Modsecurity Logs and Webserver Logs.

charlesalmeida

Hello, I was unable to locate the webserver logs by site and Modsecurity logs to investigate connection issues.

Another question about IPs blocked by modsecurity where to make the adjustments.

twest

When I'm working tomorrow I can give you the template for the config I'm using to whitelist IPs, I might know where the logs are too. I wanted to quickly ask now though, with ModSecurity enabled are you able to view the Tools > Site Health section in wp-admin? I was getting blocked by modsec. I did figure out a config rule to unblock it, I'm just curious if it blocks everyone or just my test site (I will post my config fix for that too if you're affected).

kyzoeadmin

I would love to see a devcent working config of Modsecurity, and what rules have to be deacitvated. If anybody out there that have a good config let me know.

charlesalmeida

can locate the logs, but cannot solve the Modsecurity problem blocking ManageWP.
Rule I have a problem with 949110.

docker logs nginx 2>&1 | grep "modsec"

It would be nice to have this log in the dashboard to browse.

twest

charlesalmeida I've got that exclusion on my comp, I'll post it tomorrow. I think this month or next the roadmap has an update to put modsec logs in the panel ui 🙂

tstrand

For debugging modsec and other enhance services I usually ssh to the server application server (web server) and do:

tail -f /var/lib/docker/containers/*/*.log

Webserver logs can be found at:

/var/local/enhance/webserver_logs/

charlesalmeida

Hello, I was able to locate the logs and identify the problems.
Follow the rules to make ManageWP work. With proxy and without proxy.

SecRule REQUEST_HEADERS:X-Forwarded-For "@ipMatch 34.211.180.66,54.70.65.107,34.210.224.7,52.41.5.108,52.35.72.129,54.191.137.17,35.162.254.253,52.11.12.231,52.11.29.70,52.11.54.161,52.24.142.159,52.25.191.255,52.34.126.117,52.34.254.47,52.35.82.99,52.36.28.80,52.39.177.152,52.41.237.12,52.43.13.71,52.43.76.224,52.88.96.110,52.89.155.51,54.187.92.57,54.191.32.65,54.191.67.23,54.191.80.119,54.191.135.209,54.191.136.176,54.191.148.85,54.191.149.8,52.26.122.21,52.24.187.29,52.89.85.107,54.186.128.167,54.191.40.136,52.88.119.122,52.89.94.121,52.25.116.116,52.88.215.225,54.186.143.184,52.88.197.180,52.27.171.126,34.211.178.241,52.24.232.158,52.26.187.210,52.42.189.119,54.186.244.128,54.71.54.102,34.210.35.214,34.213.77.188,34.218.121.176,52.10.190.191,52.10.225.96,52.11.187.168,52.25.139.76,52.43.127.200,54.191.108.9,54.70.201.228,44.224.174.169,52.32.57.81,44.225.177.160,34.223.186.249,44.224.135.238,44.226.111.14,44.225.203.104,44.226.100.122,44.224.250.144,44.225.118.211" \
"id:1000, \
phase:1, \
pass, \
nolog, \
ctl:ruleRemoveById=949110"

SecRule REMOTE_ADDR "@ipMatch 34.211.180.66,54.70.65.107,34.210.224.7,52.41.5.108,52.35.72.129,54.191.137.17,35.162.254.253,52.11.12.231,52.11.29.70,52.11.54.161,52.24.142.159,52.25.191.255,52.34.126.117,52.34.254.47,52.35.82.99,52.36.28.80,52.39.177.152,52.41.237.12,52.43.13.71,52.43.76.224,52.88.96.110,52.89.155.51,54.187.92.57,54.191.32.65,54.191.67.23,54.191.80.119,54.191.135.209,54.191.136.176,54.191.148.85,54.191.149.8,52.26.122.21,52.24.187.29,52.89.85.107,54.186.128.167,54.191.40.136,52.88.119.122,52.89.94.121,52.25.116.116,52.88.215.225,54.186.143.184,52.88.197.180,52.27.171.126,34.211.178.241,52.24.232.158,52.26.187.210,52.42.189.119,54.186.244.128,54.71.54.102,34.210.35.214,34.213.77.188,34.218.121.176,52.10.190.191,52.10.225.96,52.11.187.168,52.25.139.76,52.43.127.200,54.191.108.9,54.70.201.228,44.224.174.169,52.32.57.81,44.225.177.160,34.223.186.249,44.224.135.238,44.226.111.14,44.225.203.104,44.226.100.122,44.224.250.144,44.225.118.211"\
"id:1010,\
phase:1,\
pass,\
nolog,\
ctl:ruleRemoveById=949110"

twest

This fixes WP Site Health section, if you're getting blocked there:

