Whitelisting in ModSecurity
Broken down into 2 components our article’s 1st section hits on “how to whitelist IPs or URIs,” for those who area unit somewhat aware of ModSecurity. However need to grasp more concerning the method. Our second section examines why we have a tendency to set up ModSecurity approach to stop the protection of the server from entering into the way of our work. If you’ve got a completely Managed Liquid internet server reach dead set our Heroic Support team for help with whitelisting!
How to Whitelist IPs or URIs
“ModSecurity may be a toolkit for time period internet application observation, logging, and access management.” (modsecurity.org). In straightforward terms, this implies that ModSec, conjointly known asmod_security or ModSecurity, may be a internet application firewall that may actively hunt for attacks to the system and stop malicious activity.
However, generally these rules trigger once legitimate work is happening, block your informatics. And stopping you or your developer’s till you’ll take away the informatics block. The method around for being blocked is understood as whitelisting, that primarily permits for a selected informatics to access the server. There area unit a couple of ways in which to whitelist letter of invitation in ModSec. Either by informatics or by URI (URIs area unit specific pages on the website).
Getting Started
Find your informatics or raise your developer for theirs. (You will realize this by progressing to informatics.liquidweb.com)If you or your developer have a static informatics (one that may not change), a way you’ll whitelist the ModSec rules is by informatics. Find the ModSec error within the Apache error logs with the subsequent command (Be bound to modify the command along with your informatics in site of “IP here.”):
How to Whitelist IPs or URIs
[pastacode lang=”apacheconf” manual=”grep%20ModSec%20%2Fusr%2Flocal%2Fapache%2Flogs%2Ferror_log%20%7C%20grep%20%E2%80%9CIP%20here%E2%80%9D.” message=”” highlight=”” provider=”manual”/]- The output of this command will give you a list of hits for ModSecurity from you or your developer’s IP, which you can see below. While this looks intimidating, you will only want to pay attention to 3 bits of information highlighted. Please note, the output will not show these colors when you are viewing the files.
Note
Blue = client, the IP which tripped the rule
Red = ID number of tripped rule within ModSec
Green = URI, the location where the error started from
Whitelist By IP:
- Once you have the correct ModSec error, you will need to edit the ModSec configuration. If you are using Easy Apache 4 you will find the configuration file with this path:
/etc/apache2/conf.d/modsec2/whitelist.conf - Open the file with your favorite text editor, such as vim, nano, or file manager like so:
- The blue text above will be the IP address that you are whitelisting from the original error. You must keep the backslashes (\) and up-carrot (^) in order for the IP to be read correctly. Thus it will always look something like:
“^192\.168\.896\.321”
For for the id, noted in red, you will change the number after the colon, which will be the Apache error log like we saw above. This will look similar to:
Id:2000221
Add the following code with the colored sections edited to match your intended IP.
[pastacode lang=”apacheconf” manual=”SecRule%20REMOTE_ADDR%20%22%5E64%5C.14%5C.210%5C.4%22%0A%22phase%3A1%2Cnolog%2Callow%2Cctl%3AruleEngine%3Doff%2Cid%3A20000221%22″ message=”” highlight=”” provider=”manual”/]Whitelist By URI:
If your IP is dynamic (changing) and you keep getting blocked in the firewall, it is best to whitelist it via URI, the yellow item in the ModSec error.
- Begin by opening the Easy Apache 4 configuration file:
2. Add the following text to the configuration. Remember to pay attention to the highlighted parts. Change the yellow “/db/index.php” to match your URI and the red id to match the id of your error (Do not use the colon in this one).
[pastacode lang=”apacheconf” manual=”%3CLocationMatch%20%22%2Fdb%2Findex.php%22%3E%0ASecRuleRemoveById%2020000221%0A%3C%2FLocationMatch%3E” message=”” highlight=”” provider=”manual”/]3. The final step for whitelisting, before you finalize the process, is to ensure you have correctly set up the whitelist. For Easy Apache 4 you will run the command:
[pastacode lang=”apacheconf” manual=”apachectl%20-t” message=”” highlight=”” provider=”manual”/]As long as the command returns “Syntax Ok” you are safe to make the whitelist active by restarting Apache. Otherwise, review the whitelists to make sure the syntax matches up correctly with the above directions.
- Lastly, restart Apache with the following command.
You have successfully whitelisted yourself in ModSec!
Using ModSec
Cyber Security may be a hydra. Once one threat is ending, 2 additional grow back. whereas this can be not a replacement analogy. It’s vital to grasp as we have a tendency to battle threats to our network, computers, and servers. With all the complexities that escort security, I need to speak regarding adequately configuring ModSec to discourage threats whereas still permitting you to figure on your websites. Often, once it involves server security, an excessive amount of protection will hinder effectiveness.
For example, say you have got the subsequent established on your server:
You do not permit root SSH login to the server utilize dual-factor authentication for any SSH logins use Associate in Nursing SSH key for the sudo user and need different security safeguards While this kind of configuration is secure, it takes longer to log into your system to form a fast edit to your settings, a ambiguous sword; however are you able to keep the server safe whereas not ligature your own hands? a good example of however this plays out is victimization ModSec.
ModSec will block your scientific discipline if it incorrectly flags your work. whereas this module improves system security, you’ll got to remember of properly implementing and “scoping” the technology. Scoping during this sense means that to manage risks, the main focus of what’s vital for security whereas still permitting work on the server with tokenish interference. To tune out legitimate requests to your server, like after you square measure piece of writing your website’s code via a plugin. ModSec has the choices to whitelist rules or IPs and keep your work on the right track.
Whitelisting Associate in Nursing scientific discipline from the principles that ModSec follows may be a nice choice goodbye because the scientific discipline ne’er changes (i.e. a static scientific discipline, see article here to be told additional https://support.google.com/fiber/answer/3547208?hl=en) and is restricted to solely folks you trust.
This methodology prevents ModSec from viewing your requests as malicious and interference your scientific discipline. This follow has the downside that if somebody (say Associate in Nursing sad employee) has access to your network, they currently have the way around ModSec to attack your server.
Whitelisting Rules
With non-static (dynamic) scientific disciplines the issues of whitelisting Associate in Nursing IP square measure promptly apparent. With the continual modification of a dynamic scientific discipline, it creates the potential of exploiting your server, as somebody might use Associate in Nursing previous scientific discipline to access the server. Whitelisting specific rules involves save the day!. After you whitelist by rules, you’ll edit with roughness and limit the principles to explicit domains and URIs. URI’s are protective the remainder of the server from attacks associated with that very same rule!
Example of ModSecurity
ModSec reads a series of rules and applies them to incoming requests being created to the net server. Associate in Nursing example of what a block sounds like is:
[pastacode lang=”apacheconf” manual=”%5BSat%20Jun%2030%2002%3A21%3A56.013837%202018%5D%20%5B%3Aerror%5D%20%5Bpid%2079577%3Atid%20139862413879040%5D%20%5Bclient%20120.27.217.223%3A24397%5D%20%5Bclient%20120.27.217.223%5D%20ModSecurity%3A%20Access%20denied%20with%20code%20406%20(phase%202).%20Pattern%20match%20%22Mozilla%2F(4%7C5)%5C%5C%5C%5C.0%24%22%20at%20REQUEST_HEADERS%3AUser-Agent.%20%5Bfile%20%22%2Fetc%2Fapache2%2Fconf.d%2Fmodsec2.liquidweb.conf%22%5D%20%5Bline%20%22109%22%5D%20%5Bid%20%222000064%22%5D%20%5Bhostname%20%2267.227.192.139%22%5D%20%5Buri%20%22%2Fmysql%2Findex.php%22%5D%20%5Bunique_id%20%22WzchhAjuZ6wPAzo9AwW1WwAAAE8%22%5D” message=”” highlight=”” provider=”manual”/]This error shows Apache stopped a potential attack on a file at /mysql/index.php. This is an error similar to what appears when the code is being written or edited within programs like Drupal or WordPress.
Evaluating ModSecurity:
If you’re persistently being blocked in your firewall whereas engaged on your code, ModSec is that the doubtless offender. The ModSec errors will be found within the Apache error log (in cPanel the trail is /usr/local/apache/logs/error_log). The phrase “ModSec” will be quickly isolated from the log (via the command ‘grep “ModSec” /usr/local/apache/logs/error_log’).
By examination you or your developer(s) IP to the log, you’ll be ready to determine stopped requests that area unit legitimate. Verify these area unit valid requests by double-checking that somebody in your organization created them. Once you have got done therefore, you’ll be able to move forward in fitting a whitelist for the error, per the steps on top of.
Again, we would like to scope to permit the smallest amount of flexibility for an attack and guarantee. That we will keep operating. If you’re unable to possess a trusty static IP, you’ll ought to use the whitelist URI technique, providing the particular page as an exemption. Once completed, take away each whitelisted things from the configuration file, just in case of a real attack.
On a parting note, I encourage you to explore ModSec and learn additional of the ins and outs of the code. Exploring totally different ways of whitelisting will be heaps of for to find out and most significantly helps to tighten server security. As always, our totally Supported Customers will contact our useful Human Support team for help. consider articles on security in our mental object, like this one on Maldet! It’s another glorious thanks to find out about your server and develop an understanding of server security.