• The Horde webmail has been deprecated. Its complete removal is scheduled for April 2025. For details and recommended actions, see the Feature and Deprecation Plan.
  • We’re working on enhancing the Monitoring feature in Plesk, and we could really use your expertise! If you’re open to sharing your experiences with server and website monitoring or providing feedback, we’d love to have a one-hour online meeting with you.

mod_security within Atomic Basic looks broken on Centos 6.5

Brujo

Silver Pleskian
Plesk Guru
Well since last update today morning the mod_security looks wired for me.

starting from /etc/httpd/conf.d/security2.conf (which seems to be the initial conf) with the include path of Include "/etc/httpd/conf/modsecurity.d/*.conf"

ls -la /etc/httpd/conf/modsecurity.d/
total 20
drwxr-xr-x 3 root root 4096 Aug 14 04:29 .
drwxr-xr-x 4 root root 4096 Aug 13 23:53 ..
drwxr-xr-x 4 root root 4096 Aug 14 04:29 rules
-rw-r--r-- 1 root root 211 Aug 14 04:29 zz_rules.conf

zz_rules.conf with the include of Include "/etc/httpd/conf/modsecurity.d/rules/tortix/*.conf"

ls -la /etc/httpd/conf/modsecurity.d/rules/tortix/
total 20
drwxr-xr-x 3 root root 4096 Aug 14 04:29 .
drwxr-xr-x 4 root root 4096 Aug 14 04:29 ..
drwxr-xr-x 2 root root 4096 Aug 14 04:29 modsec
-rw-r--r-- 1 root root 442 Aug 14 04:29 plesk_init.conf
-rw-r--r-- 1 root root 195 Aug 14 04:29 plesk_init.conf.tpl

more /etc/httpd/conf/modsecurity.d/rules/tortix/plesk_init.conf
#ATTENTION!
#
#DO NOT MODIFY THIS FILE BECAUSE IT WAS GENERATED AUTOMATICALLY,
#SO ALL YOUR CHANGES WILL BE LOST THE NEXT TIME THE FILE IS GENERATED.

Include /etc/httpd/conf/modsecurity.d/rules/tortix/modsec/tortix_waf.conf
Include /etc/httpd/conf/modsecurity.d/rules/tortix/modsec/00*exclude.conf
Include /etc/httpd/conf/modsecurity.d/rules/tortix/modsec/*asl*.conf
Include /etc/httpd/conf/modsecurity.d/rules/tortix/modsec/99*exclude.conf

there is only the tortix_waf.conf matching the include and it seems the 50_plesk_basic_asl_rules.conf (which i asume is the basic ruleset) will nowhere included...

ls -la /etc/httpd/conf/modsecurity.d/rules/tortix/modsec/
total 664
drwxr-xr-x 2 root root 4096 Aug 14 04:29 .
drwxr-xr-x 3 root root 4096 Aug 14 04:29 ..
-rw------- 1 root root 0 Aug 14 04:29 000_vhost_exclude.conf
-rw------- 1 root root 659404 Aug 14 04:29 50_plesk_basic_asl_rules.conf
-rw------- 1 root root 0 Aug 14 04:29 99_global_exclude.conf
-rw------- 1 root root 959 Aug 14 04:29 sql.txt
-rw------- 1 root root 1015 Aug 14 04:29 tortix_waf.conf

I also cant find out where modsecurity_crs-plesk (I think this are the standard basic rules ) will be included if neccesary ...

ls -la /etc/httpd/conf/modsecurity.d/rules/
total 16
drwxr-xr-x 4 root root 4096 Aug 14 04:29 .
drwxr-xr-x 3 root root 4096 Aug 14 04:29 ..
drwxr-xr-x 2 root root 4096 Aug 13 23:52 modsecurity_crs-plesk
drwxr-xr-x 3 root root 4096 Aug 14 04:29 tortix

ls -la /etc/httpd/conf/modsecurity.d/rules/modsecurity_crs-plesk/
total 368
drwxr-xr-x 2 root root 4096 Aug 13 23:52 .
drwxr-xr-x 4 root root 4096 Aug 14 04:29 ..
-rw-r--r-- 1 root root 1969 Mar 31 07:00 modsecurity_35_bad_robots.data
-rw-r--r-- 1 root root 386 Mar 31 07:00 modsecurity_35_scanners.data
-rw-r--r-- 1 root root 3928 Mar 31 07:00 modsecurity_40_generic_attacks.data
-rw-r--r-- 1 root root 2224 Mar 31 07:00 modsecurity_50_outbound.data
-rw-r--r-- 1 root root 56714 Mar 31 07:00 modsecurity_50_outbound_malware.data
-rw-r----- 1 root root 13778 Mar 31 07:00 modsecurity_crs_10_setup.conf
-rw-r--r-- 1 root root 22924 Mar 31 07:00 modsecurity_crs_20_protocol_violations.conf
-rw-r--r-- 1 root root 6914 Mar 31 07:00 modsecurity_crs_21_protocol_anomalies.conf
-rw-r--r-- 1 root root 3792 Mar 31 07:00 modsecurity_crs_23_request_limits.conf
-rw-r--r-- 1 root root 6933 Mar 31 07:00 modsecurity_crs_30_http_policy.conf
-rw-r--r-- 1 root root 5410 Mar 31 07:00 modsecurity_crs_35_bad_robots.conf
-rw-r--r-- 1 root root 20469 Mar 31 07:00 modsecurity_crs_40_generic_attacks.conf
-rw-r--r-- 1 root root 43652 Mar 31 07:00 modsecurity_crs_41_sql_injection_attacks.conf
-rw-r--r-- 1 root root 96711 Mar 31 07:00 modsecurity_crs_41_xss_attacks.conf
-rw-r--r-- 1 root root 1795 Mar 31 07:00 modsecurity_crs_42_tight_security.conf
-rw-r--r-- 1 root root 3660 Mar 31 07:00 modsecurity_crs_45_trojans.conf
-rw-r--r-- 1 root root 2247 Mar 31 07:00 modsecurity_crs_47_common_exceptions.conf
-rw-r--r-- 1 root root 2787 Mar 31 07:00 modsecurity_crs_48_local_exceptions.conf.example
-rw-r--r-- 1 root root 1838 Mar 31 07:00 modsecurity_crs_49_inbound_blocking.conf
-rw-r--r-- 1 root root 22336 Mar 31 07:00 modsecurity_crs_50_outbound.conf
-rw-r--r-- 1 root root 1448 Mar 31 07:00 modsecurity_crs_59_outbound_blocking.conf
-rw-r--r-- 1 root root 2674 Mar 31 07:00 modsecurity_crs_60_correlation.conf

and at last custom added rules will be placed at:
ls -la /etc/httpd/conf/plesk.conf.d/m*
-rw------- 1 root apache 726 Aug 14 19:19 /etc/httpd/conf/plesk.conf.d/modsecurity.conf

would be great if someone can enlight me, this plesk / Atomic basic ruleset integration of mod_security confuse me a bit......
kind regards
Brujo
 
Last edited:
Back
Top