Jump to content

Mod Security Issue on BJP Site: Difference between revisions

From TetraWiki
← Older edit
No edit summary
No edit summary
 
(One intermediate revision by the same user not shown)
Line 1: Line 1:
[[category:BJP]]
[[category:BJP]]


'''Mod Security Issue on BJP Site - Still issue is there'''  
=='''Mod Security Issue on BJP Site - Issue Finally Closed''' ==




Line 9: Line 9:
  httpd: Syntax error on line 212 of /httpdjail/etc/httpd/conf/httpd.conf: Syntax error on line 3 of  /httpdjail/etc/httpd/conf.d/00_mod_security.conf: Cannot load /etc/httpd/modules/mod_security2.so into server:  /etc/httpd/modules/mod_security2.so: '''undefined symbol: ap_get_server_banner'''
  httpd: Syntax error on line 212 of /httpdjail/etc/httpd/conf/httpd.conf: Syntax error on line 3 of  /httpdjail/etc/httpd/conf.d/00_mod_security.conf: Cannot load /etc/httpd/modules/mod_security2.so into server:  /etc/httpd/modules/mod_security2.so: '''undefined symbol: ap_get_server_banner'''


==Temporary solution==


'''Solution Came from --'''
'''Solution Came from --'''
Line 55: Line 56:
# No logs are generated or traceable
# No logs are generated or traceable


== Updrade of httpd ==


So Decided to Update the httpd version to fix the issue of mod-security , as suggested t
So Decided to Update the httpd version to fix the issue of mod-security , as suggested t
Line 63: Line 65:




'''Process of Update httpd t0 2.2.15'''
'''Process of Update httpd to 2.2.22'''


  rpm --import http://www.jasonlitka.com/media/RPM-GPG-KEY-jlitka
  rpm --import http://www.jasonlitka.com/media/RPM-GPG-KEY-jlitka
Line 110: Line 112:
  http://www.cyberciti.biz/tips/chroot-apache-under-rhel-fedora-centos-linux.html
  http://www.cyberciti.biz/tips/chroot-apache-under-rhel-fedora-centos-linux.html


Commented the line ( disable chroot as it is inbuilt in 2.2.15 - httpd )
Commented the line ( disable chroot as it is inbuilt in 2.2.22 - httpd )


  #LoadModule chroot_module      /usr/lib64/httpd/modules/mod_chroot.so
  #LoadModule chroot_module      /usr/lib64/httpd/modules/mod_chroot.so


'''[[After All these efforts too , the Site was not accessible]]'''
'''[[After All these efforts too , the Site was not accessible]]'''
== Final Fix and Solution ==


So we have disabled the mod_security2.so and enabled mod_security.so in /etc/httpd/conf.d/00_mod_security.conf file as shown below .  
So we have disabled the mod_security2.so and enabled mod_security.so in /etc/httpd/conf.d/00_mod_security.conf file as shown below .  
Line 127: Line 131:
         # Basic configuration goes in here
         # Basic configuration goes in here
         Include modsecurity.d/tortix_waf.conf
         Include modsecurity.d/tortix_waf.conf
         # Rule management is handled by ASL
         # Rule management is handled by ASL
         Include modsecurity.d/00*exclude.conf
         Include modsecurity.d/00*exclude.conf
Line 148: Line 151:
  [Thu Feb 21 04:16:36 2013] [notice] Digest: done
  [Thu Feb 21 04:16:36 2013] [notice] Digest: done
  [Thu Feb 21 04:16:37 2013] [notice] Apache/2.2.22 (Unix) DAV/2 Apache mod_perl/2.0.4 Perl/v5.8.8 configured -- resuming normal operations
  [Thu Feb 21 04:16:37 2013] [notice] Apache/2.2.22 (Unix) DAV/2 Apache mod_perl/2.0.4 Perl/v5.8.8 configured -- resuming normal operations
So as conclusion ,  new module mod_security2.so best works with Apache 2.7 where we are still at apache 2.2.22 so it can suite us the best .
Thanks
Biswajit Banerjee

Latest revision as of 04:50, 21 February 2013


Mod Security Issue on BJP Site - Issue Finally Closed[edit]

