ConfigServer ModSec Control not working in some cases

[Carlos Martini]

Hello,

We have some security rules deactivated in "ConfigServer ModSec Control". The problem is that even with the rules disabled there are still clients being blocked in our firewall because of them.

The rules are: 970901 and 981205

In our logs:

[Tue Feb 28 12:42:31 2012] [error] [client 200.193.0.106] ModSecurity: Access denied with code 403 (phase 4). Pattern match "^5\\\\d{2}$" at RESPONSE_STATUS. [file "/usr/local/apache/conf/modsecurity-crs/base_rules/modsecurity_crs_50_outbound.conf"] [line "53"] [id "970901"] [rev "2.2.2"] [msg "The application is not available"] [severity "ERROR"] [tag "WASCTC/WASC-13"] [tag "OWASP_TOP_10/A6"] [tag "PCI/6.5.6"] [hostname "www.XXXXXXXXXXX"] [uri "/favicon.ico"] [unique_id "T0z15zIWJcIACpn6LJoAAAAB"]

[Tue Feb 28 12:42:31 2012] [error] [client 200.193.0.106] ModSecurity: Warning. Operator GE matched 0 at TX:outbound_anomaly_score. [file "/usr/local/apache/conf/modsecurity-crs/base_rules/modsecurity_crs_60_correlation.conf"] [line "40"] [id "981205"] [msg "Outbound Anomaly Score Exceeded (score 0): The application is not available"] [hostname "www.XXXXXXXXXXX"] [uri "/favicon.ico"] [unique_id "T0z15zIWJcIACpn6LJoAAAAB"]

Please, what may be happening?

[appds]

Same issue here.

Anyone knows how to fix it?

[Sergio]

What option did you use to white list that rules?

Sergio

[Carlos Martini]

Hello,

Plugins > ConfigServer ModSec Control

Selected domain > Modify user whitelist

mod_security rule ID list:

970901
981205

Saved whitelist.

The same way we deactivated several other rules.

However, it seems that this problem only happens with these two rules.

A mod_security issue, maybe... ?

[Sergio]

Why don't you try to white list the rule via modsec2.whitelist.conf, using something like the example:

<LocationMatch /path_to_your_file.php>
SecRuleRemoveById 970901
SecRuleRemoveById 981205
</LocationMatch>

Sergio

[Carlos Martini]

Hello,

Well, I know how to whitelist manually.

But the WHM plugin exists to make our lives easier, right? ;-)

The strange is that this isn't working only for these 2 rules...

[chirpy]

Make sure that the whitelist line "Include /usr/local/apache/conf/modsec2.whitelist.conf" in modsec2.user.conf is the very first line in that file and then restart httpd. Other than that, I don't know why it wouldn' work.

[Carlos Martini]

Sorry, I think you don't understand the case.

ConfigServer ModSec Control not working ONLY WITH 2 OR 3 RULES.

For ALL other rules, it works fine, normally.

There are no configuration error.

[chirpy]

Then I have no idea why ModSecurity would not be ignoring the rules you have told it to ignore.

[Sergio]

Carlos,
can you share what is CMC showing you on the log for this rules?

Sergio