|
[-]
[+]
|
Changed |
mod_security-ix.changes
|
|
|
|
[-]
[+]
|
Changed |
mod_security-ix.spec
^
|
|
|
|
[-]
[+]
|
Deleted |
CVE-2013-2765.patch
^
|
| @@ -1,10 +0,0 @@
---- modsecurity-apache_2.6.8/apache2/msc_reqbody.c.orig 2013-06-29 18:56:31.446864803 +0200
-+++ modsecurity-apache_2.6.8/apache2/msc_reqbody.c 2013-06-29 18:56:45.354863561 +0200
-@@ -170,6 +170,7 @@
-
- /* Would storing this chunk mean going over the limit? */
- if ((msr->msc_reqbody_spilltodisk)
-+ && (msr->txcfg->reqbody_buffering != REQUEST_BODY_FORCEBUF_ON)
- && (msr->msc_reqbody_length + length > (apr_size_t)msr->txcfg->reqbody_inmemory_limit))
- {
- msc_data_chunk **chunks;
|
|
[-]
[+]
|
Deleted |
mlogc-disable-force-sslv3.patch
^
|
| @@ -1,11 +0,0 @@
---- mlogc/mlogc.c.orig 2012-03-05 17:20:00.254555490 +0100
-+++ mlogc/mlogc.c 2012-03-05 17:20:10.430753985 +0100
-@@ -1214,7 +1214,7 @@
- curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, FALSE);
- curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0);
- /* SSLv3 works better overall as some servers have issues with TLS */
-- curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_SSLv3);
-+ /* curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_SSLv3); */
- curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 15);
- curl_easy_setopt(curl, CURLOPT_NOSIGNAL, TRUE);
- curl_easy_setopt(curl, CURLOPT_HEADER, TRUE);
|
|
[-]
[+]
|
Deleted |
modsecurity-2.9.1_curl-lower_7.34.patch
^
|
| @@ -1,60 +0,0 @@
---- mlogc/mlogc.c.orig 2016-06-02 09:15:03.283648355 +0200
-+++ mlogc/mlogc.c 2016-06-02 10:59:44.378377602 +0200
-@@ -1270,33 +1270,36 @@
- }
-
-
-- /* Seems like CURL_SSLVERSION_TLSv1_2 is not supported on libcurl
-- * < v7.34.0
-- *
-- * version_num is a 24 bit number created like this:
-- * <8 bits major number> | <8 bits minor number> | <8 bits patch number>.
-- */
-- switch (tlsprotocol) {
-- case 0:
-- curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_0);
-- break;
-- case 1:
-- curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_1);
-- break;
-- case 2:
-- curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2);
-- break;
-- default:
-- curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2);
-- break;
-- }
- cmaj = curlversion->version_num >> 16;
- cmin = (curlversion->version_num & 0x00ff00) >> 8;
- cpat = (curlversion->version_num & 0x0000ff);
- /* If cURL version < v7.34.0, use TLS v1.x */
- if (cmaj <= 7 && cmin < 34) {
- curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);
-- }
-+#ifdef CURL_SSLVERSION_TLSv1_0
-+ } else {
-+ /* Seems like CURL_SSLVERSION_TLSv1_2 is not supported on libcurl
-+ * < v7.34.0
-+ *
-+ * version_num is a 24 bit number created like this:
-+ * <8 bits major number> | <8 bits minor number> | <8 bits patch number>.
-+ */
-+ switch (tlsprotocol) {
-+ case 0:
-+ curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_0);
-+ break;
-+ case 1:
-+ curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_1);
-+ break;
-+ case 2:
-+ curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2);
-+ break;
-+ default:
-+ curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2);
-+ break;
-+ }
-+#endif
-+ }
-
- curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 15);
- curl_easy_setopt(curl, CURLOPT_NOSIGNAL, TRUE);
|
|
[-]
[+]
|
Deleted |
00_mod_security.conf.suse
^
|
| @@ -1,18 +0,0 @@
-# Example configuration file for the mod_security Apache module
-
-#LoadModule security2_module modules/mod_security2.so
-#LoadModule unique_id_module modules/mod_unique_id.so
-# run:
-# a2enmod unique_id
-# a2enmod security2
-
-<IfModule mod_security2.c>
- # This is the ModSecurity Core Rules Set.
