Resolved Mod_Security Error Response body too large

[BWMC]

Hello,

I use Plesk on Ubuntu and installed Mod_Security with Comodo ModSecurity subscription.

I also set "Predefined Set Of Values" to THOROUGH.

For large pages it returns an Error 500 page.

The mod_security log file says:
Message: Output filter: Response body too large (over limit of 524288, total not specified).

How can I increase the limit?

I tried to add a vhost.conf file but it seems to be ignored. I'm not knowledgeable enough to fully understand this whole issue.

My current workaround is to set from THOROUGH to TRADEOFF.

Thanks for your help!

 

[IgorG]

To fix the issue, try to add the following lines in Domains >domain.com > Apache & nginx Settings > Additional directives for HTTP:

<IfModule mod_security2.c>
SecResponseBodyLimit 546870912
</IfModule>

And pressed apply.

 

[BWMC]

Awesome!

From what I can tell, it worked!

Thanks a lot!

 

[Betafer]

Thanks !

 

[cientiros]

To fix the issue, try to add the following lines in Domains >domain.com > Apache & nginx Settings > Additional directives for HTTP:

<IfModule mod_security2.c>
SecResponseBodyLimit 546870912
</IfModule>

And pressed apply.

This was my issue as well and this fixed it. Is there a Plesk tutorial on this?

 

[cientiros]

To fix the issue, try to add the following lines in Domains >domain.com > Apache & nginx Settings > Additional directives for HTTP:

<IfModule mod_security2.c>
SecResponseBodyLimit 546870912
</IfModule>

And pressed apply.

Thanks Igor! this worked for me.

 

[Goodfred]

To fix the issue, try to add the following lines in Domains >domain.com > Apache & nginx Settings > Additional directives for HTTP:

<IfModule mod_security2.c>
SecResponseBodyLimit 546870912
</IfModule>

And pressed apply.

Hello you!
I have a question!
Is it possible to make this for the whole reseller?
I've made it at 2 domains for a customer.
But we think it could happen on more domains.
I hope you have a reseller-wide solution!
Thank you for reading. Thank you more for answer!
Goodfred

 

[moswak]

Hi,
"not" reseller-wide but server-wide
see:

 Site on Plesk is not available: ModSecurity: Response body too large

Applicable to: Plesk for Linux Symptoms Domain is not available with the following error shown: CONFIG_TEXT: 500Internal Server Error The following messages can be found in Domains > exam...

support.plesk.com

 

[negi2410]

To fix the issue, try to add the following lines in Domains >domain.com > Apache & nginx Settings > Additional directives for HTTP:

<IfModule mod_security2.c>
SecResponseBodyLimit 546870912
</IfModule>

And pressed apply.

Thank you so much

IgorG​

 

[Sergey K.]

it works for me, BUT only for HTTPS,
NOT HTTP - screen is attached

 

[backfour94]

Hi, I am expereincing a similar problem, but I only get the error when I am logged into WordPress, when not logged in it works fine. I'm guessing that this is something to do with a plug in, but wondered if anyone had any ideas. Thanks

 

[technique-web]

Same case as backfour94, the root of the problem was Query Monitor plugin !

 

[IanJSaul]

it works for me, BUT only for HTTPS,
NOT HTTP - screen is attached View attachment 19386

Same - it caught me as odd to have it only listed in the HTTP section, and when testing, it didn't work.

Adding to HTTPS resolved the issue, cheers! -Ian

 

[desisn.com]

Adding it for your entire plesk (all domains) is the easiest option as mentioned by moswak on post #8:

1. Log in to Plesk.
2. Navigate to Tools & settings > Web Application Firewall (ModSecurity) > Settings > Custom directives section:
3. Add the following line:
   SecResponseBodyLimit 536870912
4. Press Apply

Source:
https://support.plesk.com/hc/en-us/...available-ModSecurity-Response-body-too-large

 

[Carsten.oder.so]

Vielen Dank, durch das Hinzufügen zu HTTPS wurde das Problem behoben.

@IgorG​

 

[Shamrock]

Adding it for your entire plesk (all domains) is the easiest option as mentioned by moswak on post #8:

1. Log in to Plesk.
2. Navigate to Tools & settings > Web Application Firewall (ModSecurity) > Settings > Custom directives section:
3. Add the following line:
   SecResponseBodyLimit 536870912
4. Press Apply

Source:
https://support.plesk.com/hc/en-us/...available-ModSecurity-Response-body-too-large

in the link are 2 ways to change the SecResponseBodyLimit, for 1 domain or for all domains. The all domains resolution works, but we want to only use it on our staging and dev domains, but the for one domain code gives the following error

Invalid Apache configuration: AH00112: Warning: DocumentRoot [/usr/share/roundcubemail/public_html/] does not exist AH00112: Warning: DocumentRoot [/usr/share/roundcubemail/public_html/] does not exist AH00112: Warning: DocumentRoot [/usr/share/roundcubemail/public_html/] does not exist AH00112: Warning: DocumentRoot [/usr/share/roundcubemail/public_html/] does not exist AH00112: Warning: DocumentRoot [/usr/share/roundcubemail/public_html/] does not exist AH00112: Warning: DocumentRoot [/usr/share/roundcubemail/public_html/] does not exist AH00526: Syntax error on line 2 of /var/www/vhosts/system/staging.DOMAIN.com/conf/vhost_ssl.conf: Invalid command '\xc2\xa0'Invalid Apache configuration: AH00112: Warning: DocumentRoot [/usr/share/roundcubemail/public_html/] does not exist AH00112: Warning: DocumentRoot [/usr/share/roundcubemail/public_html/] does not exist AH00112: Warning: DocumentRoot [/usr/share/roundcubemail/public_html/] does not exist AH00112: Warning: DocumentRoot [/usr/share/roundcubemail/public_html/] does not exist AH00112: Warning: DocumentRoot [/usr/share/roundcubemail/public_html/] does not exist AH00112: Warning: DocumentRoot [/usr/share/roundcubemail/public_html/] does not exist AH00526: Syntax error on line 2 of /var/www/vhosts/system/staging.DOMAIN.com/conf/vhost_ssl.conf: Invalid command '\xc2\xa0', perhaps misspelled or defined by a module not included in the server configuration, perhaps misspelled or defined by a module not included in the server configuration

The code was literally copy pasted into it, so no typo's....
Anyone has any clue what could cause this?