mod_security-message: Access denied with code 403. Error processing request body: Multipart: final boundary missing [severity "EMERGENCY"]

로그파일에에 위와 같은 로그가 찍혀있다면 mod_security.conf 파일에서 아래 값으로 옵션을 수정해 줍니다.

SecFilterScanPost Off

파일 첨부

modsecurity_seminar_26.pdf

[root@sysdocu]# wget http://www.modsecurity.org/download/modsecurity-apache_2.5.12.tar.gz

[root@sysdocu]# tar xvzf modsecurity-apache_2.5.12.tar.gz

[root@sysdocu]# cd modsecurity-apache_2.5.12/apache2
[root@sysdocu]# ./configure --with-apxs=/usr/local/apache/bin/apxs --with-apr=/usr/local/apache/bin/apr-1-config --with-apu=/usr/local/apache/bin/apu-1-config --with-lua
[root@sysdocu]# make
[root@sysdocu]# make install

[에러]

apache 2.4 버전에 mod_security 2.5.12 를 설치하는중 아래와 같은 문제가 발생하였다.

[root@sysdocu]# make

/usr/local/apache/build/libtool --silent --mode=compile gcc -std=gnu99 -prefer-pic   -DLINUX=2 -D_REENTRANT -D_GNU_SOURCE -g -O2 -pthread -I/usr/local/apache/include  -I/usr/local/apache/include   -I/usr/local/apache/include  -O2 -g -Wall -DWITH_PCRE_STUDY -DMODSEC_PCRE_MATCH_LIMIT=1500 -DMODSEC_PCRE_MATCH_LIMIT_RECURSION=1500 -I/usr/local/apache/include -I/usr/local/apache/include -I. -I/usr/local/src/APM_Setup/httpd-2.4.3/srclib/apr/include -I/usr/local/src/APM_Setup/httpd-2.4.3/srclib/apr-util/include -I/usr/local/pcre/include -I/usr/include/libxml2  -c -o mod_security2.lo mod_security2.c && touch mod_security2.slo

mod_security2.c: In function 'create_tx_context':

mod_security2.c:363: error: 'conn_rec' has no member named 'remote_ip'

mod_security2.c:364: error: 'conn_rec' has no member named 'remote_addr'

mod_security2.c: In function 'register_hooks':

mod_security2.c:1136: warning: passing argument 1 of 'ap_hook_error_log' from incompatible pointer type

/usr/local/apache/include/http_core.h:888: note: expected 'void (*)(const struct ap_errorlog_info *, const char *)' but argument is of type 'void (*)(const char *, int,  int,  apr_status_t,  const struct server_rec *, const struct request_rec *, struct apr_pool_t *, const char *)'

apxs:Error: Command failed with rc=65536

.

make: *** [mod_security2.la] 오류 1

[해결]

[root@sysdocu]# vi mod_security2.c

(363, 364 라인의 뒷부분의 remote 를 client 로 변경)

    msr->remote_addr = r->connection->client_ip;

    msr->remote_port = r->connection->client_addr->port;

[root@sysdocu]# vi apache2_util.c

(305 라인의 뒷부분의 remote 를 client 로 변경)

ap_log_error(APLOG_MARK, APLOG_ERR | APLOG_NOERRNO, 0, r->server,

            "[client %s] ModSecurity: %s%s [uri \"%s\"]%s", r->connection->client_ip, str1,

            hostname, log_escape(msr->mp, r->uri), unique_id);

그러나 httpd syntax 체크시 오류 출력..

지원되는 버전 문제로 보여 httpd 2.4 에는 mod_security 2.7.x mod_security 2.7.0 을 설치해서 해결함

mod_security 2.7

[root@sysdocu]# wget https://sourceforge.net/projects/mod-security/files/modsecurity-apache/2.7.0/modsecurity-apache_2.7.0.tar.gz

[root@sysdocu]# tar xvzf modsecurity-apache_2.7.0.tar.gz

[root@sysdocu]# cd modsecurity-apache_2.7.0

[root@sysdocu]# ./configure --with-apxs=/usr/local/apache/bin/apxs

[root@sysdocu]# make

[root@sysdocu]# make install

mod_security 2.9.1

[root@sysdocu]#./configure --with-apxs=/usr/local/apache/bin/apxs --with-pcre=/usr/local/pcre --with-apr=/usr/local/apache/bin/apr-1-config --with-apu=/usr/local/apache/bin/apu-1-config

[root@sysdocu]# make

[root@sysdocu]# make install

./configure 에서 잘 안되면 그냥 옵션 다 빼고 ./configure 만 해도 된다.

룰셋은 별도의 포스팅 참조..

SecRule REMOTE_ADDR "^192.168.10.2" phase:1,nolog,allow,ctl:ruleEngine=Off

modsecurity.log  에 아래와 같은 오류 메세지가 뜰때

 
[증상]

Message: Rule execution error - PCRE limits exceeded (-8): (null).

 
[해결1]

mod_security 설치시 아래 옵션을 추가하여 설치를 합니다.

[root@sysdocu ~]# ./configure --enable-pcre-match-limit=90000 --enable-pcre-match-limit-recursion=90000
[root@sysdocu ~]# make && make install 

그리고 아래 명령으로 확인이 가능합니다.

[root@sysdocu ~]# php -i | egrep -i pcre 

[해결2]

php.ini 를 수정합니다.

[Pcre]
pcre.backtrack_limit=1000000
pcre.recursion_limit=1000000  
 

[root@sysdocu ~]# /usr/local/apache/bin/httpd -t
Syntax OK

첨부파일 참조

[출처] modsecurity

modsecurity2-apache-reference.pdf

문서 작성일 : 2009.04.29

ModSecurity 안내서_090429.pdf

[root@sysdocu ~]# /usr/local/apache/bin/httpd -t
Syntax OK

1. 다운로드

[root@sysdocu ~]# /usr/local/apache/bin/httpd -t
Syntax OK

다운로드 (파일 첨부)

mod_security-1.9.5.tar.gz

mod_security-2.1.7.tar.gz

모든 버젼 다운로드

http://sourceforge.net/projects/mod-security/files/

mod_security-1.9.5.tar.gz

mod_security-2.1.7.tar.gz