2

I have Apache set up on a Linux server and have mod_security enabled. I have a few lines that look like:

SecRule REQUEST_URI "^/*admin" drop,phase:1

Because there is no /admin on my website, and I don't want to waste the server resources to serve a 404 page to a bot or hacker.

I've noticed that whenever a page such as /admin is visited, I see in my Apache access logs that an HTTP 301 status with 0 bytes of content was returned (which is exactly what I want). However, I also get a ModSecurity: Access denied with connection close (phase 1). Pattern match "^/*admin" at REQUEST_URI. line in my Apache error logs.

Is there any way I can continue having mod_security append these connection drops to my access logs, but not append anything to my error logs?

Improve this question

1 Answer 1

Reset to default
2

Make sure that you don't have log specified - from the documentation on ModSecurity:

Description: Indicates that a successful match of the rule needs to be logged.

Example:

SecAction phase:1,id:117,pass,initcol:ip=%{REMOTE_ADDR},log

This action will log matches to the Apache error log file and the ModSecurity audit log.

Instead specify nolog:

Description: Prevents rule matches from appearing in both the error and audit logs.

Example:

SecRule REQUEST_HEADERS:User-Agent "Test" allow,nolog,id:121

Although nolog implies noauditlog, you can override the former by using nolog,auditlog.

Improve this answer
9
  • I can't get nolog to work. I've tried SecRule REQUEST_URI "^/*admin" drop,phase:1,nolog and SecRule REQUEST_URI "^/*admin" nolog,drop,phase:1, and yes I restarted Apache both times. The documentation doesn't say anything about using nolog and phase:# at the same time though. Could this be causing the problem?
    – user28412
    Sep 9, 2013 at 0:32
  • There's an example in the docs using phase and nolog together here using SecAction, and another example here for phase.
    – dan ♦
    Sep 9, 2013 at 1:15
  • I tried using it that way and it still didn't work. Maybe it's because of drop?
    – user28412
    Sep 9, 2013 at 1:23
  • 1
    That's really strange. Suddenly, nolog works. I'm not sure what was wrong, but all I know is that it's working now. Thanks.
    – user28412
    Sep 9, 2013 at 2:30
  • 1
    I see, thanks for the update. Lots of variables...nothing technical is ever too easy ;-)
    – dan ♦
    Sep 9, 2013 at 4:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.