Modsecurity Logs and Webserver Logs.

charlesalmeida

twest Thanks is working.

charlesalmeida

Here is another one that fixes the ManageWP backup.

SecRule REQUEST_HEADERS:X-Forwarded-For "@ipMatch 34.211.180.66,54.70.65.107,34.210.224.7,52.41.5.108,52.35.72.129,54.191.137.17,35.162.254.253,52.11.12.231,52.11.29.70,52.11.54.161,52.24.142.159,52.25.191.255,52.34.126.117,52.34.254.47,52.35.82.99,52.36.28.80,52.39.177.152,52.41.237.12,52.43.13.71,52.43.76.224,52.88.96.110,52.89.155.51,54.187.92.57,54.191.32.65,54.191.67.23,54.191.80.119,54.191.135.209,54.191.136.176,54.191.148.85,54.191.149.8,52.26.122.21,52.24.187.29,52.89.85.107,54.186.128.167,54.191.40.136,52.88.119.122,52.89.94.121,52.25.116.116,52.88.215.225,54.186.143.184,52.88.197.180,52.27.171.126,34.211.178.241,52.24.232.158,52.26.187.210,52.42.189.119,54.186.244.128,54.71.54.102,34.210.35.214,34.213.77.188,34.218.121.176,52.10.190.191,52.10.225.96,52.11.187.168,52.25.139.76,52.43.127.200,54.191.108.9,54.70.201.228,44.224.174.169,52.32.57.81,44.225.177.160,34.223.186.249,44.224.135.238,44.226.111.14,44.225.203.104,44.226.100.122,44.224.250.144,44.225.118.211" \
"id:1001, \
phase:1, \
pass, \
nolog, \
ctl:ruleRemoveById=200002"

SecRule REMOTE_ADDR "@ipMatch 34.211.180.66,54.70.65.107,34.210.224.7,52.41.5.108,52.35.72.129,54.191.137.17,35.162.254.253,52.11.12.231,52.11.29.70,52.11.54.161,52.24.142.159,52.25.191.255,52.34.126.117,52.34.254.47,52.35.82.99,52.36.28.80,52.39.177.152,52.41.237.12,52.43.13.71,52.43.76.224,52.88.96.110,52.89.155.51,54.187.92.57,54.191.32.65,54.191.67.23,54.191.80.119,54.191.135.209,54.191.136.176,54.191.148.85,54.191.149.8,52.26.122.21,52.24.187.29,52.89.85.107,54.186.128.167,54.191.40.136,52.88.119.122,52.89.94.121,52.25.116.116,52.88.215.225,54.186.143.184,52.88.197.180,52.27.171.126,34.211.178.241,52.24.232.158,52.26.187.210,52.42.189.119,54.186.244.128,54.71.54.102,34.210.35.214,34.213.77.188,34.218.121.176,52.10.190.191,52.10.225.96,52.11.187.168,52.25.139.76,52.43.127.200,54.191.108.9,54.70.201.228,44.224.174.169,52.32.57.81,44.225.177.160,34.223.186.249,44.224.135.238,44.226.111.14,44.225.203.104,44.226.100.122,44.224.250.144,44.225.118.211"\
"id:1011,\
phase:1,\
pass,\
nolog,\
ctl:ruleRemoveById=200002"

charlesalmeida

Some standard rules are missing from being included ModSecurity.

charlesalmeida

These rules apply to the IPs provided by the ManageWP company link.

https://managewp.com/troubleshooting/general/managewp-ips-can-white-list

twest

charlesalmeida I use this to completely whitelist mwp, works like a charm:

SecRule REQUEST_HEADERS:X-Forwarded-For "@ipMatch 34.211.180.66,54.70.65.107,34.210.224.7,52.41.5.108,52.35.72.129,54.191.137.17,35.162.254.253,52.11.12.231,52.11.29.70,52.11.54.161,52.24.142.159,52.25.191.255,52.34.126.117,52.34.254.47,52.35.82.99,52.36.28.80,52.39.177.152,52.41.237.12,52.43.13.71,52.43.76.224,52.88.96.110,52.89.155.51,54.187.92.57,54.191.32.65,54.191.67.23,54.191.80.119,54.191.135.209,54.191.136.176,54.191.148.85,54.191.149.8,52.26.122.21,52.24.187.29,52.89.85.107,54.186.128.167,54.191.40.136,52.88.119.122,52.89.94.121,52.25.116.116,52.88.215.225,54.186.143.184,52.88.197.180,52.27.171.126,34.211.178.241,52.24.232.158,52.26.187.210,52.42.189.119,54.186.244.128,54.71.54.102,34.210.35.214,34.213.77.188,34.218.121.176,52.10.190.191,52.10.225.96,52.11.187.168,52.25.139.76,52.43.127.200,54.191.108.9,54.70.201.228,44.224.174.169,52.32.57.81,44.225.177.160,34.223.186.249,44.224.135.238,44.226.111.14,44.225.203.104,44.226.100.122,44.224.250.144,44.225.118.211" "phase:1,nolog,allow,ctl:ruleEngine=off,id:20000221"

