Hi guys,

We run a bunch of cPanel servers where we use the cPanel Mod_security vendor functionality, and there we include the Comodo WAF ruleset ( )

To control Mod_security further we use the CMC, since we can disable rules per site level if we want to.

One rule though (ID 220030) we disable globally through CMC, because the rule only applies to PHP versions before 5.4.2 (not something...

Hi.

Actually CMS write a file modsec.conf on userdata/*/*/<user>*/ for Cpanel Servers.

Example
<LocationMatch .*>
SecRuleRemoveById 340149
SecRuleRemoveById 340029
</LocationMatch>

If there some problem woth mod_security, and Sys admin need remove mod_security form his Apache conf, appache not start because Apache read this files and if mod_security it's deactivate...

Hello,

What about making a Auto Update on cmc as you have on csf/lfd?
Or setup a cron job so it get automatically updated? :)

Occasionally we use Modify User Whitelist to disable Mod Security for a customer, as part of some troubleshooting. Sometimes we forget to turn it back on. :-(

I would like to see something obvious on the main CMC page, that makes it clear that there are users that are currently whitelisted. Short of that, if there was a place we could go to in CMC to at least see which users are whitelisted,...

I noticed in your requirements that CMC requires mod_security installed via easyapache, and after the hassle I ran into with this particular combination of software, I can see why.

The Atomicorp WAF rules do something interesting to the easyapache build order. Specifically, they remove mod_security from the easyapache build, and then add it back in during the posteasyapache step....

Hi Jonathan / Sarah,
what file may I have to tweak in order to have the country code with IP on the CMC log?

It will be great to have the IP and 2 letter country code, so, in a glance we can see what country that IP belongs to.

If it is not possible to add it to the script, may I can have the command to add it myself?

Thanks a lot in advance.

Regards,

Sergio

Hi
i suggest please release DirectAdmin Version for this Plugin !!!
tnx

It would be nice to be able to refresh the mod_security log file view screen manually. The automatic refresh is too fast at times and it is a pain to have to go back and reclick to see the next N entries. Why not make a link on the page that reloads the contents, like the autorefresh does.

Previously, I want to apologize for having to discuss anything outside the forum topic.

I wish to discuss the feature that have the same ability with ModSecurity ConfigServer Control. As we know, with the help of suPHP on cPanel we've got some options settings PHP.INI

1) You can allow the users to set up Their own php.ini files as They see fit. This is the default configuration.

2) You...

Hi Chirpy,
is it possible to have the Restart of Apache in a switch of automatic yes or no?

What I mean is this, if you are fixing one rule, is ok to have the automatic restart, but if you are fixing two or more rules, apache has to restart for every single change and that is not worth it.

So, it will be great if we could decide if the restart is automatic or manual.

Regards,

Sergio

Hi Jonathan,
it will be nice that the page that shows ModSec errors could be reloaded in an interval of time that will help us to debug any error a customer on a false positive could have.

It will be nice that we could modify that time interval.

Regards,

Sergio

Hey,

I was just using CMC and it doesnt give a 'idiots guide' of how to set it up like CSF does? Could we either make one or try making it easier?

I see you can disable a ar rule ID by domain, but is there a way by directory?
Either on a per domain basis like
/home/username/public_html/foldername/

or for a directory server wide like
/home/*/public_html/foldername

If this cannot be done through cmc, is there a way manually, and could this be added to cmc?

Thanks!

Tom

This is a long term one perhaps...

I was working through mod_security logs and thinking 'I wonder which sites and which rules are getting the most attention?'.

So, how about some kind of statistics tracking for sites and rules. It'd help with security if we knew which sites get hit a lot and which rules are being triggered.

How about have the log area have a search/filter area like the WHM plugin. Would be nice to have the best of both worlds in a single location.

Hi Chirpy,
- It will be really nice to have it there an UPLOAD RULES section, so we can upload files or TAR files with the latest rules files.

- Also, it will be great to have a button that TEST APACHE so we can see that the rules will work OK before to get them in production.

This two options will do a great improvement in a really nice script.

Best Regards,
Sergio

Is it possible to create an icon in CP that allows CP users to filter view their domain? Each rule that was tripped would hook into the CP request support which is defined in cpanel so that they could inform the administrator that a rule was tripped and requires white listing for that domain?