Hello,

I'm using mambo on a client's site and mod_security does not like one of the pages I am setting as "typed content" in mambo. It has something to do wilth the html code since if I remove one half it works but the other half returns a server 500 error. It's not my code but my client's. It looks like I will have to clean it up to use but I want to know if there is something mis-configured in mod_security. Here is the error code. I made the error message indigo.
"POST /administrator/index2. php HTTP/1.1" 500 0
Handler: server-parsed
Error: File does not exist: /home/lucybe/public_html/ 500. shtml
----------------------------------------
POST /administrator/index2.php HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/msword, application/vnd.ms-powerpoint, */*
Accept-Encoding: gzip, deflate
Accept-Language: en-us
Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 4683
Content-Type: application/x-www-form-urlencoded
Cookie: mosadmin=04796c45454634a56ad136bad79175d3; sessioncookie=5c4a3a0c8a01e5d64a8534a04ca1c505
Host: XXX
Referer: XXX
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
mod_security-message: Access denied with code 500. Pattern match "rm\x20" at POST_PAYLOAD.
mod_security-action: 500

HTML CONTENT HERE. REMOVED TO SHORTEN...

HTTP/1.1
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=iso-8859-1



Thanks for the help...

Create right rules for mod_security - art.

Greetings:

Access denied with code 500. Pattern match "rm\x20" is the rule that was broken. Either adjust or comment out the rule in httpd.conf and restart Apache.

Thank you.

WOW! That was fast! I got it fixed now. I uncommented the line but what did that line do exactly? Am I going to be safe without it?

Thanks for the posts!

This rule works fine you just need to tweak the rule. :)

This rules safes you agaist command attempt.

Try this on your httpd.conf


SecFilterSelective THE_REQUEST "rm\x20"

Good luck.


PS: With this code you will be less safe but will reduce false alarms

OK,
I modified the code to:
SecFilterSelective THE_REQUEST "rm\x20"
Are there any other rules I should be aware of?

Thanks!

Not at the moment, you can't tweak all the rules some rules you just got to say... No no No, I'm sorry but this script will not run on my server it's not safe.

I advise you install a phpnuke and others script on a test location where you can test the rules.

Keep an eye open if the rule gives the alarm again (even with the tweak).
If it does remove the rule either by uncomment our by deleting the rule it self.

Good luck matte ;)