-
- # Basic configuration goes in here
- Include /etc/apache2/modsecurity.d/modsecurity_crs_10_config.conf
-
- # Rule management is handled by ASL
- Include /etc/apache2/modsec/*asl*.conf
-
-</IfModule>
|
|
[-]
[+]
|
Added |
mod_security-ix.spec2513
^
|
| @@ -0,0 +1,110 @@
+Summary: Security module for the Apache HTTP Server
+Name: mod_security
+Version: 2.6.1
+Release: 23
+License: GPLv2
+URL: http://www.modsecurity.org/
+Group: System Environment/Daemons
+Source: http://www.modsecurity.org/download/modsecurity-apache_%{version}.tar.bz2
+Source1: 00_mod_security.conf
+Source2: modsecurity_crs_10_config-default.conf
+Source3: zzz_asl_custom_exclude.conf
+Source4: zzz_asl_custom_local_exclude.conf
+Patch1: waf-label.patch
+BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
+Requires: httpd httpd-mmn = %([ -a %{_includedir}/httpd/.mmn ] && cat %{_includedir}/httpd/.mmn || echo missing)
+BuildRequires: httpd-devel libxml2-devel pcre-devel libtool pkgconfig curl-devel
+BuildRequires: curl
+BuildRequires: lua-devel
+
+Requires: libxml2 pcre lua
+Provides: ix-mod_security = %{version}
+
+%description
+ModSecurity is an open source intrusion detection and prevention engine
+for web applications. It operates embedded into the web server, acting
+as a powerful umbrella - shielding web applications from attacks.
+
+%prep
+%setup -n modsecurity-apache_%{version}
+%patch1 -p1
+
+%build
+CFLAGS="%{optflags}"
+export CFLAGS
+
+cd apache2
+%configure \
+ --disable-pcre-match-limit \
+ --disable-pcre-match-limit-recursion
+
+# Legacy from LoadFile
+#perl -pi.orig -e 's|LIBDIR|%{_libdir}|;' %{SOURCE1}
+
+make %{_smp_mflags}
+
+%install
+rm -rf %{buildroot}
+mkdir -p %{buildroot}/%{_sysconfdir}/httpd/modsecurity.d/
+mkdir -p %{buildroot}/%{_sysconfdir}/httpd/conf.d/
+mkdir -p %{buildroot}/var/asl/data/suspicious
+mkdir -p %{buildroot}/var/asl/data/msa
+mkdir -p %{buildroot}/var/asl/data/audit
+install -D -m755 apache2/.libs/mod_security2.so %{buildroot}/%{_libdir}/httpd/modules/mod_security2.so
+install -D -m644 %{SOURCE1} %{buildroot}/%{_sysconfdir}/httpd/conf.d/00_mod_security.conf
+install -D -m644 %{SOURCE2} %{buildroot}/%{_sysconfdir}/httpd/modsecurity.d/modsecurity_crs_10_config.conf
+install -D -m644 %{SOURCE3} %{buildroot}/%{_sysconfdir}/httpd/modsec/zzz_asl_custom_exclude.conf
+install -D -m644 %{SOURCE4} %{buildroot}/%{_sysconfdir}/httpd/modsec/zzz_asl_custom_local_exclude.conf
+install -D -m755 rules/util/modsec-clamscan.pl %{buildroot}%{_bindir}/modsec-clamscan.pl
+
+%clean
+rm -rf %{buildroot}
+
+%files
+%defattr (-,root,root)
+%doc CHANGES LICENSE README.* modsecurity* doc
+%{_libdir}/httpd/modules/mod_security2.so
+%{_bindir}/modsec-clamscan.pl
+%config %{_sysconfdir}/httpd/conf.d/00_mod_security.conf
+%dir %{_sysconfdir}/httpd/modsecurity.d
+%config(noreplace) %{_sysconfdir}/httpd/modsecurity.d/modsecurity_crs_10_config.conf
+%config %{_sysconfdir}/httpd/modsec/zzz_asl_custom_exclude.conf
+%config(noreplace) %{_sysconfdir}/httpd/modsec/zzz_asl_custom_local_exclude.conf
+
+%defattr(-,apache,apache)
+%dir /var/asl
+%dir /var/asl/data
+%dir /var/asl/data/suspicious
+%dir /var/asl/data/msa
+%dir /var/asl/data/audit
+
+%changelog
+* Mon Jun 27 2011 Carsten Schoene <cs@linux-administrator.com> - 2.5.13-23
+- rename 999_asl_custom_exclude.conf to zzz_asl_custom_exclude.conf
+- rename 999_asl_custom_local_exclude.conf to zzz_asl_custom_local_exclude.conf
+
+
+* Mon Jun 06 2011 Carsten Schoene <cs@linux-administrator.com> - 2.5.13-21
