Host mod_security rule alarm.........

I have recied an e-mail today, telling me that my site is raising alarms with my host mod_security rules. its causing errors, which caused them to turn off mod_security on my site as a result, without talking to me about it.

I discovered that by doing this, my site was open to attack. I have insisted that it has been turned back on, but they are still threatening to turn it off, as this is the only way to get rid of the alarms and errors.

This is what i got told were the reasons for the errors

--------------------------------------------------------------------------------------------------------------------------------

mod_security has certain rules for the words "pattern" used in online CMS and requested URL’s.
If any pattern match with the requested URL under your site or any online CMS try to put the words "Pattern" to Database . mod_security deny the access to it. Most of the CMS put the data in the Ddabase and edit / delete record from database and really need the mod_security disable.
We cannot modify the mod_security rules on shared server however can disable mod_sec for your site.

and they posted these two urls to show me why its rasing alarms, but it didnt make any sense to me, as I just couldnt understand it.

Refer following URL for detailed information about mod_security.
http://www.modsecurity.org/
http://www.modsecurity.org/documentation/

---------------------------------------------------------------------------------------------------------------------------------

This is the rule that they say I’m breaking

------------------------------------------------------------------------------------------------------------------------------
"SecRule REQUEST_HEADERS:User-Agent "(?:\b(?:(?:indy librar|snoop)y|microsoft url control|lynx)\b|d(?:ownload demon|isco)|w(?:3mirror|get)|l(?:ibwww|wp)|p(?:avuk|erl)|cu(?:sto|rl)|big brother|autohttp|netants|eCatch)" \
"chain,log,auditlog,msg:’Request Indicates an automated program explored the site’,id:’990011’,severity:’5’
SecRule REQUEST_HEADERS:User-Agent "!^apache.*perl"

------------------------------------------------------------------------------------------------------------------------

It states that it is something to do with the cms, which is modx.

Has anybody heard of this before, if they have can you help me with fixing it please?

Thank you.

John.

We recommend you turn off mod_security for your modx manager as this is a known issue. No one has come up with a ruleset tailored to modx yet, at least not that I’m aware.

Hi, thank you for your message. I mentioned that to my Host, and they have come back asking how do you turn it off just for the Manager?

How open does that leave the site, with it turned off?

A quick search above for turn off mod_security reveals tons of options, but most involve adding to your .htaccess:

Quote from: rthrash at Nov 17, 2008, 09:10 PM

A quick search above for turn off mod_security reveals tons of options, but most involve adding to your .htaccess:

<IfModule mod_security.c>
   # Turn off mod_security filtering.
   SecFilterEngine Off
</IfModule>

I think you mean to put this in .htaccess in the manager folder, not the root -- right?

I think so.

Hi, that’s why I asked, was a bit confused when looking in the search about where to put it. Needed to be sure.

Thank you so much for the help, I really appreciate it.

I’ve personally never run mod_security hence my uncertainty.

Hi, thank you for your message. Until I got the e-mail from the host, I didnt even know anything about it either.

By turning it off, how are we covered for security, does it leave the site open to attack?

That depends on the way your server is set up. I’ve never run it and never run into any attacks or had sites defaced because it wasn’t running. I don’t run on shared servers though and always have control over who else is on the servers, though.