The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

block userAgent on server, with mod_security?

Discussion in 'Security' started by upsforum, Nov 26, 2013.

  1. upsforum

    upsforum Well-Known Member

    Joined:
    Jul 27, 2005
    Messages:
    446
    Likes Received:
    0
    Trophy Points:
    16
    What is best solution for block specific userAgent on all websites of server? I have any client that use joomla with old versions insicure, for example this vulnerability:

    POST /index.php?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager&version=1576&cid=20 HTTP/1.1" 200 10 "-" "BOT/0.1 (BOT for JCE)"

    what is best solution for block it on all accounts of server?
     
  2. Deehem

    Deehem Member
    PartnerNOC

    Joined:
    Jul 6, 2006
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Preston, UK
    cPanel Access Level:
    DataCenter Provider
    Instead of using modsec to achieve this, you could use bad-bot-blocker in a global .htaccess file.

    An example of b-b-b can be found here.
     
  3. upsforum

    upsforum Well-Known Member

    Joined:
    Jul 27, 2005
    Messages:
    446
    Likes Received:
    0
    Trophy Points:
    16
    can I post this also in Apache Configuration -> Include Editor -> Post VirtualHost Include right?

    thank you
     
  4. upsforum

    upsforum Well-Known Member

    Joined:
    Jul 27, 2005
    Messages:
    446
    Likes Received:
    0
    Trophy Points:
    16
    I added in /home/.htaccess but get a internal server error
     
  5. Deehem

    Deehem Member
    PartnerNOC

    Joined:
    Jul 6, 2006
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Preston, UK
    cPanel Access Level:
    DataCenter Provider
    Do you have the correct permissions on that file? What does the apache error_log file say?

    644 should suffice for /home/.htaccess :)
     
  6. upsforum

    upsforum Well-Known Member

    Joined:
    Jul 27, 2005
    Messages:
    446
    Likes Received:
    0
    Trophy Points:
    16
    I removed ips and now work fine, thank you
     
  7. quizknows

    quizknows Well-Known Member

    Joined:
    Oct 20, 2009
    Messages:
    942
    Likes Received:
    57
    Trophy Points:
    28
    cPanel Access Level:
    DataCenter Provider
    These are the rules I use for that attack:
    Code:
    
    #Joomla com_jce exploit
    SecRule HTTP_User-Agent "BOT for JCE" "deny,status:500,id:5000218,msg:'Joomla com_jce code exec'"
    
    #Joomla com_jce exploit
    SecRule REQUEST_URI "/images/stories/.+\.php" "deny,status:500,id:5000219,msg:'Joomla com_jce code exec'"
    
    The first blocks the user agent. That exploit puts PHP files into site.com/images/stories/something.php if it is successful, so the 2nd rule blocks access to those in case they change user agent.

    Even with the .htaccess or this first rule, you should still use the 2nd rule. Changing user agents is very simple.
     
    #7 quizknows, Nov 26, 2013
    Last edited: Nov 26, 2013
Loading...

Share This Page