+- added 999_asl_custom_local_exclude.conf with noreplace
+- set 999_asl_custom_exclude.conf to replace
+
+* Mon Jun 06 2011 Carsten Schoene <cs@linux-administrator.com> - 2.5.13-20
+- added rules to excludelist:
+ - 350147
+ - 350148
+ - 340162
+
+* Fri May 06 2011 Carsten Schoene <cs@linux-administrator.com> - 2.5.13-19
+- rename exclude config file from 00_asl_custom_exclude.conf to 999_asl_custom_exclude.conf
+
+* Thu May 05 2011 Carsten Schoene <cs@linux-administrator.com> - 2.5.13-18
+- disable clamav check rule 351000 by default
+
+* Tue May 03 2011 Carsten Schoene <cs@linux-administrator.com> - 2.5.13-17
+- add 00_asl_custom_exclude.conf and disable RBL rule 350000 by default
+
+* Fri Apr 01 2011 Carsten Schoene <cs@linux-administrator.com> - 2.5.13-16
+- update to release 2.5.13
+
+* Wed Nov 24 2010 Carsten Schoene <cs@linux-administrator.com> - 2.5.12-15
+- initial InterNetX GmbH specific mod_security build
|
|
[-]
[+]
|
Deleted |
modsec-clamscan.pl
^
|
| @@ -1,50 +0,0 @@
-#!/usr/bin/perl
-#
-# modsec-clamscan.pl
-# ModSecurity for Apache (http://www.modsecurity.org)
-# Copyright (c) 2002-2007 Breach Security, Inc. (http://www.breach.com)
-#
-# This script is an interface between mod_security and its
-# ability to intercept files being uploaded through the
-# web server, and ClamAV
-
-# by default use the command-line version of ClamAV,
-# which is slower but more likely to work out of the
-# box
-$CLAMSCAN = "/usr/bin/clamscan";
-
-# using ClamAV in daemon mode is faster since the
-# anti-virus engine is already running, but you also
-# need to configure file permissions to allow ClamAV,
-# usually running as a user other than the one Apache
-# is running as, to access the files
-# $CLAMSCAN = "/usr/bin/clamdscan";
-
-if (@ARGV != 1) {
- print "Usage: modsec-clamscan.pl <filename>\n";
- exit;
-}
-
-my ($FILE) = @ARGV;
-
-$cmd = "$CLAMSCAN --stdout --no-summary $FILE";
-$input = `$cmd`;
-$input =~ m/^(.+)/;
-$error_message = $1;
-
-$output = "0 Unable to parse clamscan output [$1]";
-
-if ($error_message =~ m/: Empty file\.?$/) {
- $output = "1 empty file";
-}
-elsif ($error_message =~ m/: (.+) ERROR$/) {
- $output = "0 clamscan: $1";
-}
-elsif ($error_message =~ m/: (.+) FOUND$/) {
- $output = "0 clamscan: $1";
-}
-elsif ($error_message =~ m/: OK$/) {
- $output = "1 clamscan: OK";
-}
-
-print "$output\n";
|
|
[-]
[+]
|
Deleted |
modsec-clean_var-asl-data-audit
^
|
| @@ -1,5 +0,0 @@
-#!/bin/bash
-nice -n 19 find /var/asl/data/audit -type d -mindepth 1 -cmin +30 -print0 | xargs -r -0 rm -rf
-mkdir -p /var/asl/data/audit
-chown -R %APAUSR%:%APAGRP% /var/asl/data/audit
-[ -x /usr/local/bin/modsec-permissions ] && /usr/local/bin/modsec-permissions || :
|
|
|
Deleted |
modsecurity-2.8.0.tar.bz2
^
|
|
|
Deleted |
modsecurity-2.9.0.tar.bz2
^
|
|
|
Deleted |
modsecurity-2.9.2.tar.bz2
^
|
|
|
Deleted |
modsecurity-2.9.3.tar.bz2
^
|
|
|
Deleted |
modsecurity-2.9.4.tar.bz2
^
|
|
|
Deleted |
modsecurity-2.9.5.tar.bz2
^
|
|
|
Deleted |
modsecurity-2.9.7.tar.bz2
^
|
|
|
Changed |
modsecurity-apache_2.5.13.tar.gz
^
|
|
|
Changed |
modsecurity-apache_2.6.1.tar.bz2
^
|
|
|
Deleted |
modsecurity-apache_2.7.5.tar.bz2
^
|
|
|
Deleted |
modsecurity-apache_2.7.7.tar.bz2
^
|
|
[-]
[+]
|
Deleted |
modsecurity_crs_10_config-default.conf.suse
^
|
| @@ -1,302 +0,0 @@
-# ---------------------------------------------------------------
-# Core ModSecurity Rule Set ver.1.6.1
-# Copyright (C) 2006-2007 Breach Security Inc. All rights reserved.