While activating the 00_mod_security.conf it give the following Error 


httpd: Syntax error on line 212 of /httpdjail/etc/httpd/conf/httpd.conf: Syntax error on line 3 of   /httpdjail/etc/httpd/conf.d/00_mod_security.conf: Cannot load /etc/httpd/modules/mod_security2.so into server:  /etc/httpd/modules/mod_security2.so: undefined symbol: ap_get_server_banner

Temporary solution[edit]

Solution Came from -- 

http://www.centos.org/modules/newbb/viewtopic.php?topic_id=13208

Done 

yum install mod_perl-devel


mod_security Activated at line number 212 on file /httpdjail/etc/httpd/conf/httpd.conf 

Include /httpdjail/etc/httpd/conf.d/00_mod_security.conf


Output Shows that Mod_Security is Running a 


[Wed Feb 20 13:35:50 2013] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Wed Feb 20 13:35:51 2013] [notice] ModSecurity for Apache/2.7.1 (http://www.modsecurity.org/) configured.
[Wed Feb 20 13:35:51 2013] [notice] ModSecurity: APR compiled version="1.4.6"; loaded version="1.2.7"
[Wed Feb 20 13:35:51 2013] [warn] ModSecurity: Loaded APR do not match with compiled!
[Wed Feb 20 13:35:51 2013] [notice] ModSecurity: PCRE compiled version="6.6 "; loaded version="6.6 06-Feb-2006"
[Wed Feb 20 13:35:51 2013] [notice] ModSecurity: LUA compiled version="Lua 5.1"
[Wed Feb 20 13:35:51 2013] [notice] ModSecurity: LIBXML compiled version="2.7.6"
[Wed Feb 20 13:35:51 2013] [notice] Original server signature: Apache
[Wed Feb 20 13:35:51 2013] [notice] Digest: generating secret for digest authentication ...
[Wed Feb 20 13:35:51 2013] [notice] Digest: done
[Wed Feb 20 13:35:51 2013] [notice] mod_chroot: changed root to /httpdjail.
[Wed Feb 20 13:35:51 2013] [warn] pid file /var/run/httpd.pid overwritten -- Unclean shutdown of previous Apache run?
[Wed Feb 20 13:35:52 2013] [notice] Apache configured -- resuming normal operations

Version of Httpd on BJP Server

httpd -v

Server version: Apache/2.2.3 Server built: Jan 10 2013 08:19:28


Still the Issue

  1. When activated the site is not accessible at all.
  2. No logs are generated or traceable

Updrade of httpd[edit]

So Decided to Update the httpd version to fix the issue of mod-security , as suggested t

We have used the following Repo to update 

http://www.jasonlitka.com/yum-repository/


Process of Update httpd to 2.2.22 

rpm --import http://www.jasonlitka.com/media/RPM-GPG-KEY-jlitka
yum utterramblings http://www.jasonlitka.com/media/EL4/$ARCH

vi /etc/yum.repos.d/utterramblings.repo
yum update
yum remove httpd-devel.i386
yum --enablerepo=utterramblings install httpd

Updated the httpd version 

httpd -v
Server version: Apache/2.2.22 (Unix)
Server built:   Feb 23 2012 12:28:12

While restart of the Server we faced /httpdjail not found .

