• If you are still using CentOS 7.9, it's time to convert to Alma 8 with the free centos2alma tool by Plesk or Plesk Migrator. Please let us know your experiences or concerns in this thread:
    CentOS2Alma discussion
  • Inviting everyone to the UX test of a new security feature in the WP Toolkit
    For WordPress site owners, threats posed by hackers are ever-present. Because of this, we are developing a new security feature for the WP Toolkit. If the topic of WordPress website security is relevant to you, we would be grateful if you could share your experience and help us test the usability of this feature. We invite you to join us for a 1-hour online session via Google Meet. Select a convenient meeting time with our friendly UX staff here.

mod_security within Atomic Basic looks broken on Centos 6.5

Brujo

Silver Pleskian
Plesk Guru
Well since last update today morning the mod_security looks wired for me.

starting from /etc/httpd/conf.d/security2.conf (which seems to be the initial conf) with the include path of Include "/etc/httpd/conf/modsecurity.d/*.conf"

ls -la /etc/httpd/conf/modsecurity.d/
total 20
drwxr-xr-x 3 root root 4096 Aug 14 04:29 .
drwxr-xr-x 4 root root 4096 Aug 13 23:53 ..
drwxr-xr-x 4 root root 4096 Aug 14 04:29 rules
-rw-r--r-- 1 root root 211 Aug 14 04:29 zz_rules.conf

zz_rules.conf with the include of Include "/etc/httpd/conf/modsecurity.d/rules/tortix/*.conf"

ls -la /etc/httpd/conf/modsecurity.d/rules/tortix/
total 20
drwxr-xr-x 3 root root 4096 Aug 14 04:29 .
drwxr-xr-x 4 root root 4096 Aug 14 04:29 ..
drwxr-xr-x 2 root root 4096 Aug 14 04:29 modsec
-rw-r--r-- 1 root root 442 Aug 14 04:29 plesk_init.conf
-rw-r--r-- 1 root root 195 Aug 14 04:29 plesk_init.conf.tpl

more /etc/httpd/conf/modsecurity.d/rules/tortix/plesk_init.conf
#ATTENTION!
#
#DO NOT MODIFY THIS FILE BECAUSE IT WAS GENERATED AUTOMATICALLY,
#SO ALL YOUR CHANGES WILL BE LOST THE NEXT TIME THE FILE IS GENERATED.

Include /etc/httpd/conf/modsecurity.d/rules/tortix/modsec/tortix_waf.conf
Include /etc/httpd/conf/modsecurity.d/rules/tortix/modsec/00*exclude.conf
Include /etc/httpd/conf/modsecurity.d/rules/tortix/modsec/*asl*.conf
Include /etc/httpd/conf/modsecurity.d/rules/tortix/modsec/99*exclude.conf

there is only the tortix_waf.conf matching the include and it seems the 50_plesk_basic_asl_rules.conf (which i asume is the basic ruleset) will nowhere included...

ls -la /etc/httpd/conf/modsecurity.d/rules/tortix/modsec/
total 664
drwxr-xr-x 2 root root 4096 Aug 14 04:29 .
drwxr-xr-x 3 root root 4096 Aug 14 04:29 ..
-rw------- 1 root root 0 Aug 14 04:29 000_vhost_exclude.conf
-rw------- 1 root root 659404 Aug 14 04:29 50_plesk_basic_asl_rules.conf
-rw------- 1 root root 0 Aug 14 04:29 99_global_exclude.conf
-rw------- 1 root root 959 Aug 14 04:29 sql.txt
-rw------- 1 root root 1015 Aug 14 04:29 tortix_waf.conf

I also cant find out where modsecurity_crs-plesk (I think this are the standard basic rules ) will be included if neccesary ...

ls -la /etc/httpd/conf/modsecurity.d/rules/
total 16
drwxr-xr-x 4 root root 4096 Aug 14 04:29 .
drwxr-xr-x 3 root root 4096 Aug 14 04:29 ..
drwxr-xr-x 2 root root 4096 Aug 13 23:52 modsecurity_crs-plesk
drwxr-xr-x 3 root root 4096 Aug 14 04:29 tortix

ls -la /etc/httpd/conf/modsecurity.d/rules/modsecurity_crs-plesk/
total 368
drwxr-xr-x 2 root root 4096 Aug 13 23:52 .
drwxr-xr-x 4 root root 4096 Aug 14 04:29 ..
-rw-r--r-- 1 root root 1969 Mar 31 07:00 modsecurity_35_bad_robots.data
-rw-r--r-- 1 root root 386 Mar 31 07:00 modsecurity_35_scanners.data
-rw-r--r-- 1 root root 3928 Mar 31 07:00 modsecurity_40_generic_attacks.data
-rw-r--r-- 1 root root 2224 Mar 31 07:00 modsecurity_50_outbound.data
-rw-r--r-- 1 root root 56714 Mar 31 07:00 modsecurity_50_outbound_malware.data
-rw-r----- 1 root root 13778 Mar 31 07:00 modsecurity_crs_10_setup.conf
-rw-r--r-- 1 root root 22924 Mar 31 07:00 modsecurity_crs_20_protocol_violations.conf
-rw-r--r-- 1 root root 6914 Mar 31 07:00 modsecurity_crs_21_protocol_anomalies.conf
-rw-r--r-- 1 root root 3792 Mar 31 07:00 modsecurity_crs_23_request_limits.conf
-rw-r--r-- 1 root root 6933 Mar 31 07:00 modsecurity_crs_30_http_policy.conf
-rw-r--r-- 1 root root 5410 Mar 31 07:00 modsecurity_crs_35_bad_robots.conf
-rw-r--r-- 1 root root 20469 Mar 31 07:00 modsecurity_crs_40_generic_attacks.conf
-rw-r--r-- 1 root root 43652 Mar 31 07:00 modsecurity_crs_41_sql_injection_attacks.conf
-rw-r--r-- 1 root root 96711 Mar 31 07:00 modsecurity_crs_41_xss_attacks.conf
-rw-r--r-- 1 root root 1795 Mar 31 07:00 modsecurity_crs_42_tight_security.conf
-rw-r--r-- 1 root root 3660 Mar 31 07:00 modsecurity_crs_45_trojans.conf
-rw-r--r-- 1 root root 2247 Mar 31 07:00 modsecurity_crs_47_common_exceptions.conf
-rw-r--r-- 1 root root 2787 Mar 31 07:00 modsecurity_crs_48_local_exceptions.conf.example
-rw-r--r-- 1 root root 1838 Mar 31 07:00 modsecurity_crs_49_inbound_blocking.conf
-rw-r--r-- 1 root root 22336 Mar 31 07:00 modsecurity_crs_50_outbound.conf
-rw-r--r-- 1 root root 1448 Mar 31 07:00 modsecurity_crs_59_outbound_blocking.conf
-rw-r--r-- 1 root root 2674 Mar 31 07:00 modsecurity_crs_60_correlation.conf

and at last custom added rules will be placed at:
ls -la /etc/httpd/conf/plesk.conf.d/m*
-rw------- 1 root apache 726 Aug 14 19:19 /etc/httpd/conf/plesk.conf.d/modsecurity.conf

would be great if someone can enlight me, this plesk / Atomic basic ruleset integration of mod_security confuse me a bit......
kind regards
Brujo
 
Last edited:
Back
Top