Atomic Secured Linux and cPanel. Does it work?

[sOliver]

Thank you mike for the detailed answer. I wanted to let you know that your site is not working properly. I also tried accessing it via proxies.

AtomiCorp - Atomic Secured Linux (no response)
https://www.atomicorp.com/wiki/index...Security_Rules (text only)

Also, I read that the ruleset "useragents" bans spiders like google. I really can't afford that and I still don't know how to read the audit.log files properly to identify false positives. I have tons of files in /var/asl/data to check.

Will consider buying ASL when the site works again..

[mikegotroot]

We had a pretty major DNS outage due to register.com (no idea whats wrong on their end) which caused our domain to be unreachable sporatically, we've dropped register.com and have moved our DNS services and all is well again.

Regarding this question:

Also, I read that the ruleset "useragents" bans spiders like google. I really can't afford that and I still don't know how to read the audit.log files properly to identify false positives. I have tons of files in /var/asl/data to check.

I don't know who told you this, but its wrong. The useragents does not ban google, its not even possible for that ruleset to do that. And its just plain absurd, considering that we've been publishing and running our mod_sec rules longer than anyone else, and yet we show up just fine on google if our rules blocked google - we wouldnt show up on google searches at all, and yet we do. :-)

So no, they dont ban spiders, they dont ban google - they are perfectly safe to run.

[Secmas]

I don't know who told you this, but its wrong. The useragents does not ban google, its not even possible for that ruleset to do that. And its just plain absurd, considering that we've been publishing and running our mod_sec rules longer than anyone else, and yet we show up just fine on google if our rules blocked google - we wouldnt show up on google searches at all, and yet we do. :-)

So no, they dont ban spiders, they dont ban google - they are perfectly safe to run.

Mike is right, I have been using ASL rules and I don't have any block to spiders.

Sergio

[mikegotroot]

If I didnt mention it earlier, a new version of asl-lite is out with static builds that should work on any Linux distro with any control panel, and an even newer version is in the testing channel with lots of new features.

Also, the dev team is working feverishly on the cpanel version of ASL, you can follow and participate in the development discussion here:

https://www.atomicorp.com/forums/vie...=4534&start=30

[mikegotroot]

If anyone is interested in the private Beta of ASL with cpanel, please send me an email at mike AT atomicorp DOT com. The beta is free, and if you help us squash bugs we'll throw in a one year license once we release the gold build.

[rpmws]

only been waiting 3 months !! lol

i have a paid sub and haven't even used rulesets yet

[mikegotroot]

Definitely shoot me an email so I can get you the code then! :-)

For the rules, are you having some kind of issue loading them? They work now with cpanel.

[mikegotroot]

So the private beta went swingingly well. We are now on to public testing! Which means the final build isn't that far away.

The first public builds of the cpanel compatible version of ASL are now available, if you wish to try it out please see the forum thread below for instructions and details:

https://atomicorp.com/forum/viewtopic.php?f=21&t=4828

And as always, ASL-Lite is available for cpanel now and is fully supported.

[mikegotroot]

ASL 3.0 is now available, with full cpanel support. You can read more about the release here:

https://www.atomicorp.com/forums/vie...php?f=8&t=5166

[Hosting France]

Hi Mike

ASL 3.0 works with H1 Software ?

[hostnex]

We used to use ASL lite paid version and had allot of issues like server just went down several times a day and Apache was eating all ram. If we disabled ASL rules then everything goes well. We even opened tickets on their support and answer was we cant help you. If we are running your rules and it took our servers down then who is responsible you or Apache ? Also it was not happening on one server but on all different servers. Even we deployed it on fresh servers and same was happening.

Here is their reply which support person sent me .

" We're sorry to hear that. Thats a memory leak then in modsecurity itself, and not something we can fix for you via the rules. We recommend you either upgrade to ASL, which uses our version of modsecurity and is fully supported, or you discuss this memory leak with cpanel if you do not wish to use our version of modsecurity "

[mikegotroot]

We would be happy to help you with this issue. I believe you may have midunderstood the license you purchased. You did not purchase or install Atomic Security Linux (ASL) You only purchased support for the rules (ASL-Lite), and then installed and configured the rules and modsecurity yourself. You did not purchase any software from us that installed or configured modsecurity. ASL-Lite only includes the rules, and does not come with modsecurity, does not configure modsecurity and as such does not come with support for modsecurity. ASL-Lite is for users that are comfortable supporting and building modsecurity themselves.

