Disable mod_security on Dreamhost, for a single cgi script

dreamhostmod-security

I've searched around a lot, and tried various tweaks to .htaccess files to try to turn off mod_security for a particular cgi script (uber uploader) but it doesn't seem to have any effect.

The most popular one I see rehashed all over the web is:

# Turn off mod_security filtering.
SecFilterEngine Off

# The below probably isn't needed,
# but better safe than sorry.
SecFilterScanPOST Off

Which looks relative simple to me – if "SecFilterEngine" is in some way related to mod_security of course. Shame it has absolutely no effect!

Does anyone have a suggested way I can simply disable it for a request to any file in my cgi-bin directory?

Best Answer

From memory Dreamhost won't allow you to turn off mod_security. Are you sure that it is a mod_security problem? Dreamhost need you to run scripts with very specific chmod values, and that's always been the problem I've had. It might help to show any error messages you're getting, and related entries in your error log.

Also ask Dreamhost if you're sure it's a problem with mod_security. They won't be able to turn it off for you, but may be able to suggest some work arounds or alternatives. They're incredibly slow at responding and aren't always able to help, but sometimes you get lucky.

Related Solutions

Enable Mod_Security for only one website

Well I suppose it is possible if you enable the configuration for mod security ~~either in .htaccess or~~ in the virtual host apache configuration for that particular domain using something like this :

<IfModule mod_security2.c>
    SecRuleEngine On
    ...... (any other directives you might want to override from the defaul conf)
</IfModule>

Also in /etc/httpd/conf.d/mod_security.conf, or wherever the defaul config is stored, set SecRuleEngine Off but leave the other directives in place.

Mod_security ruleset for Joomla! admin

So, here's my answer.

By ispecting the return headers I noticed that Joomla! backend returns some HTTP headers when login is correct, and doesn't return them when login is invalid.

e.g., the P3P header is returned after a successful login, so I just look for its length being > 0:

SecAction phase:1,nolog,pass,initcol:ip=%{REMOTE_ADDR},id:5000144
<Locationmatch "/administrator/index.php">
    SecRule ip:bf_block "@gt 0" "deny,status:401,log,id:5000145,msg:'ip address blocked for 5 minutes, more than 10 login attempts in 3 minutes.'"
    SecRule RESPONSE_HEADERS:P3P "streq 0" "phase:5,t:none,nolog,pass,setvar:ip.bf_counter=0,id:5000146"
    SecRule RESPONSE_HEADERS:P3P "!streq 0" "phase:5,chain,t:none,nolog,pass,setvar:ip.bf_counter=+1,deprecatevar:ip.bf_counter=1/180,id:5000147"
    SecRule ip:bf_counter "@gt 10" "t:none,setvar:ip.bf_block=1,expirevar:ip.bf_block=300,setvar:ip.bf_counter=0"
</locationmatch>

Best Answer

Related Solutions

Enable Mod_Security for only one website

Mod_security ruleset for Joomla! admin

Related Topic