Well since last update today morning the mod_security looks wired for me.
starting from /etc/httpd/conf.d/security2.conf (which seems to be the initial conf) with the include path of Include "/etc/httpd/conf/modsecurity.d/*.conf"
zz_rules.conf with the include of Include "/etc/httpd/conf/modsecurity.d/rules/tortix/*.conf"
there is only the tortix_waf.conf matching the include and it seems the 50_plesk_basic_asl_rules.conf (which i asume is the basic ruleset) will nowhere included...
I also cant find out where modsecurity_crs-plesk (I think this are the standard basic rules ) will be included if neccesary ...
and at last custom added rules will be placed at:
would be great if someone can enlight me, this plesk / Atomic basic ruleset integration of mod_security confuse me a bit......
kind regards
Brujo
starting from /etc/httpd/conf.d/security2.conf (which seems to be the initial conf) with the include path of Include "/etc/httpd/conf/modsecurity.d/*.conf"
ls -la /etc/httpd/conf/modsecurity.d/
total 20
drwxr-xr-x 3 root root 4096 Aug 14 04:29 .
drwxr-xr-x 4 root root 4096 Aug 13 23:53 ..
drwxr-xr-x 4 root root 4096 Aug 14 04:29 rules
-rw-r--r-- 1 root root 211 Aug 14 04:29 zz_rules.conf
zz_rules.conf with the include of Include "/etc/httpd/conf/modsecurity.d/rules/tortix/*.conf"
ls -la /etc/httpd/conf/modsecurity.d/rules/tortix/
total 20
drwxr-xr-x 3 root root 4096 Aug 14 04:29 .
drwxr-xr-x 4 root root 4096 Aug 14 04:29 ..
drwxr-xr-x 2 root root 4096 Aug 14 04:29 modsec
-rw-r--r-- 1 root root 442 Aug 14 04:29 plesk_init.conf
-rw-r--r-- 1 root root 195 Aug 14 04:29 plesk_init.conf.tpl
more /etc/httpd/conf/modsecurity.d/rules/tortix/plesk_init.conf
#ATTENTION!
#
#DO NOT MODIFY THIS FILE BECAUSE IT WAS GENERATED AUTOMATICALLY,
#SO ALL YOUR CHANGES WILL BE LOST THE NEXT TIME THE FILE IS GENERATED.
Include /etc/httpd/conf/modsecurity.d/rules/tortix/modsec/tortix_waf.conf
Include /etc/httpd/conf/modsecurity.d/rules/tortix/modsec/00*exclude.conf
Include /etc/httpd/conf/modsecurity.d/rules/tortix/modsec/*asl*.conf
Include /etc/httpd/conf/modsecurity.d/rules/tortix/modsec/99*exclude.conf
there is only the tortix_waf.conf matching the include and it seems the 50_plesk_basic_asl_rules.conf (which i asume is the basic ruleset) will nowhere included...
ls -la /etc/httpd/conf/modsecurity.d/rules/tortix/modsec/
total 664
drwxr-xr-x 2 root root 4096 Aug 14 04:29 .
drwxr-xr-x 3 root root 4096 Aug 14 04:29 ..
-rw------- 1 root root 0 Aug 14 04:29 000_vhost_exclude.conf
-rw------- 1 root root 659404 Aug 14 04:29 50_plesk_basic_asl_rules.conf
-rw------- 1 root root 0 Aug 14 04:29 99_global_exclude.conf
-rw------- 1 root root 959 Aug 14 04:29 sql.txt
-rw------- 1 root root 1015 Aug 14 04:29 tortix_waf.conf
I also cant find out where modsecurity_crs-plesk (I think this are the standard basic rules ) will be included if neccesary ...
ls -la /etc/httpd/conf/modsecurity.d/rules/
total 16
drwxr-xr-x 4 root root 4096 Aug 14 04:29 .
drwxr-xr-x 3 root root 4096 Aug 14 04:29 ..
drwxr-xr-x 2 root root 4096 Aug 13 23:52 modsecurity_crs-plesk
drwxr-xr-x 3 root root 4096 Aug 14 04:29 tortix
ls -la /etc/httpd/conf/modsecurity.d/rules/modsecurity_crs-plesk/
total 368
drwxr-xr-x 2 root root 4096 Aug 13 23:52 .
drwxr-xr-x 4 root root 4096 Aug 14 04:29 ..
-rw-r--r-- 1 root root 1969 Mar 31 07:00 modsecurity_35_bad_robots.data
-rw-r--r-- 1 root root 386 Mar 31 07:00 modsecurity_35_scanners.data
-rw-r--r-- 1 root root 3928 Mar 31 07:00 modsecurity_40_generic_attacks.data
-rw-r--r-- 1 root root 2224 Mar 31 07:00 modsecurity_50_outbound.data
-rw-r--r-- 1 root root 56714 Mar 31 07:00 modsecurity_50_outbound_malware.data
-rw-r----- 1 root root 13778 Mar 31 07:00 modsecurity_crs_10_setup.conf
-rw-r--r-- 1 root root 22924 Mar 31 07:00 modsecurity_crs_20_protocol_violations.conf
-rw-r--r-- 1 root root 6914 Mar 31 07:00 modsecurity_crs_21_protocol_anomalies.conf
-rw-r--r-- 1 root root 3792 Mar 31 07:00 modsecurity_crs_23_request_limits.conf
-rw-r--r-- 1 root root 6933 Mar 31 07:00 modsecurity_crs_30_http_policy.conf
-rw-r--r-- 1 root root 5410 Mar 31 07:00 modsecurity_crs_35_bad_robots.conf
-rw-r--r-- 1 root root 20469 Mar 31 07:00 modsecurity_crs_40_generic_attacks.conf
-rw-r--r-- 1 root root 43652 Mar 31 07:00 modsecurity_crs_41_sql_injection_attacks.conf
-rw-r--r-- 1 root root 96711 Mar 31 07:00 modsecurity_crs_41_xss_attacks.conf
-rw-r--r-- 1 root root 1795 Mar 31 07:00 modsecurity_crs_42_tight_security.conf
-rw-r--r-- 1 root root 3660 Mar 31 07:00 modsecurity_crs_45_trojans.conf
-rw-r--r-- 1 root root 2247 Mar 31 07:00 modsecurity_crs_47_common_exceptions.conf
-rw-r--r-- 1 root root 2787 Mar 31 07:00 modsecurity_crs_48_local_exceptions.conf.example
-rw-r--r-- 1 root root 1838 Mar 31 07:00 modsecurity_crs_49_inbound_blocking.conf
-rw-r--r-- 1 root root 22336 Mar 31 07:00 modsecurity_crs_50_outbound.conf
-rw-r--r-- 1 root root 1448 Mar 31 07:00 modsecurity_crs_59_outbound_blocking.conf
-rw-r--r-- 1 root root 2674 Mar 31 07:00 modsecurity_crs_60_correlation.conf
and at last custom added rules will be placed at:
ls -la /etc/httpd/conf/plesk.conf.d/m*
-rw------- 1 root apache 726 Aug 14 19:19 /etc/httpd/conf/plesk.conf.d/modsecurity.conf
would be great if someone can enlight me, this plesk / Atomic basic ruleset integration of mod_security confuse me a bit......
kind regards
Brujo
Last edited: