9

I've recently been frequented by erroneous error messages from mod_security. Its filter sets cover outdated PHP exploits, and I have to rewrite my stuff because Wordpress&Co had bugs years ago.

Does this happen to anyone else?

Apache mod_security blocks possibly dangerous HTTP requests before they reach applications (PHP specifically). It uses various filter sets, mostly regex based.

So I have a nice shared hosting provider, technically apt and stuff. But this bugged me:

Just last week I had to change a parameter name &src= in one of my apps because mod_security blocks ANY requests with that. I didn't look up its details, but this filter rule was preventing the exploitability of another app which I don't use and probably never had heard about. Still I had to rewrite my code (renaming parameter often suffices to trick mod_security) which had nothing to do or in common with that!

And today, a silly regex blocks form submissions, because I wanted to submit php sample code. Given, this is the simple stuff that mod_security is there to protect against. But I don't believe mod_security can detect seriously obfuscated code, and just goes off at obvious (and in this case totally trivial) php snippets.

Basically I'm getting penalized by mod_security because other people released bug-prone apps. (Not saying my apps are ultra secure - I'm pretty security wary, but make no hyperbolic claims.)
I've already asked my provider to disable it anyway, the benefits are too minuscle IMO and for my apps.

What do you think? Does mod_security make much sense outside of WP hosting? Or is it really just a bunch of blacklists of long passed security bugs? Which of its rules are actually helpful? Is there an application level equivalent?

Improve this question
2
  • 1
    That PHP code submission is silly because even printing a string with <?php doBadStuff(); ?> won't run that function. (Unless you use eval of course which is evil anyway.)
    – DisgruntledGoat
    Commented Sep 22, 2010 at 12:08
  • @DisgruntledGoat: Or maybe I've been too grumpy again just because of two false alarms. In the end mod_security is just like a virus scanner that still carries MS-DOS virus signatures around. Mostly not helpful, but catches the random exploit scanner and occasional potentialbadstuff()? Or so :}
    – mario
    Commented Sep 25, 2010 at 22:17

2 Answers 2

Reset to default
3

I personally see mod_security as a patch. I use it on some of our servers where we can't control the code that's uploaded (shared hosting servers, for example), but it's never really felt like a good solution to me. Based on it's wide and very general blacklist approach, it's more of a patch to cover up security holes than a good security policy.

It can also provide a false sense of security. mod_security can reveal some common attacks but can by no means prevent any attack. Again, it's a blacklist of common known attacks. If you simply install mod_security and think that you're magically secure, you're horribly mistaken.

I have found a much better policy to me managed servers where my team reviews all code that is placed on them, combined with lots of logs, logfile analysis, reporting systems, and intrusion detection/intrusion prevention systems (IPS). Everytime third-party or open-source software is installed (I'm looking at you, WordPress!) we keep a log of where it was installed, and when new versions are released we update every copy that was installed.

Again, you're more likely to find mod_security on a shared hosting server, as you're experiencing now. As you grow you can move to a VPS or clod based hosting provider where you get your own managed environment and can more tightly control the available software.

Improve this answer
1
  • That's what it feels like to me. For securing shared hosting accounts against each other, suexec+fastcgi seem generally more applicable. On a VPS and with all-custom code, mod_security helps seldomly (it does a few HTTP compliance checks though). +1 comprehensive logs.
    – mario
    Commented Sep 26, 2010 at 17:33
0

In my opinion, if you are a novice at programming, mod_security is a good idea, but if you take the time to write your applications correctly and avoid writing insecure code that uses eval or concatenate GET strings directly into SQL, you should be alright without it. mod_security will never stop the serious hackers, and if you have a good application, the script kiddies will give up and move on to the next really weak and insecure app out there.

Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.