Disabling mod security for apache

Disabling mod_security for apache

It is possible to come across apache configuration where POST requests containing path like /etc/shadow or /bin/ping get blocked. To solve this problem use

mv /etc/httpd/conf.d/mod_security.conf /etc/httpd/conf.d/mod_security.conf2
service httpd reload

This basically renamed mod_security configuration so that it is no longer applied.

This is very bad idea. mod_security is designed to protect against buffer overflow, code injection, etc. attacks and disabling it like mentioned above increases surface area of attack to very large extent. Way better approach is to actually understand apache mod_security configuration and configure it appropriately.

Back to Apache web server configuration