Community Forums
Connect with us on LinkedIn
Community Notice
+ Reply to Thread
Results 1 to 2 of 2
  1. #1
    Member
    Join Date
    Sep 2004
    Posts
    38

    Default Mod Security but how?

    Hi friends.

    Im new. I install mod_security for apache. My server have redhat 9.0, cpanel+whm. Where i must paste it?

    Code:
    <IfModule mod_security.c>
        # Turn the filtering engine On or Off
        SecFilterEngine On
    
        # Change Server: string
        SecServerSignature " "
    
        # Make sure that URL encoding is valid
        SecFilterCheckURLEncoding On
    
        # This setting should be set to On only if the Web site is
        # using the Unicode encoding. Otherwise it may interfere with
        # the normal Web site operation.
        SecFilterCheckUnicodeEncoding Off
    
        # Only allow bytes from this range
        SecFilterForceByteRange 1 255
    
        # The audit engine works independently and
        # can be turned On of Off on the per-server or
        # on the per-directory basis. "On" will log everything,
        # "DynamicOrRelevant" will log dynamic requests or violations,
        # and "RelevantOnly" will only log policy violations
        SecAuditEngine RelevantOnly
    
        # The name of the audit log file
        SecAuditLog /var/log/httpd/audit_log
    
        # Should mod_security inspect POST payloads
        SecFilterScanPOST On
    
        # Action to take by default
        SecFilterDefaultAction "deny,log,status:500"
    
        # Require HTTP_USER_AGENT and HTTP_HOST in all requests
        SecFilterSelective "HTTP_USER_AGENT|HTTP_HOST" "^$"
    
        # Prevent path traversal (..) attacks
        SecFilter "../"
    
        # Weaker XSS protection but allows common HTML tags
        SecFilter "<[[:space:]]*script"
    
        # Prevent XSS atacks (HTML/Javascript injection)
        SecFilter "<(.|n)+>"
    
        # Very crude filters to prevent SQL injection attacks
        SecFilter "delete[[:space:]]+from"
        SecFilter "insert[[:space:]]+into"
        SecFilter "select.+from"
    
        # Protecting from XSS attacks through the PHP session cookie
        SecFilterSelective ARG_PHPSESSID "!^[0-9a-z]*$"
        SecFilterSelective COOKIE_PHPSESSID "!^[0-9a-z]*$"
    </IfModule>

    Help me please

  2. #2
    Member sawbuck's Avatar
    Join Date
    Jan 2004
    Posts
    1,310
    cPanel/Enkompass Access Level

    Root Administrator

    Default

    If you installed mod_security from WHM or from source those directives are placed in the httpd.conf file.

Similar Threads & Tags
Similar threads

  1. Mod Security
    By aaronkolodjski in forum Security
    Replies: 7
    Last Post: 12-20-2009, 06:50 PM
  2. Mod Security?!
    By reporter in forum cPanel and WHM Discussions
    Replies: 15
    Last Post: 11-18-2009, 05:16 PM
  3. Mod security
    By black&white in forum cPanel and WHM Discussions
    Replies: 1
    Last Post: 06-19-2008, 12:16 PM
  4. Mod Security 2.5, or 2.0?
    By sh4ka in forum cPanel and WHM Discussions
    Replies: 0
    Last Post: 04-21-2008, 12:20 PM
  5. Simple security question about mod-security rule sets.
    By jols in forum cPanel and WHM Discussions
    Replies: 1
    Last Post: 08-09-2007, 05:37 AM
Linkedin       Facebook       Twitter       RSS       Flickr       YouTube