Re: Upgrade to owasp-coreruleset 4.13.0

--===============4070008827516469083==
Content-Type: multipart/alternative; boundary="00000000000017a14e06321a2ac4"

--00000000000017a14e06321a2ac4
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Ervin,

Here is he output
root@waf:/usr/local/etc/apache24 #  grep -A12 900990
/usr/local/etc/modsecurity/owasp-modsecurity-crs/crs-setup.conf
    "id:900990,\
    phase:1,\
    pass,\
    t:none,\
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/4.13.0',\
    setvar:tx.crs_setup_version=3D4130"

As far as my apache using
/usr/local/etc/apache24/modules.d/280_mod_security.conf, I am sure because
if I were to comment
LoadModule unique_id_module libexec/apache24/mod_unique_id.so
LoadModule security2_module /usr/local/modsecurity/lib/mod_security2.so

I get

root@waf:/home/mbaki # apachectl restart
Performing sanity check on apache24 configuration:
AH00526: Syntax error on line 97 of
/usr/local/etc/modsecurity/owasp-modsecurity-crs/crs-setup.conf:
Invalid command 'SecDefaultAction', perhaps misspelled or defined by a
module not included in the server configuration

Thanks
Monah

On Sun, Apr 6, 2025 at 4:54=E2=80=AFAM Ervin Heged=C3=BCs <[email protected]=
m> wrote:

> Hi Monan,
>
>
> On Sat, Apr 05, 2025 at 04:02:09PM -0400, Monah Baki wrote:
> >
> > ls /usr/local/etc/modsecurity/owasp-modsecurity-crs
> > crs-setup.conf
>
> as Christian wrote this is very strange.
>
> Anyway,
>
> are you sure your engine use this file?
>
> > cat /usr/local/etc/apache24/modules.d/280_mod_security.conf
>
> could you replace this line:
>
> > IncludeOptional
> /usr/local/etc/modsecurity/owasp-modsecurity-crs/crs-setup.conf
>
> by this one:
>
> Include /usr/local/etc/modsecurity/owasp-modsecurity-crs/crs-setup.conf
>
> so just remote the "Optional" string.
>
> And could you show us the output of this command?
>
> grep -A12 900990
> /usr/local/etc/modsecurity/owasp-modsecurity-crs/crs-setup.conf
>
>
> Thanks,
>
>
> a.
>
>
>
> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

--00000000000017a14e06321a2ac4
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi Ervin,</div><div><br></div><div>Here is he output =
<br></div><div>root@waf:/usr/local/etc/apache24 # =C2=A0grep -A12 900990 /u=
sr/local/etc/modsecurity/owasp-modsecurity-crs/crs-setup.conf<br>=C2=A0 =C2=
=A0 &quot;id:900990,\<br>=C2=A0 =C2=A0 phase:1,\<br>=C2=A0 =C2=A0 pass,\<br=
>=C2=A0 =C2=A0 t:none,\<br>=C2=A0 =C2=A0 nolog,\<br>=C2=A0 =C2=A0 tag:&#39;=
OWASP_CRS&#39;,\<br>=C2=A0 =C2=A0 ver:&#39;OWASP_CRS/4.13.0&#39;,\<br>=C2=
=A0 =C2=A0 setvar:tx.crs_setup_version=3D4130&quot;</div><div><br></div><di=
v>As far as my apache using /usr/local/etc/apache24/modules.d/280_mod_secur=
ity.conf, I am sure because if I were to comment </div><div>LoadModule uniq=
ue_id_module libexec/apache24/mod_unique_id.so<br>LoadModule security2_modu=
le /usr/local/modsecurity/lib/mod_security2.so</div><div><br></div><div>I g=
et <br></div><div><br></div><div>root@waf:/home/mbaki # apachectl restart<b=
r>Performing sanity check on apache24 configuration:<br>AH00526: Syntax err=
or on line 97 of /usr/local/etc/modsecurity/owasp-modsecurity-crs/crs-setup=
.conf:<br>Invalid command &#39;SecDefaultAction&#39;, perhaps misspelled or=
 defined by a module not included in the server configuration</div><div><br=
></div><div>Thanks</div><div>Monah</div></div><br><div class=3D"gmail_quote=
 gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Sun, Apr 6=
, 2025 at 4:54=E2=80=AFAM Ervin Heged=C3=BCs &lt;<a href=3D"mailto:airween@=
gmail.com">[email protected]</a>&gt; wrote:<br></div><blockquote class=3D"g=
mail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204=
,204,204);padding-left:1ex">Hi Monan,<br>
<br>
<br>
On Sat, Apr 05, 2025 at 04:02:09PM -0400, Monah Baki wrote:<br>
&gt; <br>
&gt; ls /usr/local/etc/modsecurity/owasp-modsecurity-crs<br>
&gt; crs-setup.conf<br>
<br>
as Christian wrote this is very strange.<br>
<br>
Anyway,<br>
<br>
are you sure your engine use this file?<br>
<br>
&gt; cat /usr/local/etc/apache24/modules.d/280_mod_security.conf<br>
<br>
could you replace this line:<br>
<br>
&gt; IncludeOptional /usr/local/etc/modsecurity/owasp-modsecurity-crs/crs-s=
etup.conf<br>
<br>
by this one:<br>
<br>
Include /usr/local/etc/modsecurity/owasp-modsecurity-crs/crs-setup.conf<br>
<br>
so just remote the &quot;Optional&quot; string.<br>
<br>
And could you show us the output of this command?<br>
<br>
grep -A12 900990 /usr/local/etc/modsecurity/owasp-modsecurity-crs/crs-setup=
.conf<br>
<br>
<br>
Thanks,<br>
<br>
<br>
a.<br>
<br>
<br>
<br>
_______________________________________________<br>
mod-security-users mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blan=
k">[email protected]</a><br>
<a href=3D"https://lists.sourceforge.net/lists/listinfo/mod-security-users"=
 rel=3D"noreferrer" target=3D"_blank">https://lists.sourceforge.net/lists/l=
istinfo/mod-security-users</a><br>
Commercial ModSecurity Rules and Support from Trustwave&#39;s SpiderLabs:<b=
r>
<a href=3D"http://www.modsecurity.org/projects/commercial/rules/" rel=3D"no=
referrer" target=3D"_blank">http://www.modsecurity.org/projects/commercial/=
rules/</a><br>
<a href=3D"http://www.modsecurity.org/projects/commercial/support/" rel=3D"=
noreferrer" target=3D"_blank">http://www.modsecurity.org/projects/commercia=
l/support/</a><br>
</blockquote></div>

--00000000000017a14e06321a2ac4--


--===============4070008827516469083==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============4070008827516469083==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

--===============4070008827516469083==--