Stop Cpanel Update from Overwriting modsecurity rule changes

[damonl]

I've got a managed dedicated server that has less than 30 different accounts/domains.

The server is
CENTOS 5.9 x86_64 standard – WHM 11.34.1 (build 7)

My problem is that the default modsecurity rules evidently block curl when called from either an ssh session or cron job.

The rule blocks certain user agents, also lynx. One domain runs an application that relies on daily external updates called by a cron job like

curl -d "user_name=username&user_pass=password" http://www.example.com/admin/example.php?action=update

When I complained to my server company abour the cron failing they found and disabled the user agent rule, but then after the next cpanel update the rule was back.

They say there is no way around this and my only option is to disable modsecurity completely for the domain.

Does that sound right? Seems like there should be a way.

 

[Phincy]

Hi damonl,

I am not certain how the mod_sec rules are changed by the cPanel update. However, you can exclude files by adding their full path to the following file.

---
/etc/cpanelsync.exclude
---

The cPanel update will not change the files that are listed in the above mentioned configuration file.

Regards,

 

[Infopro]

Stop Cpanel Update from Overwriting modsecurity rule changes

This post is relevant I believe:
ModSecurity Changes in EasyApache 3.16 - cPanel Forums

They say there is no way around this and my only option is to disable modsecurity completely for the domain.

That is incorrect. For example you could simply disable the one rule, for the one domain if you wanted to, with this:
ConfigServer ModSecurity Control

 

[quizknows]

Normally cPanel does not maintain or modify your mod_security rules, that would be you or your host.

it's very easy to exclude just the offending rule ID either globally or for the domain in question. If you don't have good working knowledge of mod_security, then configserver modsec control is a good option. I advise you school the tech who told you that you have to disable mod_security completely, or find a host that knows how to maintain the rules and handle false-positives. That should have been a 5 minute phone call ending with "OK, I've added a LocationMatch to exclude that rule ID for you, please try again."