twest

charlesalmeida BTW there's an exclusion available for WordPress to help compatibility, you can add the code below to your config. Actually, there's exclusions for a bunch of different popular panels if you check the crs-setup.conf at /etc/modsecurity.d/owasp

SecAction \
"id:900130,\
phase:1,\
nolog,\
pass,\
t:none,\
setvar:tx.crs_exclusions_wordpress=1"

I'm now working on an exclusion for a code inserter plugin that's getting 403 error when trying to make new snippets.

twest

I turned off modsec engine for a plugin (WPCode's code inserter) that was getting 403 forbidden when trying to add new code snippets. I think I will need to make many of these exclusions to unblock lots of plugins as they come up, I just targeted part of the URI:

SecRule REQUEST_URI "@contains /admin.php?page=wpcode" \
"id:9992140,\
phase:1,\
pass,\
t:none,\
nolog,\
ctl:ruleEngine=off,\
ver:'OWASP_CRS/3.3.5'"

twest

This is another good rule to add, it was causing some users to not be able to upload jpg images in the media library. Strangely my test images worked fine, but the test images they emailed me would error on my side as well = because ModSecurity was blocking it for tripping up this ruleset.

#Disable rule 200004 "detected a possible unmatched boundary" false positive.
SecRuleRemoveById 200004

charlesalmeida

twest It is very confusing to use modsecurity without functional configuration for base WordPress. becomes a useless resource. I hope the development team focuses on the basics now.

8Dweb

Question, for those running Oppshield's version of modsec, are you running into the same problems with WP sites that the stock ModSec rules that come with Enhance produce?

charlesalmeida

8Dweb I didn't understand much about integration in the test I did, this needs to be in the panel UI and what features were integrated.

twest

charlesalmeida yeah it has been a pain in the ass so far, but I really want it to work so I can stop using plugins like Wordfence and Sucuri, instead just use ModSecurity... Hopefully I won't run into any more quirks, my users will find out and let me know lol

Actually I did run into one funny quirk today, needed to update SecRequestBodyLimit. It will trigger if you don't have it set as high as the size of uploads you allow. I set mine to 200000000 for 200MB limit. I set the SecRequestBodyNoFilesLimit to 500000, and expect I may need to bump that up more too, but will wait and see how it goes.

twest

Today I give up on getting a perfect modsec config. There are just too many themes, plugins, external scripts and other oddball things clients do that triggers false positives. I've found myself stripping away more and more modsec rules to the point that it's feeling not worth it.

I am keeping modsec running on my main control panel server, as it should have more robust security than the hosting servers, and it doesn't seem to conflict with enhance in any way I've noticed yet.

I'm still keeping modsec "turned on" so that I can use its config file to add optimizations to Apache. I just set the rule engine rule at the very top to Off, and then deleted everything else in the file. Then add my Apache config in the rest of the file.

It's the same reason I couldn't use modsec in WHM/cpanel, it's just too many variables to get perfect so it doesn't affect users with false positives.

Lastly, during testing I noticed a remarkable improvement in pagespeed in wp-admin after disabling modsec. It went from a slight delay, to zero delay in loading pages in wp-admin. The performance hit + false positives = not worth it. I'm sticking to Wordfence for on-site security, good firewall at server level, and Cloudflare security at DNS level. This strategy has been proven sufficient for cPanel servers, so I will keep it going that way 🙂

tstrand

twest

Thank you for sharing your configs. I have come to the same conclusion, just to many scenarios that triggers modsecurity in wordpress.

I really hope Enhance gets imunify360 support soon. We have been running that on cpanel for years and it has been working great.

george

tstrand, I highly recommend bitninja with enhance.