Search found 72 matches

by xymox
Sun Jul 29, 2018 8:52 am
Forum: General Discussion
Topic: Apache Mod_Security OWASP false posistive on ACP use
Replies: 20
Views: 10562

Re: Apache Mod_Security OWASP false posistive on ACP use

This is not a difficult issue. As Paul said. This is simple. It was really easy to troubleshoot. The error log was quite clear. The solution equally as clear. The issue was I did not look at the error log soon enough, my bad. My "install" is: Purchased Inmotionhosting VPS-3000 Installed phpBB Mod Se...
by xymox
Sat Jul 28, 2018 11:37 pm
Forum: General Discussion
Topic: Apache Mod_Security OWASP false posistive on ACP use
Replies: 20
Views: 10562

Re: Apache Mod_Security OWASP false posistive on ACP use

Maybe I am confuzed. The ModSeurity Core Ruleset project that comes preinstalled with cpanel will always block the ACP because of the ../../adm/ reference ? This will always require a exclusion for the ACP to work on any CRS with the default rules that come with cpanel ? Thats what I got from the de...
by xymox
Fri Jul 27, 2018 8:20 am
Forum: General Discussion
Topic: Apache Mod_Security OWASP false posistive on ACP use
Replies: 20
Views: 10562

Re: Apache Mod_Security OWASP false posistive on ACP use

Makes sense. Good explanations :) From the OWASP maintainers.. Add this to your configuration before the CRS includes and you should be fine as far as this false positive is concerned. # ModSec Rule Exclusion: 930100 : Path Traversal Attack (/../) SecRule REQUEST_URI "@beginsWith /Forum/adm/index.ph...
by xymox
Fri Jul 27, 2018 6:56 am
Forum: General Discussion
Topic: Apache Mod_Security OWASP false posistive on ACP use
Replies: 20
Views: 10562

Re: Apache Mod_Security OWASP false posistive on ACP use

The below pattern match reg expression I think would require the combined knowledge of the Krell to decode.. Or.. Im just not that good at reg expressions. I removed username and password. [Thu Jul 26 22:44:25.927104 2018] [:error] [pid 24772] [client 70.162.95.216:49380] [client 70.162.95.216] ModS...
by xymox
Fri Jul 27, 2018 2:44 am
Forum: General Discussion
Topic: Apache Mod_Security OWASP false posistive on ACP use
Replies: 20
Views: 10562

Re: Apache Mod_Security OWASP false posistive on ACP use

Interesting.. " vulnerable PHP scripts"

Its interesting whats going on here. I need to look at this more. I need to look at the phpBB scripts that occur during ACP login too.

https://www.owasp.org/index.php/Testing ... _Inclusion
by xymox
Fri Jul 27, 2018 1:45 am
Forum: General Discussion
Topic: Apache Mod_Security OWASP false posistive on ACP use
Replies: 20
Views: 10562

Re: Apache Mod_Security OWASP false posistive on ACP use

There should be hits especially if it's blocking access. "You don't have permission to access /Forum/adm/index.php on this server." That is not necessarily caused by mod_security. You really need to check your server logs to see what is occurring. Yep... So a bit of isolation... The below ruleset i...
by xymox
Fri Jul 27, 2018 1:44 am
Forum: General Discussion
Topic: Apache Mod_Security OWASP false posistive on ACP use
Replies: 20
Views: 10562

Re: Apache Mod_Security OWASP false posistive on ACP use

There should be hits especially if it's blocking access. "You don't have permission to access /Forum/adm/index.php on this server." That is not necessarily caused by mod_security. You really need to check your server logs to see what is occurring. Yep... So im playing around from WHM now. modsec_ve...
by xymox
Thu Jul 26, 2018 1:48 pm
Forum: General Discussion
Topic: Apache Mod_Security OWASP false posistive on ACP use
Replies: 20
Views: 10562

Re: Apache Mod_Security OWASP false posistive on ACP use

I'm using mod_security myself with the OWASP rule set and have had no issues with it. Be sure to let us know what the problem is and follow up with OWASP. OOoOOo.. Thats awesome.. I have root, so, I can do whatever I need to. I am using a Inmotion hosting VPS-3000 for a few web sites that are hobbi...
by xymox
Thu Jul 26, 2018 8:41 am
Forum: General Discussion
Topic: Apache Mod_Security OWASP false posistive on ACP use
Replies: 20
Views: 10562

Re: Apache Mod_Security OWASP false posistive on ACP use

Thank you :) And well put.. Awesome moderation :)

I will gather the logs and look it all over and work with OWASP if I need to and post here what I find and provide a proper technical depth. I will hopefully also provide a solution that might benefit others.
by xymox
Tue Jul 24, 2018 5:30 am
Forum: General Discussion
Topic: Apache Mod_Security OWASP false posistive on ACP use
Replies: 20
Views: 10562

Re: Apache Mod_Security OWASP false posistive on ACP use

The maintainers of the OWASP project have responded. They could use someone more experience then I to maybe help with this issue. OWASP is a killer good thing to run if your running phpBB. Forums get attacked all the time and OWASP via ModSecurity is a awesome way to protect a forum - and a whole si...
by xymox
Mon Jul 23, 2018 10:39 pm
Forum: General Discussion
Topic: Apache Mod_Security OWASP false posistive on ACP use
Replies: 20
Views: 10562

Apache Mod_Security OWASP false posistive on ACP use

It seems that the Apache Mod_Security OWASP rule set is blocking ACP use. https://modsecurity.org/crs/

Does anyone have any experence in how to run this but still allow ACP functionality ?
by xymox
Tue Oct 10, 2017 11:54 am
Forum: [3.2.x] Support Forum
Topic: It was not possible to determine the dimensions of the image
Replies: 37
Views: 4885

Re: It was not possible to determine the dimensions of the image

thank you for the response :) thats a bunch of work as I dont do that stuff often. However I suppose your right. There is one obvious difference between the 2. The one that does not work has been upgraded over years and the one that works was installed fresh. I dont think its talking to the outside ...
by xymox
Sun Oct 08, 2017 9:37 pm
Forum: [3.2.x] Support Forum
Topic: It was not possible to determine the dimensions of the image
Replies: 37
Views: 4885

Re: It was not possible to determine the dimensions of the image

hmmm.. I dont follow.Does this patch you linked to addresss more then jped issues ? Im using a gif as my test on both phpbb boards not a jpeg. It does the same thing with all types of images. I have one forum where it works fine and one that doesn't running on the same server running the same versio...
by xymox
Sun Oct 08, 2017 9:19 am
Forum: [3.2.x] Support Forum
Topic: It was not possible to determine the dimensions of the image
Replies: 37
Views: 4885

Re: It was not possible to determine the dimensions of the image

Im using a 1x1 pixel gif as testing.. The below dot works great on one of the forums and wont work on the other. Again, same server..

Image

the above dot is at xymox1.com/z1.gif
by xymox
Sun Oct 08, 2017 9:13 am
Forum: [3.2.x] Support Forum
Topic: It was not possible to determine the dimensions of the image
Replies: 37
Views: 4885

Re: It was not possible to determine the dimensions of the image

So.. were are we on this... Im on 3.2.1 now and I CANNOT figure this out.. I have 2 forums, same server. One says "It was not possible to determine the dimensions of the image. Please verify that the URL you entered is correct." on anything placed inside a [img] block. .gif, .jpg, everything.. I can...

Go to advanced search