Difference between revisions of "Disabling mod security for apache"
From Notes_Wiki
m |
m |
||
| Line 1: | Line 1: | ||
<yambe:breadcrumb>Apache web server configuration</yambe:breadcrumb> | |||
=Disabling mod_security for apache= | =Disabling mod_security for apache= | ||
| Line 10: | Line 11: | ||
''This is very bad idea. mod_security is designed to protect against buffer overflow, code injection, etc. attacks and disabling it like mentioned above increases surface area of attack to very large extent. Way better approach is to actually understand apache mod_security configuration and configure it appropriately.'' | ''This is very bad idea. mod_security is designed to protect against buffer overflow, code injection, etc. attacks and disabling it like mentioned above increases surface area of attack to very large extent. Way better approach is to actually understand apache mod_security configuration and configure it appropriately.'' | ||
Revision as of 08:15, 2 December 2012
<yambe:breadcrumb>Apache web server configuration</yambe:breadcrumb>
Disabling mod_security for apache
It is possible to come across apache configuration where POST requests containing path like /etc/shadow or /bin/ping get blocked. To solve this problem use
mv /etc/httpd/conf.d/mod_security.conf /etc/httpd/conf.d/mod_security.conf2 service httpd reload
This basically renamed mod_security configuration so that it is no longer applied.
This is very bad idea. mod_security is designed to protect against buffer overflow, code injection, etc. attacks and disabling it like mentioned above increases surface area of attack to very large extent. Way better approach is to actually understand apache mod_security configuration and configure it appropriately.
