Lighttpd + Mod_Security And Full .htaccess Support
Nov 7, 2007
Im considering alternatives to Apache web server for high traffic servers.
I already installed lighttpd + fastCGI (which is great!), integrated php5 and mysql5 without any problems.. After searching over the net i can see that there are lot of problems to have .htaccess files working in the same way as in Apache 1.3/2.x .
The solutions I've seen for this require almost a complere re-write of the .htaccess rules and even the app code in some cases, i mean, this is not good. Have anyone configured lighttpd to work with generic .htaccess files ? any guides please?
Also another important thing on a webservers is the security, apache is able to handle mod_security (a must in web server security I think), but i do not see any documentation on how to migrate mod_sec to lighttpd, any ideas about this?
Im testing this on Debian + PHP5 and MySQL 5 with latest lighttpd package.
View 9 Replies
ADVERTISEMENT
May 5, 2007
I accidently found that it could be available to de-activate mod_security in a certain directory by using a .htaccess like that...
<IfModule mod_security.c>
SecFilterEngine Off
SecFilterScanPOST Off
</IfModule>
I believe it's something related to the "AllowOverride" directive from apache but im not exactly sure, the available arguments for this directive are "AuthConfig, FileInfo, Indexes, Limit, Options", I've tried hardly to find a way to not to disable the usage of .htaccess files and keep it's functionality but also to prevent it from being able to modify through it the functionality of mod_security.
I'm sure Anyone here could help me in this issue as it's a big pain for any server running apache in a shared vhosting environment.
View 13 Replies
View Related
Jul 31, 2007
I just installed lighttpd from source and used the following options:
Code:
./configure --host=i686-redhat-linux-gnu
--build=i686-redhat-linux-gnu
--target=i386-redhat-linux
--program-prefix= --prefix=/usr
--exec-prefix=/usr
--bindir=/usr/bin
--sbindir=/usr/sbin
--sysconfdir=/etc
--datadir=/usr/share
--includedir=/usr/include
--libdir=/usr/lib
--libexecdir=/usr/libexec
--localstatedir=/var
--sharedstatedir=/usr/com
--mandir=/usr/share/man
--infodir=/usr/share/info
--with-openssl
--with-pcre
--with-zlib
--with-bzip2
--disable-ipv6
--with-PACKAGE=mod_redirect
--with-rewrite
--with-redirect
--with-ssi
--with-linux-aio
--with-lua
Now the config i'm going to use is the one lxadmin (host-in-abox) generated for me. I'm basically just trying to install lighttpd with LUA support, but I couldn't figure out how to do that with YUM. Anyway, when i try to load lighty with the lxadmin config, it says i don't have PCRE support when clearly i have it installed.
Code:
/usr/sbin/lighttpd -V
Features:
- IPv6 support
- zlib support
- bzip2 support
+ crypt support
- SSL Support
+ PCRE support
- mySQL support
- LDAP support
- memcached support
- FAM support
+ LUA support
- xml support
- SQLite support
- GDBM support
[root@server lighttpd-1.4.16]# lighttpd start -f /etc/lighttpd/lighttpd.conf
can't handle '$HTTP[url] =~ ...' as you compiled without pcre support.
(perhaps just a missing pcre-devel package ?)
2007-07-31 18:46:09: (configfile.c.853) source: /etc/lighttpd/lighttpd.conf line: 132 pos: 3 parser failed somehow near here: {
I also have the pcre-devel package installed. YUM says i do anyway.
pcre-devel.i386 6.6-1.1 installed
pcre.i386 6.6-1.1 installed
Code:
[root@server lighttpd-1.4.16]# rpm -qa pcre
pcre-6.6-1.1
Any idea what's going on? Alternatively, i would love a solution on how to install the RPM package with LUA support, as i think it's possible?
Code:
lighttpd.i386 1.4.15-1 installed
Matched from:
lighttpd
A fast webserver with minimal memory-footprint (lighttpd)
lighttpd is intented to be a frontend for ad-servers which have to deliver
small files concurrently to many connections.
Available rpmbuild rebuild options :
--with : ssl mysql lua memcache
View 3 Replies
View Related
Sep 2, 2007
I'm looking for a free web host to host my portfolio. I need:
1) Php/MySQL Support
2) .htaccess support, so I can have search-engine-friendly URLs.
3) Preferably I'd like there to only be a text/graphic ad at the bottom of the page, or to be able to pay a small fee and have the ad removed. (No popups)
Is there any such host available, or can any of you guys here who sell web hosting set me up with one such account?
