Hello good to have everything complete with this me vale ??? CPanel Service Package
+ MailScanner Front-End
Or those of scan viruses are apart and the mail ???

One of our clients reported an issue with loading their domain. On checking we could see a mod security rule (ID: id 1234123413 ) has been triggered and which caused the issue. We have then whitelisted the rule in the server, but upon checking we could see that the rule was not whitelisted properly and triggered again.

Logs shown in apache error logs are.

-------------------
ModSecurity:...

After uninstalling, and reinstalling to 2.09, the WHM UI will not load.

We see stuck process

root 160020 0.5 0.0 56884 16860 ? S 11:22 0:00 | \_ /usr/local/cpanel/3rdparty/bin/perl /usr/local/cpanel/whostmgr/docroot/cgi/configserver/cmc.cgi

we straced this process from a few milliseconds after it was created, and it stops in the same place every time

11:22:47.342042 stat(...

11.46 adds ModSecurity features to WHM/cPanel which on the face of it seems like a great thing but is it?

Does it conflict with ConfigServer's ModSecurity Control?

Hi,

I am getting this in the modsec log;

---
collections_remove_stale: Failed to access DBM file /var/cpanel/secdatadir/ip : Permission denied
---

Any advice?

/Tommy

I am using joomla and the modsec system keeps blocking a certain person from uploading stories to joomla.

Is there a way to whitelist the ip address for that user in modsec?

Regards
Tim.

Hello,

It seems the plugin after installed by cPanel Server Service, without any of my interference does not display or read the logs, it display this error.

ConfigServer ModSecurity Control - cmc v2.01

Displaying logs from /etc/apache2/logs/modsec_audit/

No entries found in /etc/apache2/logs/modsec_audit.log

root@panel # stat /etc/apache2/logs/modsec_audit.log
File:...

Hello,

I have issue with CMC. when IN CMC I amd doing whitelist rule for any domain it is wnot working.

For example in mod security I have make rule for block china. but when for one I am white-listing that rule in CMC it is not working. can you please update what can be cause ?

Hi,

We run a performance server for our clients who use Magento mainly and Zen Cart. The problem we keep having is our clients are getting blocked when out of the office.

Magento CSF

Time: Wed May 25 14:34:35 2016 -0400
IP: 24.56.254.30 (US/United States/c-24-56-254-30.customer.broadstripe.net)
Failures: 5 (mod_security)
Interval: 3600 seconds
Blocked: Permanent Block (IP match in...

Had to replace a hard drive in my server and kept the old one mounted for reference. Would like to transfer over my previous whitelisted rule id's for each domain that I created on the old drive but cannot seem to find the right files. Anyone point me in the right direction?

Hi,
I am seeing that since cPanel added the Mod_Security tools, the CMC option to set one domain with rules off is no longer working.

Is this an incompatibility?

Also, since cPanel added the Mod_Security option, the files ip.dir and ip.pag
are growing so huge that CMC now is showing the following error:
collections_remove_stale: Failed deleting collection (name ip , key xx.xx.xx.xx ):...

Hi,

i find some people recommend comodo,
but i feel their updating speed is not as quick as i expect.
do you use which rule to protect your sites ?

I got the following notifcation logging into one of my cpanel servers this morning.

OWASP rules for ModSecurity™ More Information
The OWASP ModSecurity CRS is a set of rules for use with the ModSecurity Apache module aimed at protecting your web server from malicious traffic. Through the guidance of OWASP, cPanel is now distributing a curated set of these rules. You can install and manage...

Hello,
I use CMC for long time to disable mod_security for espeficic cpanel accounts.
Now Cpanel has a feature to disable mod_security (ModSecurity™ Domain Manager), but if I disable mod_security for an account from CMC, does not appear disabled in Cpanel ModSecurity™ Domain Manager .

What interface is really controlling the mod_security for each user/domain?

Dear All,

I'm having a problem when turning off one of my client domain by CMC, even i did turn off, the rules is still active for that domain, until i i look into /usr/local/apache/conf/userdata/std/2/username/modsec.conf and its show:

<LocationMatch .*>
SecRuleEngine Off
</LocationMatch>

So i try to change it to:

<IfModule mod_security2.c>
SecRuleEngine Off...

Hello

We have a ton of false positive with rules 340206 under /usr/local/apache/conf/modsec_rules/70_asl_csrf_experimental.conf

So, we have first try to disable rule for user : not work
after, we try to disable rule for user and domain : not work
after, we try to disable rule globally : not work

Best regards

Hello,

we are looking at implementing Mod Ruid w/Mod Security via the WHM Easyapache to address the Symlink Protection Advisory issue. We are currently using CMC which works with the mod audit log. But when using Mod Ruid with Mod Security the location of the mod audit log is changed. According to the documentation:

If you install Mod Ruid2 and Mod Security, the Mod Security log location...

Howdy,

I just had to remove mod_security from my Apache build because of an incompatibility with Ruid2.

Is it best to remove cmc also, or am I OK leaving it installed?

I hope to use mod_sec one day when the issue is resolved.

TIA!

Hi,

I am just wondering that if copyacct is performed between two servers running ConfigServer ModSecurity Control, does the whitelist get copied as part of this process, or does it need to be done manually?

Thanks and kind regards,
Paul.

Will cmc work when the rulesets are specified in the config file via Include directives as opposed to the actual rules being posted in the config file.

For example, here is my mod_sec config:

SecRequestBodyAccess On
SecDataDir /var/tmp
SecTmpDir /var/tmp
SecPcreMatchLimit 150000
SecPcreMatchLimitRecursion 150000
Include /usr/local/apache/conf/modsec2/00_asl_whitelist.conf...