• Our team is looking to connect with folks who use email services provided by Plesk, or a premium service. If you'd like to be part of the discovery process and share your experiences, we invite you to complete this short screening survey. If your responses match the persona we are looking for, you'll receive a link to schedule a call at your convenience. We look forward to hearing from you!
  • We are looking for U.S.-based freelancer or agency working with SEO or WordPress for a quick 30-min interviews to gather feedback on XOVI, a successful German SEO tool we’re looking to launch in the U.S.
    If you qualify and participate, you’ll receive a $30 Amazon gift card as a thank-you. Please apply here. Thanks for helping shape a better SEO product for agencies!
  • The BIND DNS server has already been deprecated and removed from Plesk for Windows.
    If a Plesk for Windows server is still using BIND, the upgrade to Plesk Obsidian 18.0.70 will be unavailable until the administrator switches the DNS server to Microsoft DNS. We strongly recommend transitioning to Microsoft DNS within the next 6 weeks, before the Plesk 18.0.70 release.
  • The Horde component is removed from Plesk Installer. We recommend switching to another webmail software supported in Plesk.

Question Plesk IM360 and ModSec

A

Ayki

Basic Pleskian
Server operating system version
CENTOS 7
Plesk version and microupdate number
Obsidian
I am having an issue with one of my server's IM360 ModSecurity Rule sets. I have another server with identical configuration (so I thought) where this issue is not present.

The Issue:

IM360 is configured and appears to be working fine. Fail to ban is OFF. Modsecurity is configured to use IM360 conf rules.

Suddenly on the affected server I have noticed the error below over and over again: nearly 1 million lines of this in the modsec_audit.log in one day:

"Message: JSON support was not enabled
Message: Warning. Operator EQ matched 1 at REQBODY_ERROR. [file "/etc/httpd/conf/modsecurity.d/rules/custom/005_i360_4_custom.conf"] [line "335"] [id "77316736"] [msg "IM360 WAF: Request body parsing error||T:APACHE||"] [severity "NOTICE"] [tag "service_i360custom"]"

When comparing this with the other server’s modsec_audit.log (with identical configuration). There are no signs of this error and only 10000 lines of entry in the modsec_audit.log instead of a million observed on the affected server.

Any suggestions would be most appreciated
 
Exactly the same problem.

I would like to add that some incoming requests with JSON payload are dropped because of rule ID 77316736. In Plesk logs that requests have Error type


[client XXX.XXX.XXX.XXX] ModSecurity: JSON support was not enabled [hostname "XXXXXXXX.com"] [uri "/callback"] [unique_id "XXXXXXXXXXXXXXXXXX"]


[client XXX.XXX.XXX.XXX] ModSecurity: Warning. Operator EQ matched 1 at REQBODY_ERROR. [file "/etc/httpd/conf/modsecurity.d/rules/custom/006_i360_4_custom.conf"] [line "387"] [id "77316736"] [msg "IM360 WAF: Request body parsing error||T:APACHE||"] [severity "NOTICE"] [tag "service_i360custom"] [hostname "XXXXXXXX.com"] [uri "/callback"] [unique_id "XXXXXXXXXXXXXXXXXX"]


[client XXX.XXX.XXX.XXX] ModSecurity: Warning. Operator EQ matched 1 at REQBODY_ERROR. [file "/etc/httpd/conf/modsecurity.d/rules/custom/006_i360_4_custom.conf"] [line "387"] [id "77316736"] [msg "IM360 WAF: Request body parsing error||T:APACHE||"] [severity "NOTICE"] [tag "service_i360custom"] [hostname "XXXXXXXX.com"] [uri "/callback"] [unique_id "XXXXXXXXXXXXXXXXXX"]

As you can see, requests have NOTICE severity BUT are dropped by firewall and the type of request is ERROR without HTTP response code. The code is empty


Plesk team, please, give a hand with that issue. I mean how to turn on JSON support for ModSecurity with Imunify 360 rule set?
Or maybe you have another solution / ideas?
 
