Mod Security Issue on BJP Site - Revision history

Biswajit at 04:50, 21 February 2013

2013-02-21T04:50:19Z

← Older revision		Revision as of 04:50, 21 February 2013
Line 1:		Line 1:
	[[category:BJP]]		[[category:BJP]]

	=='''Mod Security Issue on BJP Site - ~~Still issue~~ Closed''' ==		=='''Mod Security Issue on BJP Site - Issue Finally Closed''' ==

Biswajit at 04:49, 21 February 2013

2013-02-21T04:49:46Z

← Older revision		Revision as of 04:49, 21 February 2013
Line 1:		Line 1:
	[[category:BJP]]		[[category:BJP]]

	'''Mod Security Issue on BJP Site - Still issue ~~is there~~'''		=='''Mod Security Issue on BJP Site - Still issue Closed''' ==


Line 9:		Line 9:
	httpd: Syntax error on line 212 of /httpdjail/etc/httpd/conf/httpd.conf: Syntax error on line 3 of /httpdjail/etc/httpd/conf.d/00_mod_security.conf: Cannot load /etc/httpd/modules/mod_security2.so into server: /etc/httpd/modules/mod_security2.so: '''undefined symbol: ap_get_server_banner'''		httpd: Syntax error on line 212 of /httpdjail/etc/httpd/conf/httpd.conf: Syntax error on line 3 of /httpdjail/etc/httpd/conf.d/00_mod_security.conf: Cannot load /etc/httpd/modules/mod_security2.so into server: /etc/httpd/modules/mod_security2.so: '''undefined symbol: ap_get_server_banner'''

			==Temporary solution==

	'''Solution Came from --'''		'''Solution Came from --'''
Line 55:		Line 56:
	# No logs are generated or traceable		# No logs are generated or traceable

			== Updrade of httpd ==

	So Decided to Update the httpd version to fix the issue of mod-security , as suggested t		So Decided to Update the httpd version to fix the issue of mod-security , as suggested t
Line 63:		Line 65:


	'''Process of Update httpd t0 2.2.15'''		'''Process of Update httpd to 2.2.22'''

	rpm --import http://www.jasonlitka.com/media/RPM-GPG-KEY-jlitka		rpm --import http://www.jasonlitka.com/media/RPM-GPG-KEY-jlitka
Line 110:		Line 112:
	http://www.cyberciti.biz/tips/chroot-apache-under-rhel-fedora-centos-linux.html		http://www.cyberciti.biz/tips/chroot-apache-under-rhel-fedora-centos-linux.html

	Commented the line ( disable chroot as it is inbuilt in 2.2.15 - httpd )		Commented the line ( disable chroot as it is inbuilt in 2.2.22 - httpd )

	#LoadModule chroot_module /usr/lib64/httpd/modules/mod_chroot.so		#LoadModule chroot_module /usr/lib64/httpd/modules/mod_chroot.so

	'''[[After All these efforts too , the Site was not accessible]]'''		'''[[After All these efforts too , the Site was not accessible]]'''

			== Final Fix and Solution ==

	So we have disabled the mod_security2.so and enabled mod_security.so in /etc/httpd/conf.d/00_mod_security.conf file as shown below .		So we have disabled the mod_security2.so and enabled mod_security.so in /etc/httpd/conf.d/00_mod_security.conf file as shown below .
Line 127:		Line 131:
	# Basic configuration goes in here		# Basic configuration goes in here
	Include modsecurity.d/tortix_waf.conf		Include modsecurity.d/tortix_waf.conf

	# Rule management is handled by ASL		# Rule management is handled by ASL
	Include modsecurity.d/00*exclude.conf		Include modsecurity.d/00*exclude.conf
Line 148:		Line 151:
	[Thu Feb 21 04:16:36 2013] [notice] Digest: done		[Thu Feb 21 04:16:36 2013] [notice] Digest: done
	[Thu Feb 21 04:16:37 2013] [notice] Apache/2.2.22 (Unix) DAV/2 Apache mod_perl/2.0.4 Perl/v5.8.8 configured -- resuming normal operations		[Thu Feb 21 04:16:37 2013] [notice] Apache/2.2.22 (Unix) DAV/2 Apache mod_perl/2.0.4 Perl/v5.8.8 configured -- resuming normal operations


			So as conclusion , new module mod_security2.so best works with Apache 2.7 where we are still at apache 2.2.22 so it can suite us the best .