SecRule REQUEST_FILENAME "@endsWith /wp-admin/site-health.php"\
"id:9002840,\
phase:2,\
pass,\
t:none,\
nolog,\
ctl:ruleRemoveTargetById=951220;TX:sql_error_match,\
ctl:ruleRemoveTargetById=953110;RESPONSE_BODY,\
ver:'OWASP_CRS/3.3.5'"

charlesalmeida

twest Thanks is working.

charlesalmeida

Here is another one that fixes the ManageWP backup.

SecRule REQUEST_HEADERS:X-Forwarded-For "@ipMatch 34.211.180.66,54.70.65.107,34.210.224.7,52.41.5.108,52.35.72.129,54.191.137.17,35.162.254.253,52.11.12.231,52.11.29.70,52.11.54.161,52.24.142.159,52.25.191.255,52.34.126.117,52.34.254.47,52.35.82.99,52.36.28.80,52.39.177.152,52.41.237.12,52.43.13.71,52.43.76.224,52.88.96.110,52.89.155.51,54.187.92.57,54.191.32.65,54.191.67.23,54.191.80.119,54.191.135.209,54.191.136.176,54.191.148.85,54.191.149.8,52.26.122.21,52.24.187.29,52.89.85.107,54.186.128.167,54.191.40.136,52.88.119.122,52.89.94.121,52.25.116.116,52.88.215.225,54.186.143.184,52.88.197.180,52.27.171.126,34.211.178.241,52.24.232.158,52.26.187.210,52.42.189.119,54.186.244.128,54.71.54.102,34.210.35.214,34.213.77.188,34.218.121.176,52.10.190.191,52.10.225.96,52.11.187.168,52.25.139.76,52.43.127.200,54.191.108.9,54.70.201.228,44.224.174.169,52.32.57.81,44.225.177.160,34.223.186.249,44.224.135.238,44.226.111.14,44.225.203.104,44.226.100.122,44.224.250.144,44.225.118.211" \
"id:1001, \
phase:1, \
pass, \
nolog, \
ctl:ruleRemoveById=200002"

SecRule REMOTE_ADDR "@ipMatch 34.211.180.66,54.70.65.107,34.210.224.7,52.41.5.108,52.35.72.129,54.191.137.17,35.162.254.253,52.11.12.231,52.11.29.70,52.11.54.161,52.24.142.159,52.25.191.255,52.34.126.117,52.34.254.47,52.35.82.99,52.36.28.80,52.39.177.152,52.41.237.12,52.43.13.71,52.43.76.224,52.88.96.110,52.89.155.51,54.187.92.57,54.191.32.65,54.191.67.23,54.191.80.119,54.191.135.209,54.191.136.176,54.191.148.85,54.191.149.8,52.26.122.21,52.24.187.29,52.89.85.107,54.186.128.167,54.191.40.136,52.88.119.122,52.89.94.121,52.25.116.116,52.88.215.225,54.186.143.184,52.88.197.180,52.27.171.126,34.211.178.241,52.24.232.158,52.26.187.210,52.42.189.119,54.186.244.128,54.71.54.102,34.210.35.214,34.213.77.188,34.218.121.176,52.10.190.191,52.10.225.96,52.11.187.168,52.25.139.76,52.43.127.200,54.191.108.9,54.70.201.228,44.224.174.169,52.32.57.81,44.225.177.160,34.223.186.249,44.224.135.238,44.226.111.14,44.225.203.104,44.226.100.122,44.224.250.144,44.225.118.211"\
"id:1011,\
phase:1,\
pass,\
nolog,\
ctl:ruleRemoveById=200002"

charlesalmeida

Some standard rules are missing from being included ModSecurity.