It sounds like you need a supported installation of modsecurity as well as full support for modsecurity - which we also offer (and with a free trial). To get that, just visit the URL below to get a correct license, Atomic Secured Linux not ASL-Lite. ASL will automatically install modsecurity with a fully supported configuration. You can get an ASL license from this URL:

https://www.atomicorp.com/amember/signup.php

The ASL license includes and installs modsecurity and of course comes with full support for modsecurity so just visit that URL to get a license for ASL and we'd be happy to help you with this issue. As I'm sure you understand, we support our software and since you are not running our software its understandable that we wouldn't support someone elses.

And if you prefer to try ASL before you make any purchasing decision, just install the free 30 day trial of ASL. If that doesnt resolve the issue for you (which comes with free support during the 30 days) then you havent spent a cent. I'm confident that your issue will be resolved by simply installing ASL, lots of folks use our rules and ASL without any trouble and with ASL installed we would be happy to help you with that issue and if by some chance ASL doesnt resolve this for you, will get it resolved for you regardless. So what do you have to lose? You'll have modsecurity working correctly and all for free. You can get your free ASL trial from this URL:

https://www.atomicorp.com/products/aslfreetrial.html

If you prefer to roll your own modsecurity configuration and want to build and provide your own build of modsecurity (which it sounds like you are currently doing), then please make sure you have configured modsecurity exactly as described in the wiki here:

https://www.atomicorp.com/wiki/index...Security_Rules

Please understand that we do not support third party modsecurity configurations or builds with our either ASL or ASL-Lite licenses.

With that said, if you do want to roll your own modsecurity build and configuration and you want it to be supported we can help you with that. We will support a custom modsecurity configuration if we build it and set it up for you. So, if you prefer to have a custom modsecurity build and configuration supported by us, we would be happy to help you with that too. Just let us know and will we will have our professional services group put together a services quote. Just contact us at support at this email address:

support AT atomicorp DOT com

My advice would be to just install the ASL trial, as we said in the email that you quote, we can support any issue you may have with our software. And the additional upside of the free trial is that you will have a working and supported modsecurity configuration that we can help you with right now, and you can do all of this for free - right now.

I do wish there was a way we could help you with someone elses software and configuration, but I think you'll agree thats not something any software company should be expected to do, especially when they offer a working version of their software for free.

Of course if you don't want to take any of these options I'd be happy to take a look at your system on my own time to see whats going on and then let everyone know what was wrong with your system so they can avoid those problems in the future. Just shoot me an email at mike AT atomicorp DOT com.

And if you don't want to do any of this, then I wish there was some other way we could help you and wish you the best of luck with your own efforts. We certainly offer a full range of supported options, including free trials and free support for our trials. So as said before, I encourage you to use one of our supported options so you can begin enjoying the full benefits of modsecurity, and if you choose to go it your own way then I wish you the best of luck. We have free rules and free documentation to configure them you can avail yourself of right now as well.

[LBJ]

We used to use ASL lite paid version and had allot of issues... Also it was not happening on one server but on all different servers. Even we deployed it on fresh servers and same was happening.

For the benefit of other cPanel users considering asl-lite (and presumably also the main asl product), we had the same experience both with the application itself and with the support system provided by atomicorp.

Their asl-lite application failed to install on 4 separate clean installs of cPanel under Centos 5.7 with a problem reported in their forums on multiple locations dating back a few months. Installing just the asl-lite rules updater alone results in a swag of dependencies being installed and a crash in the installation near the end of the routine.

Their very slow ticket support system replied with a vague transfer of the problem to cPanel as per "Try running the installer again, we just pushed out a fix for a pretty nasty bug we found in cpanel. Theres a new subsystem in that update for that particular part of the installer as well, I think it probably addresses the condition you're running in to."

With that, our ticket was set to "closed - pending" and although we updated the ticket to explain that the update did not fix the installation, the ticket remained set that way.

Our advice for cPanel users is to forget the asl line of applications. I believe that although they claim compatibility with cPanel, their testing with the cPanel platform is very limited. Further, their slow 9 to 5 weekdays only support is not really suitable for typical 24 x 7 hosting operations where systems are commercially important.

Regards,

LBJ