Disable rules by id for Mod security with Atomic rules

[Oto Tortorella]

Hello there,

I've mod_security active with the Atomic Ruleset and I need to disable some rules using their ID.
I go to "Web Application Firewall" into the website overview page and i put the rule ID into the field "Switch off security rules" -> "Security rule IDs" but nothing happens. The rules remain active and continue to be used to block the event.

If i try to search in the field below, "Tags", nothing shows up.

Does this interface work for the Atomic ruleset?
If not, why is it enabled?

Cheers
Oto Tortorella

 

[Amin Taheri]

You can do this from the command line (assuming you are using ASL)

you would use the asl command with one of the following flags

-dr --disable-rule Disable modsec rule(s) by signature ID
Usage: -dr 123456[,123457,...]

-drv --disable-rule-vhost Disable modsec rule(s) by vhost(s)
Usage: -drv 123456[,123457] foo.bar.com[,bar.foo.com,...]
Each rule id will be disabled on each vhost



Then restart httpd

 

[Oto Tortorella]

Yes thanks, but how can the customer disable a problematic rule?
I was confident that the web interface to the rule management was functional.
Atomic rules are very well done and infrequently cause problems, but sometimes they do.

 

[Amin Taheri]

Honestly allowing the customer (end user) to disable rules is a bad idea in my mind - they could disable something truly intended to protect the server and provide critical functionality. I would recommend that you manage the rules and if they require something have them contact you.

 

[Oto Tortorella]

I have experieced resellers and they are perfectly able to manage this kind of things. The server is their so they should be able to manage that.
The other point is that if the web managing interface is present it should work or should be disabled when Atomic is selected.
The way it works now seems buggy to me.

Thank you for your reply.

 

[Red Paint]

Completely agree with you Oto, this interface should be disabled if it does nothing, right now it causes confusion where you expect a rule to be disabled and nothing happens.

 

[Andrew Penry]

I though I was having this same issue. I found that putting the ID in the Security rule IDs box and clicking Apply did not cause the rule to be instantly disabled. Something needed restarting (not sure if it was apache, or nginx, or something else). By switching that domain to Detection Only and then right back to On, the rule was disabled for that domain.

 

[Oto Tortorella]

I also find that, recently, it started to work. Putting a rule ID in the box disables the rule even if you are using Atomic.
Cheers!