charlesalmeida

These rules apply to the IPs provided by the ManageWP company link.

https://managewp.com/troubleshooting/general/managewp-ips-can-white-list

twest

charlesalmeida I use this to completely whitelist mwp, works like a charm:

SecRule REQUEST_HEADERS:X-Forwarded-For "@ipMatch 34.211.180.66,54.70.65.107,34.210.224.7,52.41.5.108,52.35.72.129,54.191.137.17,35.162.254.253,52.11.12.231,52.11.29.70,52.11.54.161,52.24.142.159,52.25.191.255,52.34.126.117,52.34.254.47,52.35.82.99,52.36.28.80,52.39.177.152,52.41.237.12,52.43.13.71,52.43.76.224,52.88.96.110,52.89.155.51,54.187.92.57,54.191.32.65,54.191.67.23,54.191.80.119,54.191.135.209,54.191.136.176,54.191.148.85,54.191.149.8,52.26.122.21,52.24.187.29,52.89.85.107,54.186.128.167,54.191.40.136,52.88.119.122,52.89.94.121,52.25.116.116,52.88.215.225,54.186.143.184,52.88.197.180,52.27.171.126,34.211.178.241,52.24.232.158,52.26.187.210,52.42.189.119,54.186.244.128,54.71.54.102,34.210.35.214,34.213.77.188,34.218.121.176,52.10.190.191,52.10.225.96,52.11.187.168,52.25.139.76,52.43.127.200,54.191.108.9,54.70.201.228,44.224.174.169,52.32.57.81,44.225.177.160,34.223.186.249,44.224.135.238,44.226.111.14,44.225.203.104,44.226.100.122,44.224.250.144,44.225.118.211" "phase:1,nolog,allow,ctl:ruleEngine=off,id:20000221"

twest

charlesalmeida BTW there's an exclusion available for WordPress to help compatibility, you can add the code below to your config. Actually, there's exclusions for a bunch of different popular panels if you check the crs-setup.conf at /etc/modsecurity.d/owasp

SecAction \
"id:900130,\
phase:1,\
nolog,\
pass,\
t:none,\
setvar:tx.crs_exclusions_wordpress=1"

I'm now working on an exclusion for a code inserter plugin that's getting 403 error when trying to make new snippets.

twest

I turned off modsec engine for a plugin (WPCode's code inserter) that was getting 403 forbidden when trying to add new code snippets. I think I will need to make many of these exclusions to unblock lots of plugins as they come up, I just targeted part of the URI:

SecRule REQUEST_URI "@contains /admin.php?page=wpcode" \
"id:9992140,\
phase:1,\
pass,\
t:none,\
nolog,\
ctl:ruleEngine=off,\
ver:'OWASP_CRS/3.3.5'"

twest

This is another good rule to add, it was causing some users to not be able to upload jpg images in the media library. Strangely my test images worked fine, but the test images they emailed me would error on my side as well = because ModSecurity was blocking it for tripping up this ruleset.

#Disable rule 200004 "detected a possible unmatched boundary" false positive.
SecRuleRemoveById 200004

charlesalmeida

twest It is very confusing to use modsecurity without functional configuration for base WordPress. becomes a useless resource. I hope the development team focuses on the basics now.

8Dweb

Question, for those running Oppshield's version of modsec, are you running into the same problems with WP sites that the stock ModSec rules that come with Enhance produce?

charlesalmeida

8Dweb I didn't understand much about integration in the test I did, this needs to be in the panel UI and what features were integrated.

twest

charlesalmeida yeah it has been a pain in the ass so far, but I really want it to work so I can stop using plugins like Wordfence and Sucuri, instead just use ModSecurity... Hopefully I won't run into any more quirks, my users will find out and let me know lol

Actually I did run into one funny quirk today, needed to update SecRequestBodyLimit. It will trigger if you don't have it set as high as the size of uploads you allow. I set mine to 200000000 for 200MB limit. I set the SecRequestBodyNoFilesLimit to 500000, and expect I may need to bump that up more too, but will wait and see how it goes.