• Please be aware: Kaspersky Anti-Virus has been deprecated
    With the upgrade to Plesk Obsidian 18.0.64, "Kaspersky Anti-Virus for Servers" will be automatically removed from the servers it is installed on. We recommend that you migrate to Sophos Anti-Virus for Servers.
  • The Horde webmail has been deprecated. Its complete removal is scheduled for April 2025. For details and recommended actions, see the Feature and Deprecation Plan.
  • We’re working on enhancing the Monitoring feature in Plesk, and we could really use your expertise! If you’re open to sharing your experiences with server and website monitoring or providing feedback, we’d love to have a one-hour online meeting with you.

Question Plesk IM360 and ModSec

A

Ayki

Basic Pleskian
Server operating system version
CENTOS 7
Plesk version and microupdate number
Obsidian
I am having an issue with one of my server's IM360 ModSecurity Rule sets. I have another server with identical configuration (so I thought) where this issue is not present.

The Issue:

IM360 is configured and appears to be working fine. Fail to ban is OFF. Modsecurity is configured to use IM360 conf rules.

Suddenly on the affected server I have noticed the error below over and over again: nearly 1 million lines of this in the modsec_audit.log in one day:

"Message: JSON support was not enabled
Message: Warning. Operator EQ matched 1 at REQBODY_ERROR. [file "/etc/httpd/conf/modsecurity.d/rules/custom/005_i360_4_custom.conf"] [line "335"] [id "77316736"] [msg "IM360 WAF: Request body parsing error||T:APACHE||"] [severity "NOTICE"] [tag "service_i360custom"]"

When comparing this with the other server’s modsec_audit.log (with identical configuration). There are no signs of this error and only 10000 lines of entry in the modsec_audit.log instead of a million observed on the affected server.

Any suggestions would be most appreciated
 
Exactly the same problem.

I would like to add that some incoming requests with JSON payload are dropped because of rule ID 77316736. In Plesk logs that requests have Error type


[client XXX.XXX.XXX.XXX] ModSecurity: JSON support was not enabled [hostname "XXXXXXXX.com"] [uri "/callback"] [unique_id "XXXXXXXXXXXXXXXXXX"]


[client XXX.XXX.XXX.XXX] ModSecurity: Warning. Operator EQ matched 1 at REQBODY_ERROR. [file "/etc/httpd/conf/modsecurity.d/rules/custom/006_i360_4_custom.conf"] [line "387"] [id "77316736"] [msg "IM360 WAF: Request body parsing error||T:APACHE||"] [severity "NOTICE"] [tag "service_i360custom"] [hostname "XXXXXXXX.com"] [uri "/callback"] [unique_id "XXXXXXXXXXXXXXXXXX"]


[client XXX.XXX.XXX.XXX] ModSecurity: Warning. Operator EQ matched 1 at REQBODY_ERROR. [file "/etc/httpd/conf/modsecurity.d/rules/custom/006_i360_4_custom.conf"] [line "387"] [id "77316736"] [msg "IM360 WAF: Request body parsing error||T:APACHE||"] [severity "NOTICE"] [tag "service_i360custom"] [hostname "XXXXXXXX.com"] [uri "/callback"] [unique_id "XXXXXXXXXXXXXXXXXX"]

As you can see, requests have NOTICE severity BUT are dropped by firewall and the type of request is ERROR without HTTP response code. The code is empty


Plesk team, please, give a hand with that issue. I mean how to turn on JSON support for ModSecurity with Imunify 360 rule set?
Or maybe you have another solution / ideas?
 
According to my research, this happens whenever JSON support is not enabled on the ModSecurity engine, this is expected for some operating systems, please check this link as it contains more info on this matter: JSON support was not enabled (Make it required?) · Issue #1914 · SpiderLabs/ModSecurity

Overall, it is safe to say that the currently used custom rule-set on ModSecurity is too strict and is causing many false positives within the website and failed actions, for this reason, you could switch it to Detection only which should be enough to mitigate the aforementioned problems.

If you really need ModSecurity enabled for this website, you may consider Switching to the Atomic ModSecurity ruleset: Plesk > Websites > domain.tld > Web Application Firewall (ModSecurity) > Settings > Atomic Standard > Click OK to apply the changes
 
Many thanks for your replies

I read the spiderlabs thread and conclude that the required JAYL library support must be included in Plesk installation in my case.
Following on I found the mod_security-2.9.3.2-2.centos.7+p18.0.41.0+t211130.1601.x86_64 was currently installed on this server running on Plesk Centos 7.

In my case re-installing the modsecurity was enough to update the mod_security version to -2.9.5-2.centos.7+p18.0.43.0+t220406.1450.x86_64.

Then the problem has gone away.

Ofcourse doing all this I had to re-configure modsecurity with a custom ruleset to allow IM360 to handle the firewall rules for the web traffic.
 
Ayki said:
Many thanks for your replies

I read the spiderlabs thread and conclude that the required JAYL library support must be included in Plesk installation in my case.
Following on I found the mod_security-2.9.3.2-2.centos.7+p18.0.41.0+t211130.1601.x86_64 was currently installed on this server running on Plesk Centos 7.

In my case re-installing the modsecurity was enough to update the mod_security version to -2.9.5-2.centos.7+p18.0.43.0+t220406.1450.x86_64.

Then the problem has gone away.

Ofcourse doing all this I had to re-configure modsecurity with a custom ruleset to allow IM360 to handle the firewall rules for the web traffic.
Click to expand...
Hi Ayki,

I'm also seeing this behaviour, which is preventing a payment gateway callback for a client.

I'm already on v2.9.5, but still experiencing the issue.

Code: 
# rpm -qa | grep mod_sec
mod_security-2.9.5-2.centos.8+p18.0.42.0+t220121.0734.x86_64

Was there anything else you did to allow these requests through?

You mentioned reconfiguring modesc to allow IM360 to handle traffic. Can you please let me know more about this?

Thanks.
 
Just an update to the above - it seems the updating to the newest mod_sec (removing and reinstalling via the plesk installer) has probably done the trick... I had a further issue with a bug in the payment gateway module (Square for Prestashop) which has been resolved.

Code: 
plesk installer --select-release-current --remove-component modsecurity
plesk installer --select-release-current --install-component modsecurity
 
Christopher McBride said:
Just an update to the above - it seems the updating to the newest mod_sec (removing and reinstalling via the plesk installer) has probably done the trick... I had a further issue with a bug in the payment gateway module (Square for Prestashop) which has been resolved.

Code: 
plesk installer --select-release-current --remove-component modsecurity
plesk installer --select-release-current --install-component modsecurity
Click to expand...
I've done it and it looks like it's working.
How do I make sure that IM360 it's handling modsecurity?
 
You must log in or register to reply here.

Similar threads

Q
Issue mod security settings for nextcloud works only fo several hours
Replies
0
Views
1K
Quit96
Q
L
Resolved ModSecurity: Access denied with code 403 (phase 2). Match of "contains /wp-json/yoast/"
Replies
7
Views
371
loman
L
K
Question modsecurity
Replies
2
Views
494
Knutsford
K
P
Issue my website not rendering in some countries due to modsecurity
Replies
0
Views
857
pointsriver
P
P
Question my website not rendering in some countries due to modsecurity
Replies
0
Views
737
pointsriver
P
Back
Top