRITICAL"] [tag "POLICY/METHOD_NOT_ALLOWED"] [hostname "104.244.122.237"]
[uri "/products/order/items/45"] [unique_id "V96LGGj0eu0AAH1MR8sAAACB"]
It mentions a security rule and the file it's coming from:
/usr/local/apache/conf/modsec-imh/01_base_rules.conf. Editing that file solved my problem smoothly.
I have a cPanel server with apache 2.4 and Maldetect, ClamAV. I want to have realtime malware scanner on server to block hackers from uploading malicious files on server. What i meant is when someone uploads a file, apache will invoke the scanner using mod-security 2.9 and scan the uploaded file.
If it's found as malware - should get rejected.
If it's found good file - should upload to correct destination.
I have tried to do this with following settings as described in https://www.rfxn.com/appdocs/README.maldetect
To enable upload scanning with mod_security2 you must set enable the public_scan option
in conf.maldet (public_scan=1) then add the following rules to your mod_security2
configuration. These rules are best placed in your modsec2.user.conf file on cpanel servers
or at the top of the appropraite rules file for your setup.
/usr/local/apache/conf/modsec2.user.conf (or similar mod_security2 rules file):
SecRequestBodyAccess On
SecRule FILES_TMPNAMES "#inspectFile /usr/local/maldetect/hookscan.sh" \
"id:'999999',log,auditlog,deny,severity:2,phase:2,t:none"
If using ModSecurity >=2.9, you should set 'SecTmpSaveUploadedFiles On' before the
'SecRule FILES_TMPNAMES' line.
A restart of the Apache service is required following these changes.
But the problem is all the files are getting rejected by doing this, even good files. Is there anything wrong with the above setup?
# cat /usr/local/apache/conf/modsec2.user.conf
### UPLOAD PARAMETERS BEGIN ####
SecUploadDir /tmp
SecTmpDir /tmp/
SecDataDir /tmp/
SecUploadKeepFiles RelevantOnly
### UPLOAD PARAMETERS END ####
SecRequestBodyAccess On
SecTmpSaveUploadedFiles On
SecRule FILES_TMPNAMES "#inspectFile /usr/local/maldetect/hookscan.sh" \
"id:'999999',log,auditlog,deny,severity:2,phase:2,t:none"
Following is the error in logs
[Sun Mar 05 21:11:35.936553 2017] [:error] [pid 9800] [client x.x.x.x] ModSecurity: Access denied with code 406 (phase 2). File "/tmp/20170305-211135-WLxNz#kP#rKcABIc7ZF3lAAAAAM-file-SfujtQ" rejected by the approver script "/usr/local/maldetect/hookscan.sh": Linux Malware Detect v1.5 [file "/usr/local/apache/conf/modsec2.user.conf"] [line "13"] [id "999999"] [severity "CRITICAL"] [hostname "x.x.x.x"] [uri "/test.php"] [unique_id "WLxNz#kP#rKcABIc7ZF3lAAAAAM"]
[Sun Mar 05 21:11:44.511418 2017] [:error] [pid 9526] [client x.x.x.x] ModSecurity: Access denied with code 406 (phase 2). File "/tmp/20170305-211144-WLxN2EJsvK1FL3paCDmxrgAAAAE-file-iQx2zR" rejected by the approver script "/usr/local/maldetect/hookscan.sh": Linux Malware Detect v1.5 [file "/usr/local/apache/conf/modsec2.user.conf"] [line "13"] [id "999999"] [severity "CRITICAL"] [hostname "x.x.x.x"] [uri "/test.php"] [unique_id "WLxN2EJsvK1FL3paCDmxrgAAAAE"]
I had this issue too. Problem is this line:
SecTmpSaveUploadedFiles On
Try to remove it from the rule.
in our current environment, we have an internet facing web application and all the incoming traffic to the same is routed through an apache reverse proxy. On this reverse proxy we have configured ModSecurity as well.
Now, some of our inbound requests have content-type=text/plain. All these requests are being blocked by ModSec rule set with below logs :
[Tue Jan 10 11:14:31 2017] [error] [client 175.45.116.65] ModSecurity: [file "/etc/httpd/conf/crs/activated_rules/modsecurity_crs_30_http_policy.conf"] [line "64"] [id "960010"] [rev "2"] [msg "Request content type is not allowed by policy"] [data "text/plain"] [severity "CRITICAL"] [ver "OWASP_CRS/2.2.6"] [maturity "9"] [accuracy "9"] [tag "OWASP_CRS/POLICY/ENCODING_NOT_ALLOWED"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"] Access denied with code 403 (phase 1). Match of "rx ^%{tx.allowed_request_content_type}$" against "TX:0" required. [hostname "hadToRemove"] [uri "hadToRemove"] [unique_id "WHQnZwoMD1QAACBlB70AAAAN"]
Now if we want to allow text/plain as an acceptable content-type, how should we add that. We already have a conf file where we have disabled/customized some rules. I just dont know how to add this one.
PS: according this post (https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/208), this issue is already fixed but for that we will have upgrade our ruleset.
You should have a modsecurity_crs_10_setup.conf file where these types of things are configured and then used by the various other rules.
That file has a line like the following:
#
# Set the following policy settings here and they will be propagated to the 30 rules
# file (modsecurity_crs_30_http_policy.conf) by using macro expansion.
# If you run into false positves, you can adjust the settings here.
#
SecAction \
"id:'900012', \
phase:1, \
t:none, \
setvar:'tx.allowed_methods=GET HEAD POST OPTIONS', \
setvar:'tx.allowed_request_content_type=application/x-www-form-urlencoded|multipart/form-data|text/xml|application/xml|application/x-amf|application/json', \
You can alter that last line to allow text/plain:
setvar:'tx.allowed_request_content_type=application/x-www-form-urlencoded|multipart/form-data|text/xml|application/xml|application/x-amf|application/json|text/plain', \
And then restart Apache.
I am gettign this error code on submititng the form.
That form have rich text editors and I am assuming that is the problem.
So from erorr log I found out this message:
[Sat Sep 13 18:45:11 2014] [error] [client xx.xx.xx.xx] ModSecurity: [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1023"] [id "350147"] [rev "147"] [msg "Atomicorp.com WAF Rules: Potentially Untrusted Web Content Detected"] [data "10862"] [severity "CRITICAL"] Access denied with code 403 (phase 2). Match of "rx ((?:submit(?:\\\\+| )?(request)?(?:\\\\+| )?>+|<<(?:\\\\+| )remove|(?:sign ?in|log ?(?:in|out)|next|modifier|envoyer|add|continue|weiter|account|results|select)(?:\\\\+| )?>+)$|^< ?\\\\??(?: |\\\\+)?xml|^<samlp|^>> ?$)" against "REQUEST_URI" required. [hostname "example.com"] [uri "/add-product/"] [unique_id "VBTzJkJVoVIAAGGuSEgAAAAT"]
So what is this error and can anyone tell me how to fix this?
After this error being displayd every access to the server is blocked from 10 to 15 minutes?
The client have full access to server so that is not the problem.
It is standard LAMP environment.
Thanks!