According to my research, this happens whenever JSON support is not enabled on the ModSecurity engine, this is expected for some operating systems, please check this link as it contains more info on this matter: JSON support was not enabled (Make it required?) · Issue #1914 · SpiderLabs/ModSecurity

Overall, it is safe to say that the currently used custom rule-set on ModSecurity is too strict and is causing many false positives within the website and failed actions, for this reason, you could switch it to Detection only which should be enough to mitigate the aforementioned problems.

If you really need ModSecurity enabled for this website, you may consider Switching to the Atomic ModSecurity ruleset: Plesk > Websites > domain.tld > Web Application Firewall (ModSecurity) > Settings > Atomic Standard > Click OK to apply the changes
 
Many thanks for your replies

I read the spiderlabs thread and conclude that the required JAYL library support must be included in Plesk installation in my case.
Following on I found the mod_security-2.9.3.2-2.centos.7+p18.0.41.0+t211130.1601.x86_64 was currently installed on this server running on Plesk Centos 7.

In my case re-installing the modsecurity was enough to update the mod_security version to -2.9.5-2.centos.7+p18.0.43.0+t220406.1450.x86_64.

Then the problem has gone away.

Ofcourse doing all this I had to re-configure modsecurity with a custom ruleset to allow IM360 to handle the firewall rules for the web traffic.
 
Ayki said:
Many thanks for your replies

I read the spiderlabs thread and conclude that the required JAYL library support must be included in Plesk installation in my case.
Following on I found the mod_security-2.9.3.2-2.centos.7+p18.0.41.0+t211130.1601.x86_64 was currently installed on this server running on Plesk Centos 7.

In my case re-installing the modsecurity was enough to update the mod_security version to -2.9.5-2.centos.7+p18.0.43.0+t220406.1450.x86_64.

Then the problem has gone away.

Ofcourse doing all this I had to re-configure modsecurity with a custom ruleset to allow IM360 to handle the firewall rules for the web traffic.
Click to expand...
Hi Ayki,

I'm also seeing this behaviour, which is preventing a payment gateway callback for a client.

I'm already on v2.9.5, but still experiencing the issue.

Code: 
# rpm -qa | grep mod_sec
mod_security-2.9.5-2.centos.8+p18.0.42.0+t220121.0734.x86_64

Was there anything else you did to allow these requests through?

You mentioned reconfiguring modesc to allow IM360 to handle traffic. Can you please let me know more about this?

Thanks.
 
Just an update to the above - it seems the updating to the newest mod_sec (removing and reinstalling via the plesk installer) has probably done the trick... I had a further issue with a bug in the payment gateway module (Square for Prestashop) which has been resolved.

Code: 
plesk installer --select-release-current --remove-component modsecurity
plesk installer --select-release-current --install-component modsecurity
 
Christopher McBride said:
Just an update to the above - it seems the updating to the newest mod_sec (removing and reinstalling via the plesk installer) has probably done the trick... I had a further issue with a bug in the payment gateway module (Square for Prestashop) which has been resolved.

Code: 
plesk installer --select-release-current --remove-component modsecurity
plesk installer --select-release-current --install-component modsecurity
Click to expand...
I've done it and it looks like it's working.
How do I make sure that IM360 it's handling modsecurity?
 
You must log in or register to reply here.

Similar threads

K
Question What is the current version of the free AtomiCorp ruleset(s) (ModSecurity) within Plesk?
Replies
0
Views
316
King555
K
Jürgen_T
Resolved ModSecurity configuration files and directives remain on the server after its removal
Replies
5
Views
2K
Sebahat.hadzhi
Sebahat.hadzhi
Q
Issue mod security settings for nextcloud works only fo several hours
Replies
0
Views
1K
Quit96
Q
S
Issue Need Help Whitelisting GTM Noscript in Comodo WAF Rule 214540 on Plesk
Replies
1
Views
285
alvarezcruz
alvarezcruz
L
Resolved ModSecurity: Access denied with code 403 (phase 2). Match of "contains /wp-json/yoast/"
Replies
7
Views
9K
loman
L
Back
Top