ModSecurity and OLS

Dome

I am looking to disable Modsec as WP is throwing me errors when saving posts... I cannot find where to adjust these settings when the server runs on OLS.

Where and how do I disable Modsec?

Cheers

webnestify

Why disable modsec? Just find rule that is blocking that action and make global whitelist. Usually logs are in error log.

Dome

webnestify you're right, ideally I'd like to adjust the settings on a domain basis, but I don't even know if that is possible?

This is my first time dealing with Modsec, and I'm unsure where to find the logs and the relative settings.

rdbf

Modsec takes a lot of babysitting if you don't use a service that does the whitelisting etc for you, especially if there's many different customers using different CMSes and virtual builders.

Every time something isn't working on any site, you'll be digging through modsec logs and spending time remediating rules.

Dome

rdbf What service are you referring to?

I mainly use Enhance to host my agency websites, so only WordPress.

rdbf

cPFence does this for example, but there's also rulesets that regularly update that you could use, which will still mean a bit of admin work but not nearly as much as using plain Modsecurity with the plain OWASP ruleset that I believe Enhance uses by default.

opsshield

It is not recommended to shut down the ModSec security layer, especially for WordPress kind of websites. With the correct rule sets, it can stop many attacks against the websites. So you may better identify the causative rules and disable/whitelist them rather than disabling the whole ModSec. If you want to disable it for any particular website, you can do it from Website > Select website > Security > ModSecurity > Turn it off for the website.

Dome

opsshield I am running OLS, so no Modsecurity settings are available from the admin.

Could you hint me where I can find the error logs to determine what is preventing posts from being saved/updates?

opsshield

My Enhance panel knowledge is limited, but on our test server, I can see the ModSec setting under the security tab of websites. So with OLS you can turn on/off modsec epr website.

For ModSec related errors, you may check the following logs

/usr/local/lsws/logs/error.log
/usr/local/lsws/logs/security_audit.log