Issue - error_log , Apache failed 

[Wed Feb 20 16:43:54 2013] [notice] core dump file size limit raised to 18446744073709551615 bytes
[Wed Feb 20 16:43:54 2013] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Wed Feb 20 16:43:54 2013] [notice] ModSecurity for Apache/2.7.1 (http://www.modsecurity.org/) configured.
[Wed Feb 20 16:43:54 2013] [notice] ModSecurity: APR compiled version="1.4.6"; loaded version="1.2.7"
[Wed Feb 20 16:43:54 2013] [warn] ModSecurity: Loaded APR do not match with compiled!
[Wed Feb 20 16:43:54 2013] [notice] ModSecurity: PCRE compiled version="6.6 "; loaded version="6.6 06-Feb-2006"
[Wed Feb 20 16:43:54 2013] [notice] ModSecurity: LUA compiled version="Lua 5.1"
[Wed Feb 20 16:43:54 2013] [notice] ModSecurity: LIBXML compiled version="2.7.6"
[Wed Feb 20 16:43:54 2013] [notice] Original server signature: Apache
[Wed Feb 20 16:43:55 2013] [notice] Digest: generating secret for digest authentication ...
[Wed Feb 20 16:43:55 2013] [notice] Digest: done
[Wed Feb 20 16:43:56 2013] [notice] mod_chroot: changed root to /httpdjail.
[Wed Feb 20 16:43:56 2013] [warn] pid file /var/run/httpd.pid overwritten -- Unclean shutdown of previous Apache run?
[Wed Feb 20 16:43:56 2013] [alert] (2)No such file or directory: Can't chdir to /httpdjail
PHP:  Error parsing /etc/php.ini on line 1230
[Wed Feb 20 16:43:56 2013] [alert] (2)No such file or directory: Can't chdir to /httpdjail
PHP:  Error parsing /etc/php.ini on line 1230
[Wed Feb 20 16:43:56 2013] [alert] (2)No such file or directory: Can't chdir to /httpdjail
PHP:  Error parsing /etc/php.ini on line 1230
[Wed Feb 20 16:43:56 2013] [notice] Apache/2.2.22 (Unix) DAV/2 mod_chroot/0.5 Apache mod_perl/2.0.4 Perl/v5.8.8 configured -- resuming normal  operations
[Wed Feb 20 16:43:56 2013] [alert] Child 32602 returned a Fatal error... Apache is exiting!


To fix /httpdjail issue we have followed , which said that mod_chroot is in-built function of httpd and no mod_chroot is required seperately 

http://www.cyberciti.biz/tips/chroot-apache-under-rhel-fedora-centos-linux.html

Commented the line ( disable chroot as it is inbuilt in 2.2.22 - httpd ) 

#LoadModule chroot_module      /usr/lib64/httpd/modules/mod_chroot.so

After All these efforts too , the Site was not accessible

Final Fix and Solution[edit]

So we have disabled the mod_security2.so and enabled mod_security.so in /etc/httpd/conf.d/00_mod_security.conf file as shown below . 

# ASL mod_security Template: /var/asl/data/templates/template-00_mod_security.conf
#
#LoadModule security2_module modules/mod_security2.so
LoadModule security2_module modules/mod_security.so
LoadModule unique_id_module modules/mod_unique_id.so
#
<IfModule mod_security2.c>
       # Basic configuration goes in here
       Include modsecurity.d/tortix_waf.conf
       # Rule management is handled by ASL
       Include modsecurity.d/00*exclude.conf
       Include modsecurity.d/*asl*.conf
       Include modsecurity.d/99*exclude.conf

</IfModule>


So Now httpd is loaded with mod_security ( As shown Below ) and Sites are also working 

[Thu Feb 21 04:16:35 2013] [notice] core dump file size limit raised to 18446744073709551615 bytes
[Thu Feb 21 04:16:35 2013] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Thu Feb 21 04:16:35 2013] [notice] ModSecurity for Apache/2.6.6 (http://www.modsecurity.org/) configured.
[Thu Feb 21 04:16:35 2013] [notice] ModSecurity: APR compiled version="1.2.7"; loaded version="1.2.7"
[Thu Feb 21 04:16:35 2013] [notice] ModSecurity: PCRE compiled version="6.6"; loaded version="6.6 06-Feb-2006"
[Thu Feb 21 04:16:35 2013] [notice] ModSecurity: LIBXML compiled version="2.6.26"
[Thu Feb 21 04:16:35 2013] [notice] Original server signature: Apache
[Thu Feb 21 04:16:36 2013] [notice] Digest: generating secret for digest authentication ...
[Thu Feb 21 04:16:36 2013] [notice] Digest: done
[Thu Feb 21 04:16:37 2013] [notice] Apache/2.2.22 (Unix) DAV/2 Apache mod_perl/2.0.4 Perl/v5.8.8 configured -- resuming normal operations


So as conclusion , new module mod_security2.so best works with Apache 2.7 where we are still at apache 2.2.22 so it can suite us the best .

Thanks

Biswajit Banerjee

Retrieved from "https://wiki.tetrain.com/index.php?title=Mod_Security_Issue_on_BJP_Site&oldid=1269"