Slashdot Mirror
New Apache Module For Web Intrusion Detection
ivan.ristic writes "Mod_security 1.7 has been released. Mod_security is an open source intrusion detection and prevention engine for web applications. It operates embedded into the web server, acting as a powerful umbrella - shielding applications from attacks. The latest release adds output scanning to Apache 2.x; the ability to analyze cookies; functionality to change the identity of the web server; several new actions for rule grouping; new null-byte attack anti-evasion code."
new null-byte attack anti-evasion code
Wait...wouldn't null-byte attack anti-evasion code be code that prevented evasion of null-byte attacks? Or should I go for that second cup of coffee and try parsing it again?
-- MarkusQ
Sounds to me like you have a problem with Apache. Just stay away from my production servers, OK?
To try and pull the subject away from the usual trolls, this sounds like something I really need on my web server.
Has anyone tried it? Any success or failure stories?
D
Games section colors != ughly
Games section colors = perty
Apache section colors = blurp!
j00 = dumbas
suckit.
What makes you think it's Apache and not something else like... say... hardware? PHP? Perl?
-- Stu
/. ID under 2,000. I feel old now.
Would it be *that* much work to drop the apache and geeks in space sections and add a culture section (for movies, music, things to do on saturday night (that don't involve a computer), etc?
HAHAHA
iF yOu WAnT to C YOUr iP agaIn gAThEr tWO MilLIon dOLLArS IN Non - cONsEcuTivE TweNtY's AnD AWaiT FuRThER iNstrUctIoN
yeah, it looks like a pay toilet that no one bothers to flush. All that's missing is CmdrTaco's phone number scrawned on the stall wall.
than snort? easier to setup?
Quod scripsi, scripsi.
The article's description of mod_security as a "powerful umbrella shielding applications from attacks" seems to oversell it. If you have a known app with a known exploit, you can use mod_security instead of fixing the app. But even the mod_security docs themselves say it's better to fix the app.
For apps which accept arbitrary text input (most do!) a general filter against, e.g. "insert into", is a bad idea? This slashdot post includes those two words together; you have to be specific about which inputs get filtered how. Again, this is better done in the app itself.
YHBT. Run a diff on this versus the "Apple" fanatics troll that always shows up on Apple stories. It's close enough to be a madlib.
I had to browse the site to see what this does, this overview page was good.
It reminds me of URLScan for MS's IIS - but with extra features.
no text
...you can of course spin up Apache on another box, preferably not the firewall, and set it up in proxy mode to forward the requests. Though this generates some SSL issues. Mabye you could even use mod_balance and have a security appliance / load balancer?
Of course Checkpoint already offer this functionality in FW-1 NG to a limited degree, and Netscreen are introducing it across their range as a free update (for those with a software subscription) in ScreenOS 5 later this year or early next.
"The Bat-sploits of the Masked Meddlers will rebound from my giant electronic umbrella!! Nyah, nyah!"
http://members.tripod.com/~AdamWest/peng.htm
I don't know where will you find a "cheaper" server, apache is as cheap as free...
You'll have trouble finding a faster or more stable server too.
It seems to me that you don't have much experience with this software (or the hardware or settings you use for testing are really crappy).
Speaking as a bruised and bloody firewall administrator, implementing anything above layer-3 on a large firewall deployment is a bad idea. I am assuming by the use of Firewall-1 that this is a large deployment.
Many of the firewalls I have been involved with support 10-50 applications, or sometimes even more. When it comes time to do an upgrade I don't have time to properly investigate how the next version of firewall code might affect or be affected by features of each application. This is especialy true when some or all of the applications use overly complex network models like Micro$oft is known to require.
Always push complexity to the edges of the network where it can be managed one app at a time.
Fools ignore complexity; pragmatists suffer it; experts avoid it; geniuses remove it.
A. Perlis
XML is the best data format; unless your data needs to be read or written by a human or a computer.
Or run Apache in chroot()ed environment. Or even better in a FreeBSD jail. Anyone done that? Experiences?
cpghost at Cordula's Web.
I'd rather hear some intelligent reasons why anyone would choose to use a Apache over other faster, cheaper, more stable httpd daemons.
cheaper?!
i'd have thought the hardware you ran apache on had some issues.. but when i noticed that bit at the end of your post, i realized it's you that certainly has issues!!
They just find a new bridge to hang out under. Looks like this one figured out how to use the search-and-replace feature.
(Score: -1, Stupid)
Tegatai Systems has been using mod_security in its development labs recently. It has been determined through white and blackbox testing that mod_security needs more work before it will be stable enough for wide-spread production use.
http://www.microsoft.com/technet/security/tools/ur lscan.asp
Nice to see Apache adding this functionality. As a web admin, the availability of another layer of security is always appreciated.
You run windows on a 486/66 with 8 megs of ram, and *someone hired you* ?!?
What does apache have to do with local file transfers?
You say you have a dual T1 at home one paragraph, then you say you have cable at home in the next.
Again, I'm surprised you're employable.
I have recently written an article for SecurityFocus on how mod_security can be used as part of a Apache reverse proxy: Web Security Appliance With Apache and mod_security