Wikipedia

A compact wiki for email, FTP, MySQL, SSL, cron jobs, apps, statistics and more. Find step-by-step guides, tips and technical details here.

Control the web application firewall (mod_security)
Wiki topic
Security

Control the web application firewall (mod_security)

The web application firewall checks every request to your website before it reaches your application and detects typical attack patterns such as SQL injection, cross-site scripting or attempts to read configuration files. It runs on the server as mod_security2. In the "Security" tab of your web space you set the protection mode, see the hits from your domain's error log and add exceptions whenever a rule blocks a harmless request from your application.

Steps

  1. 1 Open the "Security" tab in the web space of your domain – the top shows the protection mode, the active rules and the hits of the last 24 hours.
  2. 2 Choose the protection mode: "Active" blocks suspicious requests, "Log only" just writes them to the log, "Off" disables the check.
  3. 3 Click "Save" – the vHost of your domain is updated and Apache is reloaded. The change takes effect immediately for HTTP and HTTPS.
  4. 4 Under "Attacks" you see what was flagged: time, source IP, rule ID, target path, severity and whether the request was blocked or only logged.
  5. 5 Enter your own IP address ("Use current IP") and switch on "Only my hits" – that separates your own false alarms from real attacks.
  6. 6 If a rule blocks something harmless: click the exception icon on the right of that row – rule ID and path are copied into the "Exceptions" form. Add a reason and save.
  7. 7 An exception without a path applies to the whole domain, a path ending with a slash applies to everything below it, otherwise it applies to exactly that one file.

Was this content helpful?

·