Bug#680482: libapache2-modsecurity: should not include all *.conf files by default

2012-07-12 Thread Alberto Gonzalez Iniesta
On Wed, Jul 11, 2012 at 04:40:35PM +0300, Teodor MICU wrote: 2012/7/6 Alberto Gonzalez Iniesta a...@inittab.org: If you want rules only for a VirtualHost, they can be added to its configuration file. You don't need to use /etc/modsecurity at all. Yes, but that's exactly the purpose of this

Bug#680482: libapache2-modsecurity: should not include all *.conf files by default

2012-07-11 Thread Teodor MICU
2012/7/6 Alberto Gonzalez Iniesta a...@inittab.org: If you want rules only for a VirtualHost, they can be added to its configuration file. You don't need to use /etc/modsecurity at all. Yes, but that's exactly the purpose of this directory. I don't really see the problem or the severity of

Bug#680482: libapache2-modsecurity: should not include all *.conf files by default

2012-07-06 Thread Teodor
Package: libapache2-modsecurity Version: 2.6.6-2 Severity: important Hi, By default all the rules from /etc/modsecurity/*.conf are activated by this line in mods-available/mod-security.conf: Include /etc/modsecurity/*.conf I'm proposing to remove the second paragraph completely because from

Bug#680482: libapache2-modsecurity: should not include all *.conf files by default

2012-07-06 Thread Alberto Gonzalez Iniesta
On Fri, Jul 06, 2012 at 12:07:21PM +0300, Teodor wrote: Package: libapache2-modsecurity Version: 2.6.6-2 Severity: important Hi, By default all the rules from /etc/modsecurity/*.conf are activated by this line in mods-available/mod-security.conf: Include /etc/modsecurity/*.conf I'm

Bug#680482: libapache2-modsecurity: should not include all *.conf files by default

2012-07-06 Thread Teodor MICU
2012/7/6 Alberto Gonzalez Iniesta a...@inittab.org: I'm proposing to remove the second paragraph completely because from my experince enabling all these rules for all web sites will cause too much noise in the log (like 99.9%) with entries like this: enabling all these rules ??? Which

Bug#680482: libapache2-modsecurity: should not include all *.conf files by default

2012-07-06 Thread Alberto Gonzalez Iniesta
On Fri, Jul 06, 2012 at 03:33:36PM +0300, Teodor MICU wrote: 2012/7/6 Alberto Gonzalez Iniesta a...@inittab.org: I'm proposing to remove the second paragraph completely because from my experince enabling all these rules for all web sites will cause too much noise in the log (like 99.9%)