mod_security: what exactly does it block?
mod_security is one of the important security tweak we perform on a server when try to secure our server. mod_security integrates with Apache to stop attackers from being able to issue commands to the server through vulnerable scripts and software packages which are installed on the server. By default, mod_security blocks from being called from within a URL.
- wget
- lynx
- curl
- tar
- uname
- g
- gcc
- nmap
- .bash_history
- /etc/passwd
- /bin/ps
- /usr/bin/id
- /bin/kill
- /usr/bin/gcc
- /bin/mail
- /bin/ping
- /bin/ls
- lsof
- perl
- 0a.pl
- “img xsrc=javascript”
- /~nobody
- /~root
- /~ftp
- formmail.cgi
- formmail.pl
- formmail.php
- /modules/My_eGallery
- telnet.pl
- telnet.cgi
- shell.pl
- shell.cgi
- shell.php
Again, this list does not mean you cannot use features like “tar” in your programs. You just can’t include “tar” in the URL bar.
To modify your mod_security configuration file, you would want to:
1. Login to your server as root.
2. Open the file /usr/local/apache/conf/mod_security.conf
pico -w /usr/local/apache/conf/mod_security.conf
3. Search for any directive you might want to remove (such as “tar”) and put a “#” at the start of the line. This will “comment” that directive out where the server will essentially ignore it. If you wish to add a directive, just scroll to the bottom of the file and use:
SecFilter “phrasetoblock”
4. Save your changes and restart Apache.
service httpd restart