			Thanks

			Biswajit Banerjee

Biswajit at 04:34, 21 February 2013

2013-02-21T04:34:07Z

← Older revision		Revision as of 04:34, 21 February 2013
Line 136:		Line 136:


	So Now httpd is loaded with mod_security ( As shown Below ) and Sites are also working		So Now httpd is loaded with mod_security ( As shown Below ) '''[[and Sites are also working]]'''

	[Thu Feb 21 04:16:35 2013] [notice] core dump file size limit raised to 18446744073709551615 bytes		[Thu Feb 21 04:16:35 2013] [notice] core dump file size limit raised to 18446744073709551615 bytes

Biswajit at 04:33, 21 February 2013

2013-02-21T04:33:17Z

← Older revision		Revision as of 04:33, 21 February 2013
Line 54:		Line 54:
	# When activated the site is not accessible at all.		# When activated the site is not accessible at all.
	# No logs are generated or traceable		# No logs are generated or traceable


			So Decided to Update the httpd version to fix the issue of mod-security , as suggested t

			We have used the following Repo to update

			http://www.jasonlitka.com/yum-repository/


			'''Process of Update httpd t0 2.2.15'''

			rpm --import http://www.jasonlitka.com/media/RPM-GPG-KEY-jlitka
			yum utterramblings http://www.jasonlitka.com/media/EL4/$ARCH

			vi /etc/yum.repos.d/utterramblings.repo
			yum update
			yum remove httpd-devel.i386
			yum --enablerepo=utterramblings install httpd

			'''Updated the httpd version'''

			httpd -v
			Server version: Apache/2.2.22 (Unix)
			Server built: Feb 23 2012 12:28:12

			While restart of the Server we faced /httpdjail not found .

			Issue - error_log , Apache failed

			[Wed Feb 20 16:43:54 2013] [notice] core dump file size limit raised to 18446744073709551615 bytes
			[Wed Feb 20 16:43:54 2013] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
			[Wed Feb 20 16:43:54 2013] [notice] ModSecurity for Apache/2.7.1 (http://www.modsecurity.org/) configured.
			[Wed Feb 20 16:43:54 2013] [notice] ModSecurity: APR compiled version="1.4.6"; loaded version="1.2.7"
			[Wed Feb 20 16:43:54 2013] [warn] ModSecurity: Loaded APR do not match with compiled!
			[Wed Feb 20 16:43:54 2013] [notice] ModSecurity: PCRE compiled version="6.6 "; loaded version="6.6 06-Feb-2006"
			[Wed Feb 20 16:43:54 2013] [notice] ModSecurity: LUA compiled version="Lua 5.1"
			[Wed Feb 20 16:43:54 2013] [notice] ModSecurity: LIBXML compiled version="2.7.6"
			[Wed Feb 20 16:43:54 2013] [notice] Original server signature: Apache
			[Wed Feb 20 16:43:55 2013] [notice] Digest: generating secret for digest authentication ...
			[Wed Feb 20 16:43:55 2013] [notice] Digest: done
			[Wed Feb 20 16:43:56 2013] [notice] mod_chroot: changed root to /httpdjail.
			[Wed Feb 20 16:43:56 2013] [warn] pid file /var/run/httpd.pid overwritten -- Unclean shutdown of previous Apache run?
			[Wed Feb 20 16:43:56 2013] [alert] (2)'''No such file or directory: Can't chdir to /httpdjail'''
			PHP: Error parsing /etc/php.ini on line 1230
			[Wed Feb 20 16:43:56 2013] [alert] (2)No such file or directory: Can't chdir to /httpdjail
			PHP: Error parsing /etc/php.ini on line 1230
			[Wed Feb 20 16:43:56 2013] [alert] (2)No such file or directory: Can't chdir to /httpdjail
			PHP: Error parsing /etc/php.ini on line 1230
			[Wed Feb 20 16:43:56 2013] [notice] Apache/2.2.22 (Unix) DAV/2 mod_chroot/0.5 Apache mod_perl/2.0.4 Perl/v5.8.8 configured -- resuming normal operations
			[Wed Feb 20 16:43:56 2013] [alert] Child 32602 returned a Fatal error... Apache is exiting!


			To fix /httpdjail issue we have followed , which said that mod_chroot is in-built function of httpd and no mod_chroot is required seperately

			http://www.cyberciti.biz/tips/chroot-apache-under-rhel-fedora-centos-linux.html

			Commented the line ( disable chroot as it is inbuilt in 2.2.15 - httpd )

			#LoadModule chroot_module /usr/lib64/httpd/modules/mod_chroot.so

			'''[[After All these efforts too , the Site was not accessible]]'''

			So we have disabled the mod_security2.so and enabled mod_security.so in /etc/httpd/conf.d/00_mod_security.conf file as shown below .