-#
-# The ModSecuirty Core Rule Set is distributed under GPL version 2
-# Please see the enclosed LICENCE file for full details.
-# ---------------------------------------------------------------
-
-
-# Configuration contained in this file should be customized
-# for your specific requirements before deployment.
-#
-# Next to each rule there is a description of what it does. Each
-# location where customization is needed is marked with "TODO". It
-# is recommended that you:
-#
-# 1) Keep a copy of the original file. This will allow you to use
-# the "diff" command to quickly see the changes. It will also
-# make upgrades to future rule sets easier.
-#
-# 2) Document your changes thoroughly.
-#
-# You are advised to start with ModSecurity in detection mode only.
-# Switch to protection when you are comfortable with your rule set.
-# For maximum protection monitor your logs on daily basis (or
-# better).
-#
-
-# TODO You may want to provide an error friendly message to your
-# users when you start rejecting requests. You can do this using
-# the Apache ErrorDocument directive. You should also add
-# mod_unique_id to your configuration and display the unique
-# request ID on the error page. This would allow your users to
-# report the request ID back to you so that you can investigate
-# the false positive (if that's what it is). A nice error page
-# usually reduces the impact of false positives on the users.
-#
-# The drawback of this user friendly approach is that it is
-# easier for the attackers to figure out there is an web
-# application firewall protecting the application.
-#
-# ErrorDocument 403 /path/to/error_document.php
-#
-# For more information see
-# http://httpd.apache.org/docs-2.0/custom-error.html
-
-
-## -- Configuration ----------------------------------------------------------
-
-# Turn ModSecurity on ("On"), set to monitoring only
-# ("DetectionOnly") or turn off ("Off").
-#
-SecRuleEngine On
-
-# Define which part of the HTTP transaction to inspect.
-#
-# Inspecting request body (SecRequestBodyAccess) should probably be always set
-# to "on". Only very high volume sites that never use POST requests might want
-# to set it to "off" to optimize performance.
-#
-# Inspecting response body is useful for monitoring for information leaks,
-# or for signs of intrusion. However, it does require all responses to be
-# buffered in memory. For most sites this should not be a problem, but special
-# care must be taken to avoid buffering file downloads (through
-# MIME type selection, as shown below).
-#
-# TODO If you decide to enable output filtering make sure to
-# review the list of scanned MIME types. If pages of the types specified
-# for outbound inspection are smaller than 512K in you application
-# (which is usually the case) you may reduce the SecResponseBodyLimit
-# to protect from potential denial of service attacks.
-#
-SecRequestBodyAccess On
-SecResponseBodyAccess On
-SecResponseBodyMimeType (null) text/html text/plain text/xml
-SecResponseBodyLimit 2621440
-
-
-# Initiate XML Processor in case of xml content-type
-#
-# TODO Uncomment this rule if you wish to parse
-# text/xml requests using the XML parser. Note
-# that this may cause considerable overhead in processing
-# text/xml requests.
-#SecRule REQUEST_HEADERS:Content-Type "text/xml" \
-#"phase:1,pass,nolog,ctl:requestBodyProcessor=XML"
-
-
-# What to do when an error is encountered.
-#
-# The default is to log the error and let the request go through.
-# This is a reasonable setting to start with because you do not
-# want to reject legitimate requests with an untuned rule set.
-#
-# If, after monitoring the performance of the rule set after a
-# sufficient period, you determine the rules never (or rarely
-# trigger on legitimate requests) you can change to something
-# else, such as "log,deny,status:403". You can also leave the
-# default setting here as is, but use per rule action configuration
-# to only configure some rules to reject requests, leaving most
-# of them to work in detection mode.
