Re: How to limit access rate by header?

Yes, I had to do it that way. Just in case:

---
# Local messages
SetEnvIf Remote_Addr "127\.0\.0\.1" dontlog
SetEnvIf Remote_Addr "::1" dontlog
SetEnvIfNoCase User-Agent "internal dummy connection" dontlog

# Not interesting
SetEnvIfNoCase Request_URI "^/robots\.txt$" dontlog

# Only relevant for modsec log (it will output to error log eventually)
# Note: Keep this list updated with /etc/modsecurity/data/*.data
SetEnvIfNoCase User-Agent (Googlebot|bingbot\


|AhrefsBot|MJ12bot|trovitBot|AwarioRssBot|Semrush|DotBot|BLEXBot|YandexBot|YandexMobileBot|PaperLiBot|Baidu|ZoominfoBot\
|facebookexternalhit) dontlog

CustomLog ${APACHE_LOG_DIR}/other_vhosts_access.log vhost_combined
env=!dontlog
---

The only thing that I don't like of this approach is that I can't pass
SetEnvIf a file to read, so I'll have to keep both (*.data and .conf files)
in sync.


El mié., 12 de dic. de 2018 a la(s) 21:39, Manuel Spartan (
[email protected]) escribió:

> Hi Luciano, you can achieve that with environment variables and a custom
> log format with an env condition in Apache.
> Modsec writes error and audit log only, access log tricks can be useful to
> prevent IP/personal/financial leaks.
>
> Cheers!
>
> Sent from my iPhone
>
> On 12 Dec 2018, at 18:16, Luciano Guillermo Fantuzzi <
> [email protected]> wrote:
>
> Something I couldn't find in the docs. Is it possible to avoid logging in
> the access log? With nolog action I can avoid logging it in error log (and
> audit log, but it's turned off), but I couldn't find a way to avoid
> displaying a message in the access log on every rule match. I find this
> important because my idea was to sepparate logs and keep the access log as
> clean as possible so I can analyze bots/crawlers not being catched in my
> rules.
>
> Thanks.
>
> El mié., 12 de dic. de 2018 a la(s) 18:32, Christian Folini (
> [email protected]) escribió:
>
>> On Wed, Dec 12, 2018 at 06:16:49PM -0300, Luciano Guillermo Fantuzzi
>> wrote:
>> > Oh, I didn't realize we were not anymore in the main mailing thread. I'm
>> > re-joining it from here.
>>
>> Yes, I took it private after things turned sour following my comment.
>>
>> Glad it worked out for your in the end.
>>
>> Ahoj,
>>
>> Christian
>>
>> --
>> If liberty means anything at all, it means the right to tell people
>> what they do not want to hear.
>> -- George Orwell
>>
>>
>> _______________________________________________
>> mod-security-users mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>>
> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>
> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/