ich habe mod_security am laufen und nach dem howto hier im Forum forgegangen.
--> http://www.rootforum.org/forum/viewtopic.php?t=35865
Wenn ich das aktiviere, dann geht nichtmal mehr mein phpmyadmin richtig. Kann keine Datenbanken auswählen - nichts geht mehr.
Error.log:
Code: Select all
========================================
Request: 84.191.188.63 - - [09/Oct/2006:10:41:24 +0200] "GET /sql.php?lang=de-utf-8&server=1&collation_connection=utf8_general_ci&db=usr_web2_4&table=test
Handler: x-httpd-php
----------------------------------------
GET /sql.php?lang=de-utf-8&server=1&collation_connection=utf8_general_ci&db=usr_web2_4&table=test&sql_query=SELECT+%2A+FROM+%60test%60&pos=0&goto=t
Host: php.meinedomain.de
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.0.7) Gecko/20060909 Firefox/1.5.0.7
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://php.meinedomain.de/left.php
Cookie: pma_charset=iso-8859-1; pma_lang=de-utf-8; pma_collation_connection=utf8_general_ci; pma_theme=original
Authorization: Basic cm9vdDptaWNoYTE=
mod_security-message: Access denied with code 505. Pattern match "select.+from" at THE_REQUEST
mod_security-action: 505
HTTP/1.1 505 HTTP Version Not Supported
Content-Length: 548
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
Das ist hier meine conf.
Code: Select all
<IfModule mod_security.c>
# Only inspect dynamic requests
# (YOU MUST TEST TO MAKE SURE IT WORKS AS EXPECTED)
# SecFilterEngine DynamicOnly
# Turn the filtering engine On or Off
SecFilterEngine On
# Reject requests with status 404
SecFilterDefaultAction "deny,log,status:404"
# Some sane defaults
SecServerResponseToken Off
SecFilterScanPOST Off
SecFilterCheckURLEncoding On
SecFilterCheckCookieFormat On
SecFilterCheckUnicodeEncoding Off
# If you want to scan the output, uncomment these
# SecFilterScanOutput On
# SecFilterOutputMimeTypes "(null) text/html text/plain"
# Accept almost all byte values
SecFilterForceByteRange 1 255
# Only record the interesting stuff
SecAuditEngine RelevantOnly
SecAuditLog /var/log/apache/audit_log
# You normally won't need debug logging
SecFilterDebugLevel 0
SecFilterDebugLog /var/log/apache2/modsec_debug_log
# Include rules
Include /etc/apache2/filter.conf
</IfModule>
Ist diese rule
--> http://www.rootforum.org/forum/viewtopic.php?t=35865
Woran kann das liegen??