View 3 Replies
View Related
Jun 20, 2007
Yahoo web hosting doesn't support .HTACCESS file. What is the solution for it on yahoo web hosting?
View 19 Replies
View Related
Feb 15, 2008
what is Override .htaccess Support?
and
how can i enable this feature in Dedicated Serevr?
View 1 Replies
View Related
Mar 13, 2008
Has anybody heard of Flash Support and Real AudioVideo Support? MMHosting.com offers this kind of support and I wonder if it's effective?
What do you think of it?
View 9 Replies
View Related
Jul 12, 2008
I'm undecided between an upcoming dedicated hosting server and am moving between Softlayer and ThePlanet. My decision partly comes down to support.
I've read many reviews on WHT about both companies, but not necessarily comparing them from people who have experienced both.
So my questions (keep in mind this is my first dedicated. I have used VPS in the past with good support) Which offers MORE support (not better) - I'm curious which company might consider my support questions as "part of the default service package" or "need additional service plan for that" More detailed support - my usual experience with support is support staff assume you already know a high level so it may take going forward and back 5 times via email to get a full answer
Overall support satisfaction - any other comments
View 9 Replies
View Related
Apr 21, 2008
I have been using mod_security 1.9.x since it first release on apache 1.3 and apache 2.0.x, rules are great and they work perfect with no issues at all with any php-mysql website. Do you recommend using mod_security 2.0 or 2.5 ? (I do know that 2.5 does not work with apache 1.3).
View 2 Replies
View Related
Apr 19, 2008
using mod_security, but I believe that I have it installed correctly with some rules that should be generating entries in the security audit log. No matter what I do, I can't seem to get mod_security to generate any sort of log entries.
I am using version 2.1.7. I compiled it with no problems. In my httpd.conf file, I have the following relevant lines:
LoadFile /usr/lib/libxml2.so
LoadModule security2_module modules/mod_security2.so
Include conf/modsecurity/*.conf
I don't think there are any problems here, as I know it is running directives from the configuration file I edited. This is the file I'm working with:
modsecurity_crs_10_config.conf
Here are the relevant lines from the config file:
SecRuleEngine On
SecRequestBodyAccess On
SecResponseBodyAccess On
SecResponseBodyMimeType (null) text/html text/plain text/xml
SecResponseBodyLimit 524288
SecDefaultAction "phase:2,auditlog,log,pass,status:500"
SecAuditEngine On
SecAuditLogType Serial
SecAuditLog logs/modsec_audit.log
SecAuditLogParts "ABIFHZ"
SecRequestBodyInMemoryLimit 131072
SecDebugLog logs/modsec_debug.log
SecDebugLogLevel 3
I know that the config file is being read because when I start apache, the log files (modsec_audit.log and modsec_debug.log) are created. The problem is that the files are empty and remain empty no matter what I do. I have even tried setting permissions on the files to 777.
Here are a couple of rules I created in an attempt to generate log entries:
SecRule REQUEST_BODY "viagra"
SecRule REMOTE_ADDR "^1.1.3.4$" auditlog,phase:1,allow
I put these in the same config file mentioned above. As far as I understand, the first rule should examine the request body (which would include data in POST requests) for the word, "viagra". Since my default action is phase:2,auditlog,log,pass,status:500, such requests should end up in the audit log. However, when I use a form on my site to post the word "viagra", nothing is generated in the log file.
The second rule, as far as I understand, should generate a log entry any time the IP address 1.2.3.4 is sent in the request headers. Instead of 1.2.3.4, of course, I have put in my real IP address. However, when I visit my server and browse pages, nothing is logged. I assume that my requests should generate log entries since I match the IP address.
View 3 Replies
View Related
Dec 1, 2007
I am currently running a few small websites that use a CMS. Two are Dragonfly and one is Joomla.
I am getting sporadic errors with both systems that, upon research, seem to be related to Apache and the mod_security module. I am getting the following error:
Code:
Not Acceptable
An appropriate representation of the requested resource /somefolder/index.php could not be found on this server.
Well, I'm no idiot (although some people may tend to disagree ) and after some searching, I found that this most likely points to an Apache error. Most solutions suggest to put the following in my .htacess file for the site:
Code:
<IfModule mod_security.c>
SecFilterEngine Off
SecFilterScanPOST Off
</IfModule>
It was noted that "SecFilterScanPOST Off" may or not be necessary. I have added the above to the .htaccess for each site (all 3 sites are subdomains) and have also added it to the .htaccess that is in the root folder for the site. Nothing has worked.
