Issue ModSecurity rule exception not working

[benjamin-lgba]

Server operating system version

Windows Server 2019 Standard, Version 1809

Plesk version and microupdate number

Plesk Obsidian Web Host Edition Version 18.0.46 Update #1

I need to make requests to the server via python scripts. This is prevented by default through ModSecurity Rule 913101 (User-Agent associated with scripting/generic HTTP client). To keep the highest level of security, I want to allow python requests only from certain IP addresses. For this reason I have implemented the following rule server-wide (Tools & Settings > Web Application Firewall (ModSecurity) > Settings > Configuration > Custom directives):

SecRule REMOTE_ADDR "^XXX\.XXX\.XXX\.(123|124)$" "id:1,phase:1,nolog,allow,ctl:ruleRemoveById=913101"

I have no experience working with ModSecurity but to my understanding it means that rule 913101 should be ignored when the requests comes from IP addresses matching the regular expression, so XXX.XXX.XXX.123 and XXX.XXX.XXX.124. However, I still get denied when sending requests via python.

Is my rule wrong or is there something else I'm missing?

 

[IgorG]

Try to debug it with the ModSecurity log.
ModSecurity audit logs are domain-specific on Windows. They’re found in %plesk_dir%\ModSecurity\vhosts\<domain’s GUID>\logs ( %plesk_dir% is Plesk’s default installation directory).

Domain's GUID can be found with:

C:\> plesk db "select name,guid from domains where name='example.com'"

 

[benjamin-lgba]

Thanks for the reply but I can't debug like that. We don't have any domains so there are no entries in the vhosts directory. I did however find the rule I added in Plesk/ModSecurity/rules/modsecurity_30_custom.

 

[Filly]

Make use of the ModSecurity log to troubleshoot the issue.
The ModSecurity audit logs on Windows are customised for each domain. They may be located in the directory %plesk dir%ModSecurityvhostsdomain's GUID>logs (the directory %plesk dir% is where Plesk is installed by default).

 

[benjamin-lgba]

Make use of the ModSecurity log to troubleshoot the issue.
The ModSecurity audit logs on Windows are customised for each domain. They may be located in the directory %plesk dir%ModSecurityvhostsdomain's GUID>logs (the directory %plesk dir% is where Plesk is installed by default).

This is the same answer as @IgorG, which I have already replied to saying that we do not have any domains, so the vhosts directory is empty