Hey Richard, You are in fact correct. The typical setup explicitly calls out the setup.conf and then includes as a wildcard some directory. We are working on more clear documentation for the 3.0.0 release but an early look is at: https://www.modsecurity.org/CRS/Documentation/
On 1/13/16, 8:10 AM, "owasp-modsecurity-core-rule-set-boun...@lists.owasp.org on behalf of Richard Jones" <owasp-modsecurity-core-rule-set-boun...@lists.owasp.org on behalf of owasp-crs@junix.systems> wrote: >I¹ve been reading through the documentation that comes with the latest >CRS and I¹m a little confused. > >The bundled INSTALL file seems to suggest that >modsecurity_crs_10_setup.conf should be installed in activated_rules and >also in the directory beneath. Using both results in errors about >duplicate id numbers. Which is correct? > >$ sudo ln -s /usr/local/apache/conf/crs/modsecurity_crs_10_setup.conf >activated_rules/modsecurity_crs_10_setup.conf > >[Š] > ><IfModule security2_module> > Include conf/crs/modsecurity_crs_10_setup.conf > Include conf/crs/activated_rules/*.conf ></IfModule> > >To my mind, the setup.conf files should come before all others, but if >so then why number it *and* have it load after the optional >ignore_static rules? > >Thanks, > >Richard > >-- >http://scanmail.trustwave.com/?c=4062&d=rtKW1nM8yjyWhky8ayE4Q8vEFXoXbpBpH_ >NASbiRSg&s=5&u=http%3a%2f%2fwww%2ejonze%2ecom%2fprivacy%2ehtml >_______________________________________________ >Owasp-modsecurity-core-rule-set mailing list >Owasp-modsecurity-core-rule-set@lists.owasp.org >http://scanmail.trustwave.com/?c=4062&d=rtKW1nM8yjyWhky8ayE4Q8vEFXoXbpBpH6 >IWQLnHSw&s=5&u=https%3a%2f%2flists%2eowasp%2eorg%2fmailman%2flistinfo%2fow >asp-modsecurity-core-rule-set ________________________________ This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is strictly prohibited. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. _______________________________________________ Owasp-modsecurity-core-rule-set mailing list Owasp-modsecurity-core-rule-set@lists.owasp.org https://lists.owasp.org/mailman/listinfo/owasp-modsecurity-core-rule-set