			# ASL mod_security Template: /var/asl/data/templates/template-00_mod_security.conf
			#
			'''#LoadModule security2_module modules/mod_security2.so'''
			'''LoadModule security2_module modules/mod_security.so'''
			LoadModule unique_id_module modules/mod_unique_id.so
			#
			<IfModule mod_security2.c>
			# Basic configuration goes in here
			Include modsecurity.d/tortix_waf.conf

			# Rule management is handled by ASL
			Include modsecurity.d/00*exclude.conf
			Include modsecurity.d/asl.conf
			Include modsecurity.d/99*exclude.conf

			</IfModule>


			So Now httpd is loaded with mod_security ( As shown Below ) and Sites are also working

			[Thu Feb 21 04:16:35 2013] [notice] core dump file size limit raised to 18446744073709551615 bytes
			[Thu Feb 21 04:16:35 2013] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
			[Thu Feb 21 04:16:35 2013] [notice] ModSecurity for Apache/2.6.6 (http://www.modsecurity.org/) configured.
			[Thu Feb 21 04:16:35 2013] [notice] ModSecurity: APR compiled version="1.2.7"; loaded version="1.2.7"
			[Thu Feb 21 04:16:35 2013] [notice] ModSecurity: PCRE compiled version="6.6"; loaded version="6.6 06-Feb-2006"
			[Thu Feb 21 04:16:35 2013] [notice] ModSecurity: LIBXML compiled version="2.6.26"
			[Thu Feb 21 04:16:35 2013] [notice] Original server signature: Apache
			[Thu Feb 21 04:16:36 2013] [notice] Digest: generating secret for digest authentication ...
			[Thu Feb 21 04:16:36 2013] [notice] Digest: done
			[Thu Feb 21 04:16:37 2013] [notice] Apache/2.2.22 (Unix) DAV/2 Apache mod_perl/2.0.4 Perl/v5.8.8 configured -- resuming normal operations

Biswajit: Created page with "category:BJP '''Mod Security Issue on BJP Site - Still issue is there''' While activating the 00_mod_security.conf it give the following Error httpd: Syntax error..."

2013-02-20T15:03:41Z

Created page with "category:BJP '''Mod Security Issue on BJP Site - Still issue is there''' While activating the 00_mod_security.conf it give the following Error httpd: Syntax error..."

New page

[[category:BJP]]

'''Mod Security Issue on BJP Site - Still issue is there'''

While activating the 00_mod_security.conf it give the following Error

httpd: Syntax error on line 212 of /httpdjail/etc/httpd/conf/httpd.conf: Syntax error on line 3 of /httpdjail/etc/httpd/conf.d/00_mod_security.conf: Cannot load /etc/httpd/modules/mod_security2.so into server: /etc/httpd/modules/mod_security2.so: '''undefined symbol: ap_get_server_banner'''

'''Solution Came from --'''

http://www.centos.org/modules/newbb/viewtopic.php?topic_id=13208

Done

yum install mod_perl-devel

mod_security Activated at line number 212 on file /httpdjail/etc/httpd/conf/httpd.conf

Include /httpdjail/etc/httpd/conf.d/00_mod_security.conf

Output Shows that Mod_Security is Running a

[Wed Feb 20 13:35:50 2013] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Wed Feb 20 13:35:51 2013] [notice] ModSecurity for Apache/2.7.1 (http://www.modsecurity.org/) configured.
[Wed Feb 20 13:35:51 2013] [notice] ModSecurity: APR compiled version="1.4.6"; loaded version="1.2.7"
[Wed Feb 20 13:35:51 2013] [warn] ModSecurity: Loaded APR do not match with compiled!
[Wed Feb 20 13:35:51 2013] [notice] ModSecurity: PCRE compiled version="6.6 "; loaded version="6.6 06-Feb-2006"
[Wed Feb 20 13:35:51 2013] [notice] ModSecurity: LUA compiled version="Lua 5.1"
[Wed Feb 20 13:35:51 2013] [notice] ModSecurity: LIBXML compiled version="2.7.6"
[Wed Feb 20 13:35:51 2013] [notice] Original server signature: Apache
[Wed Feb 20 13:35:51 2013] [notice] Digest: generating secret for digest authentication ...
[Wed Feb 20 13:35:51 2013] [notice] Digest: done
[Wed Feb 20 13:35:51 2013] [notice] mod_chroot: changed root to /httpdjail.
[Wed Feb 20 13:35:51 2013] [warn] pid file /var/run/httpd.pid overwritten -- Unclean shutdown of previous Apache run?
[Wed Feb 20 13:35:52 2013] [notice] Apache configured -- resuming normal operations

Version of Httpd on BJP Server

httpd -v

Server version: Apache/2.2.3
Server built: Jan 10 2013 08:19:28

'''Still the Issue'''

# When activated the site is not accessible at all.
# No logs are generated or traceable