Difference between revisions of "Disabling mod security for apache"
From Notes_Wiki
(Created page with "=Disabling mod_security for apache= It is possible to come across apache configuration where POST requests containing path like /etc/shadow or /bin/ping get blocked. To solve...") |
m |
||
| Line 10: | Line 10: | ||
''This is very bad idea. mod_security is designed to protect against buffer overflow, code injection, etc. attacks and disabling it like mentioned above increases surface area of attack to very large extent. Way better approach is to actually understand apache mod_security configuration and configure it appropriately.'' | ''This is very bad idea. mod_security is designed to protect against buffer overflow, code injection, etc. attacks and disabling it like mentioned above increases surface area of attack to very large extent. Way better approach is to actually understand apache mod_security configuration and configure it appropriately.'' | ||
Back to [[Apache web server configuration]] | |||
Revision as of 23:12, 17 November 2012
Disabling mod_security for apache
It is possible to come across apache configuration where POST requests containing path like /etc/shadow or /bin/ping get blocked. To solve this problem use
mv /etc/httpd/conf.d/mod_security.conf /etc/httpd/conf.d/mod_security.conf2 service httpd reload
This basically renamed mod_security configuration so that it is no longer applied.
This is very bad idea. mod_security is designed to protect against buffer overflow, code injection, etc. attacks and disabling it like mentioned above increases surface area of attack to very large extent. Way better approach is to actually understand apache mod_security configuration and configure it appropriately.
Back to Apache web server configuration
