mod_security2
Hi guys, Do any of you use mod_security2? An article just came up on HowToForge about it, and I'm skeptic about installing it on my FreeBSD box. Is mod_security2 ok? Will it load the CPU? Will it make apache22 slow? http://www.howtoforge.com/apache2_mod_security_debian_etch ModSecurity is an Apache module that provides intrusion detection and prevention for web applications. It aims at shielding web applications from known and unknown attacks, such as SQL injection attacks, cross-site scripting, path traversal attacks, etc. ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: mod_security2
On Sat, 14 Jul 2007 13:03:24 +0300
Bazy [EMAIL PROTECTED] wrote:
An article just came up on HowToForge about it, and I'm skeptic about
installing it on my FreeBSD box.
Is mod_security2 ok?
I dont know, sorry
Will it load the CPU?
more than not running it? definitely. Too much that is unacceptable for your
needs? i dont think we can tell, give it a try in a test server and see how it
affects your loads.
Will it make apache22 slow?
along the same lines :) executing code that is not directly related to serving
your pages will mean your server will have less time for processing the web
requests... is this acceptable, given the benefits you may get? i dont know :)
http://www.howtoforge.com/apache2_mod_security_debian_etch ModSecurity is an
Apache module that provides intrusion detection and prevention for web
applications. It aims at shielding web applications from known and unknown
attacks, such as SQL injection attacks, cross-site scripting, path traversal
attacks, etc.
it sounds like a pretty useful module...may be doing some heavy lifting though..
let us know what you find out :)
_
{Beto|Norberto|Numard} Meijome
Life is not measured by the number of breaths we take, but by the moments that
take our breath away.
I speak for myself, not my employer. Contents may be hot. Slippery when wet.
Reading disclaimers makes you go blind. Writing them is worse. You have been
Warned.
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: mod_security2
Bazy wrote: Hi guys, Do any of you use mod_security2? An article just came up on HowToForge about it, and I'm skeptic about installing it on my FreeBSD box. Is mod_security2 ok? Will it load the CPU? Will it make apache22 slow? http://www.howtoforge.com/apache2_mod_security_debian_etch ModSecurity is an Apache module that provides intrusion detection and prevention for web applications. It aims at shielding web applications from known and unknown attacks, such as SQL injection attacks, cross-site scripting, path traversal attacks, etc. ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to [EMAIL PROTECTED] I used to have mod_security (the original one, not 2) on my debian server. It works great, the increase in security outweighs the few more resources the server needs. Will it slow you down? That depends on your hardware and the amount of traffic you are receiving. Mine was (is) a small web server and there was no noticeable performance penalty from mod_security. And it does all that is promised in the article you found. In fact I was tempted to move to mod_security2 when I upgraded my apache server, but mod_security2 has different directives / rules and could not find a good tutorial at the time to convert my original rules. ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: mod_security2
--On July 14, 2007 1:03:24 PM +0300 Bazy [EMAIL PROTECTED] wrote: Hi guys, Do any of you use mod_security2? An article just came up on HowToForge about it, and I'm skeptic about installing it on my FreeBSD box. Is mod_security2 ok? Will it load the CPU? Will it make apache22 slow? http://www.howtoforge.com/apache2_mod_security_debian_etch ModSecurity is an Apache module that provides intrusion detection and prevention for web applications. It aims at shielding web applications from known and unknown attacks, such as SQL injection attacks, cross-site scripting, path traversal attacks, etc. I use mod_security on apache13 on a server that gets about 7 million hits a month. I haven't noticed any problems. I've been using it for several years now. Paul Schmehl ([EMAIL PROTECTED]) Senior Information Security Analyst The University of Texas at Dallas http://www.utdallas.edu/ir/security/
Re: mod_security2
On Sat, 14 Jul 2007 17:38:44 -0500
Paul Schmehl [EMAIL PROTECTED] wrote:
I use mod_security on apache13 on a server that gets about 7 million hits
a month. I haven't noticed any problems.
paranoiawell, it could well be that the hack attempts that succeded were
never detected by mod_security ;) /
:-)
_
{Beto|Norberto|Numard} Meijome
Percusive Maintenance - The art of tuning or repairing equipment by hitting it.
I speak for myself, not my employer. Contents may be hot. Slippery when wet.
Reading disclaimers makes you go blind. Writing them is worse. You have been
Warned.
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]