-#
-#SecDefaultAction "phase:2,log,deny,status:403,t:lowercase,t:replaceNulls,t:compressWhitespace"
-
-# Set web server identification string
-#
-# TODO In case you use Apache, you may want specify a simple server signature
-# instead of the detailed Apache default signature that list most modules
-# used on the specific Apache deployment:
-# "Apache/2.2.0 (Fedora)"
-# For this directive to work, you need to set Apache ServerTokens
-# to Full (this is the default option)
-SecServerSignature Apache
-
-# Add ruleset identity to the logs
-#
-SecComponentSignature 201001071602
-
-## -- File uploads configuration -----------------------------------------------
-# Temporary file storage path.
-#
-# TODO Change the temporary folder setting to a path where only
-# the web server has access.
-#
-SecUploadDir /var/asl/data/suspicious
-
-# Whether or not to keep the stored files.
-#
-# In most cases you don't want to keep the uploaded files (especially
-# when there is a lot of them). It may be useful to change the setting
-# to "RelevantOnly", in which case the files uploaded in suspicious
-# requests will be stored.
-#
-SecUploadKeepFiles Off
-
-# Inspect uploaded files.
-#
-# TODO If there is a danger of attack through uploaded files then it
-# is possible to configure an external script to inspect each file
-# before it is seen by the application. An example script is
-# included with ModSecurity (/util/modsec-clamscan.pl).
-#
-# Inspecting uploaded files is especially important in a hosting,
-# community or blogging environments where uploading files is permitted.
-#
-# NOTE the t:none action is required in order not to process the files names
-# passed to the script based on previously defined actions in a
-# SecDefaultAction directive.
-#
-# SecRule FILES_TMPNAMES "@inspectFile /opt/apache/bin/inspect_script.pl" \
-# "t:none"
-
-## -- Logging ----------------------------------------------------------------
-
-# Whether to log requests to the ModSecurity audit log.
-#
-# By default, only requests that trigger a ModSecurity events (as detected
-# by) or a serer error are logged ("RelevantOnly"). This is a reasonable
-# setting. Full logging can be set by using # "on". If the system is used
-# for protection only and no logging is desired (not reccomended) logging can
-# be turned of using "off"
-#
-# NOTE It is also possible to configure forensic logging on the
-# per request basis using the "auditlog" and "noauditlog" rule
-# actions.
-#
-# TODO The default rule set logs requests that generate a 404 "file not found"
-# response. These events are interesting, but may log a lot of information.
-# you may consider removing it by setting SecAuditLogRelevantStatus
-# to "^(?:5|4\d[^4])".
-#
-SecAuditEngine RelevantOnly
-SecAuditLogRelevantStatus "^(?:5|4(?!04))"
-
-# Log files structure
-#
-# You can select to log all events to a single log file (set SecAuditLogType to
-# "Serial") or to log each request to a separate file (set it to "Concurrent").
-# The former is usually easier to use, but if full logging is required or if
-# the protected system supports a large transaction volume the later may
-# be a better option.
-#
-# TODO Set the SecAuditLog (for "Serial" logging) or SecAuditLogStorageDir (for
-# "Concurrent" logging).
-#
-# TODO If you change from "Serial" to "Concurrent" uncomment the
-# SecAuditLogStorageDir directive and make sure the direcory specified
-# exists and has write permissions for the Apache user.
-
-SecAuditLogType Concurrent
-SecAuditLog /var/log/apache2/audit_log
-# SecAuditLogStorageDir /var/log/apache2/modsec_audit
-
-# Select what portions of the request to log
-#
-# Modify the string by adding any of the letter below to it:
-# A - audit log header (mandatory)
-# B - request headers
-# C - request body (present only if the request body exists and ModSecurity is
|
|
[-]
[+]
|
Changed |
zzz_asl_custom_exclude.conf
^
|
| @@ -4,21 +4,3 @@
SecRuleRemoveById 350147
SecRuleRemoveById 350148
SecRuleRemoveById 340162
-SecRuleRemoveById 391213
-SecRuleRemoveById 340152
-
-# experimental
-SecRuleRemoveById 340202
-SecRuleRemoveById 340201
-SecRuleRemoveById 340204
-SecRuleRemoveById 340205
-SecRuleRemoveById 340206
-SecRuleRemoveById 340207
-SecRuleRemoveById 340208
-SecRuleRemoveById 340209
-SecRuleRemoveById 345400
-SecRuleRemoveById 345401
-SecRuleRemoveById 345402
-SecRuleRemoveById 345403
-SecRuleRemoveById 345404
-
|
