☰

Apache 的 security2_module 导致出现“禁止访问此服务器上的 /”消息

tag-icon • tag-icon apache-2.4 httpd mod-security
Apache 的 security2_module 导致出现“禁止访问此服务器上的 /”消息

我通过在 httpd.conf 中添加以下几行将 security2 模块安装到我的 apache 服务器：

<IfModule security2_module>
    Include crs/owasp-modsecurity-crs/modsecurity_crs_10_setup.conf
    Include crs/owasp-modsecurity-crs/base_rules/*.conf
</IfModule>

当我想通过 http 访问我的服务器时，我收到消息：“ Forbidden You don't have permission to access / on this server”

然后我转到该模块日志并看到以下错误：

--72348f1e-B--
GET / HTTP/1.1
Host: 192.8.9.70
Connection: keep-alive
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.124 Safari/537.36
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8,es;q=0.6,da;q=0.4

--72348f1e-F--
HTTP/1.1 403 Forbidden
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Content-Length: 202
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

--72348f1e-E--

--72348f1e-H--
Message: Access denied with code 403 (phase 2). Pattern match "^[\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/httpd/crs/owasp-modsecurity-crs/base_rules/modsecurity_crs_21_protocol_anomalies.conf"] [line "98"] [id "960017"] [rev "2"] [msg "Host header is a numeric IP address"] [data "192.8.9.70"] [severity "WARNING"] [ver "OWASP_CRS/2.2.9"] [maturity "9"] [accuracy "9"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [tag "http://technet.microsoft.com/en-us/magazine/2005.01.hackerbasher.aspx"]
Action: Intercepted (phase 2)
Stopwatch: 1435777069259012 1803 (- - -)
Stopwatch2: 1435777069259012 1803; combined=768, p1=644, p2=93, p3=0, p4=0, p5=30, sr=382, sw=1, l=0, gc=0
Response-Body-Transformed: Dechunked
Producer: ModSecurity for Apache/2.7.3 (http://www.modsecurity.org/); OWASP_CRS/2.2.9.
Server: Apache
Engine-Mode: "ENABLED"

我猜想这个模块有些地方配置不正确。如能提供任何帮助，我将不胜感激。

答案1

看起来 mod_security 运行正常。它阻止了请求，因为Host标头仅包含 IP 地址，而这正是此规则的作用意味着去做。

在生产环境中，您应该使用实际的主机名来引用您的网站。在开发环境中，这也是一个好主意，但如果您需要在开发环境中使用 IP 地址，您可以随时禁用该规则。

相关内容