Difference between revisions of "Disabling mod security for apache"

From Notes_Wiki
m
m
 
Line 1: Line 1:
<yambe:breadcrumb>Apache web server configuration|Apache web server configuration</yambe:breadcrumb>
[[Main Page|Home]] > [[CentOS]] > [[CentOS 6.x]] > [[Apache web server configuration]] > [[Disabling mod_security for apache]]
=Disabling mod_security for apache=


It is possible to come across apache configuration where POST requests containing path like /etc/shadow or /bin/ping get blocked. To solve this problem use
It is possible to come across apache configuration where POST requests containing path like /etc/shadow or /bin/ping get blocked. To solve this problem use
Line 11: Line 10:


''This is very bad idea. mod_security is designed to protect against buffer overflow, code injection, etc. attacks and disabling it like mentioned above increases surface area of attack to very large extent. Way better approach is to actually understand apache mod_security configuration and configure it appropriately.''
''This is very bad idea. mod_security is designed to protect against buffer overflow, code injection, etc. attacks and disabling it like mentioned above increases surface area of attack to very large extent. Way better approach is to actually understand apache mod_security configuration and configure it appropriately.''
[[Main Page|Home]] > [[CentOS]] > [[CentOS 6.x]] > [[Apache web server configuration]] > [[Disabling mod_security for apache]]

Latest revision as of 07:32, 6 March 2022

Home > CentOS > CentOS 6.x > Apache web server configuration > Disabling mod_security for apache

It is possible to come across apache configuration where POST requests containing path like /etc/shadow or /bin/ping get blocked. To solve this problem use

mv /etc/httpd/conf.d/mod_security.conf /etc/httpd/conf.d/mod_security.conf2
service httpd reload

This basically renamed mod_security configuration so that it is no longer applied.

This is very bad idea. mod_security is designed to protect against buffer overflow, code injection, etc. attacks and disabling it like mentioned above increases surface area of attack to very large extent. Way better approach is to actually understand apache mod_security configuration and configure it appropriately.



Home > CentOS > CentOS 6.x > Apache web server configuration > Disabling mod_security for apache