So my question is, is it possible that my webhost can override my .htaacess settings with their own? This is the only explanation that I can think of. But of course, I am no expert, which is why I turn to you good folks for help once again.
View 0 Replies
View Related
Jul 27, 2008
I want to add some more rules to to mod_security, however I am unsure if some of them are already being used.
So would it cause any problems if there are duplicate rules for the time being till I can check through all the rules?
View 2 Replies
View Related
Jul 23, 2007
I am having lots of problems installing mod_security on RH5 64 w/ Plesk.
mainly related to apr0, subversion, and the headers.
Any reason why everyone recommends to use version 1.94 of mod_security rather than the latest version available on www.modsecurity.org?
View 3 Replies
View Related
Oct 2, 2007
I've got this:
mod_security: Access denied with code 406. Error normalising REQUEST_URI: Invalid URL encoding detected: invalid characters used [hostname "www.mydomain.com"] [uri "/search/include/js_suggest/suggest.php?type=query&q=%u062E%u0636%u0631%u0627"]
how to disable/exclude this uri in mentioned host from being catched by mod_security?
View 4 Replies
View Related
Mar 29, 2007
how many people are actually using mod_security 2 instead of 1?
And why did you choose the version you did?
View 4 Replies
View Related
Mar 4, 2007
SSI isn't working with lighttpd. I have enabled the module and set the extension, but it still doesn't work.
View 1 Replies
View Related
Jun 5, 2007
I installed modsecurity from Addone module in Cpanel
When I try to apply phpshell woork good without a mistakes and I can do anything despite of the presence of protection modsecurity and disable_functions in php.ini.
Is there a particular settings add to the httpd.conf to prevent application phpshell or prevent upload it to the site?
View 14 Replies
View Related
May 11, 2009
I tried using mod_security and mod_filter together. However, when I try to filter js files, I noticed that certain pages stop working, especially those using ajax.
View 2 Replies
View Related
Jul 24, 2009
I installed Mod_Security on my Cent OS server today and having some problem in configurating it.
Problem -
I have added this module in 'httpd.conf' file
Code:
<IfModule mod_security.c>
SecFilterEngine On
SecServerSignature "Apache"
SecFilterCheckUnicodeEncoding Off
SecAuditEngine RelevantOnly
SecAuditLog logs/audit_log
SecFilterScanPOST On
SecFilterDefaultAction "deny,log,status:403"
SecFilterSelective REQUEST_METHOD "^POST$" chain
SecFilterSelective HTTP_Content-Length "^$"
SecFilterSelective HTTP_Transfer-Encoding "!^$"
SecFilterSelective ARG_PHPSESSID "!^[0-9a-z]*$"
SecFilterSelective COOKIE_PHPSESSID "!^[0-9a-z]*$"
SecFilter "../"
SecFilter "viewtopic.php?" chain
SecFilter "chr(([0-9]{1,3}))" "deny,log"
SecFilterSelective THE_REQUEST "wget "
SecFilterSelective THE_REQUEST "lynx "
SecFilterSelective THE_REQUEST "scp "
SecFilterSelective THE_REQUEST "ftp "
SecFilterSelective THE_REQUEST "cvs "
SecFilterSelective THE_REQUEST "rcp "
SecFilterSelective THE_REQUEST "curl "
SecFilterSelective THE_REQUEST "telnet "
SecFilterSelective THE_REQUEST "ssh "
SecFilterSelective THE_REQUEST "echo "
SecFilterSelective THE_REQUEST "links -dump "
SecFilterSelective THE_REQUEST "links -dump-charset "
SecFilterSelective THE_REQUEST "links -dump-width "
SecFilterSelective THE_REQUEST "links http:// "
SecFilterSelective THE_REQUEST "links ftp:// "
SecFilterSelective THE_REQUEST "links -source "
SecFilterSelective THE_REQUEST "mkdir "
SecFilterSelective THE_REQUEST "cd /tmp "
SecFilterSelective THE_REQUEST "cd /var/tmp "
SecFilterSelective THE_REQUEST "cd /etc/httpd/proxy "
SecFilterSelective THE_REQUEST "/config.php?v=1&DIR "
SecFilterSelective THE_REQUEST "/../../ "
SecFilterSelective THE_REQUEST "&highlight=%2527%252E "
SecFilterSelective THE_REQUEST "changedir=%2Ftmp%2F.php "
# Very crude filters to prevent SQL injection attacks
SecFilter "delete[[:space:]]+from"
SecFilter "insert[[:space:]]+into"
SecFilter "select.+from"
# Weaker XSS protection but allows common HTML tags
SecFilter "<[[:space:]]*script"
# Prevent XSS atacks (HTML/Javascript injection)
SecFilter "<(.|n)+>"
</IfModule>
But my website is multi forum hosting and requires 'index.php' file to pass parameter to make it work.
