The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

mod_security issues

Discussion in 'Security' started by bsasninja, Jan 5, 2007.

  1. bsasninja

    bsasninja Well-Known Member

    Joined:
    Sep 2, 2004
    Messages:
    528
    Likes Received:
    0
    Trophy Points:
    16
    I have some rules in mod_security but they are making trouble with a webmail system. How do I disable mod_security for that domain?? which is the line I should add to the virtual host at httpd.conf ??

    Help will be appreciated.

    Thanks!!
     
  2. tweakservers

    tweakservers Well-Known Member

    Joined:
    Mar 30, 2006
    Messages:
    379
    Likes Received:
    0
    Trophy Points:
    16
    as far as you may concern, mod_security is loaded at Apache and compiled into and there's no option of disabling it per domain at the moment.
     
  3. simplybe

    simplybe Well-Known Member

    Joined:
    Nov 29, 2002
    Messages:
    153
    Likes Received:
    0
    Trophy Points:
    16
    htaccess can turn it off for a domain. add

    <IfModule mod_security.c>
    # Turn off mod_security filtering.
    SecFilterEngine Off

    # The below probably isn't needed.
    SecFilterScanPOST Off
    </IfModule>

    to their htaccess file, although it would be better to fix the rules if they are breaking webmail rather than leaving a domain un protected.

    You can add eclusions to mode sec, check the logs and see what is causing the problem and either remove the rule or add an exlusion for the script that is having problems.

    eg
    ###########################################
    #script exclusions
    ###########################################
    <LocationMatch "myscript.php">
    SecFilterInheritance Off
    </LocationMatch>
     
  4. ramprage

    ramprage Well-Known Member

    Joined:
    Jul 21, 2002
    Messages:
    667
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    Canada
    While this works, for a production environment mod_security should be compiled in with the option to not allow users to alter it with .htaccess.

    Instead the rules should be corrected or whitelist the user in httpd.conf
     
  5. kuwaitnt

    kuwaitnt Well-Known Member

    Joined:
    Oct 13, 2003
    Messages:
    75
    Likes Received:
    0
    Trophy Points:
    6

    how can we do it ??

    manual or from easyapache ?

    if manual can we know how ?
     
Loading...

Share This Page