Example -
[url]
[url]
[url]
So i had to delete below mention code from above module.
Code:
SecFilterSelective REQUEST_METHOD "^POST$" chain
SecFilterSelective HTTP_Content-Length "^$"
SecFilterSelective HTTP_Transfer-Encoding "!^$"
SecFilterSelective ARG_PHPSESSID "!^[0-9a-z]*$"
SecFilterSelective COOKIE_PHPSESSID "!^[0-9a-z]*$"
SecFilter "../"
View 0 Replies
View Related
May 25, 2009
Is it possible to disable a particular mod_security rule for particular directory or the rules are global?
View 4 Replies
View Related
Aug 15, 2008
I just installed mod_security via WHM, and want to know what rule should I enter to prevent some URLs from being opened.
For example, if URL contains word "abc" (like domain.com/some_folder/abc/file.php), it should not be opened.
View 4 Replies
View Related
May 20, 2009
I have installed a new server with debian lenny 5, ISPConfig 3.0.1.1 and the newest mod_security and implemented the default rules.
I deactivated the rule detecting IP in pageheaders.
Then I got another problem. Some actions of ISPConfig are detected as "remote file access attempt", severity "critical", tag "web attack/file injection" data "/etc/"
detected by rule file crs_40 line 114, id 950005
question: how do I authorize ISPConfig and only ISPConfig to perform such requests on the server?
View 4 Replies
View Related
Jun 4, 2008
how to set the rules of MOD_Security.
Another question for professionals:
Q: What are the best rules to secure my server? I'd appreciate if you managed to attach these rules to your replies. // FYI, I host VBulletin portals.
View 3 Replies
View Related
Dec 24, 2008
Trying to use an RBL with ModSecurity but this matches everything whether listed or not.
SecRule REMOTE_ADDR "@rbl bb.barracudacentral.org" "log,deny,msg:'POST RBL Comment Spammer'"
What I would like to do is do an RBL lookup and any POST operations.
View 2 Replies
View Related
Feb 25, 2008
make this rules work on apache 2 mod_security 2?
View 4 Replies
View Related
Dec 17, 2008
Any good secure rules for mod_security 2 that work well for shared servers?
Can someone share what rules you are using to secure your shared servers. Have tried a few different sets of rules, but a few customers always end up with errors and disabling it for their domain name doesn't sound like a safer option for them or the server.
Share your mod_sec 2 rules.
View 2 Replies
View Related
May 7, 2008
How can i disable some words from the contain of the page by Mod_Security2?
View 6 Replies
View Related
Jun 29, 2008
I've been having the hardest time getting mod_security on my new CentOS 5.2 64-bit box.
Everything is a straight, simple, standard install - nothing special or custom. Plesk and all the apps that come with it installed fine, everything was going great. Then I tried to compile mod_sec, and things have been nothing but problems. I think I've finally sorted out the problems with the compiler, but now I get this error:
/usr/bin/ld: warning: i386 architecture of input file `.libs/msc_lua.o' is incompatible with i386:x86-64 output
Repeated, for every file it tries to link.
View 3 Replies
View Related
Jun 17, 2008
I installed new cPanel server and enabled modsecurity inside
WHM > Manage Plugins > modsecurity
When I create a phpinfo() file, it doesn't showup. Are they any configuration that I should do? How about adding the rules?
View 6 Replies
View Related
Feb 16, 2008
Anyone care to share a good set of mod_security SecFilters?
Trying to find a good set that will be good at preventing exploits, but not too restrictive that it starts interfering with everyday operations.
View 5 Replies
View Related
Dec 14, 2008
i have search this forum and google.but none of them can help me to instal it.
i have centos with direct admin.
first i login via ssh to my server
~
then i wget the latest ver an untar it in ~ and go to /modsecurity-apache_2.5.7 folder and then apache2/
and run:
./configure
make
make install
and config httpd.conf
thats it.
is it right or not and how can i test it that is it work fine or not
View 2 Replies
View Related
