Atomic ModSecurity Rules FAQ
Help! I need help!
See the Atomic ModSecurity Rules Support page for instructions on contacting support, opening a case and other tools you can use to get assistance.
What is included with the support , what is your approx response time?
Email based support, within 4 hours of the request during normal business hours which are monday-friday from 9am - 5pm EST except on US Federal Holidays.
For extended support customers, the response time is dictated in the support contract and includes after hours support, and may include 24/7 support depending on the support contract.
What are your normal support hours?
Support business hours are 09:00 AM to 05:00 PM, US Eastern Time, Monday through Friday, excluding US holidays when we are closed..
Our holiday schedule:
2010
- Friday, January 1 New Year’s Day
- Monday, January 18 Birthday of Martin Luther King, Jr.
- Monday, February 15 Washington’s Birthday
- Monday, May 31 Memorial Day
- Monday, July 5 Independence Day
- Monday, September 6 Labor Day
- Monday, October 11 Columbus Day
- Thursday, November 11 Veterans Day
- Thursday, November 25 Thanksgiving Holiday
- Thursday, November 26 Thanksgiving Holiday
- Friday, December 24 Christmas Eve Day
Support requests received after hours will be addressed during the next business day.
Do you offer support outside of your normal support coverage?
Yes, for customers with extended support contracts. Please contact sales@atomicorp.com for more information.
Do you offer phone support?
Yes, for customers with existing extended support contracts. Please contact sales@atomicorp.com for more information about extended support contracts.
Phone support is not available without an existing extended support contract.
Are these the gotroot.com rules?
Yes they are, the one and same (and that website is being merged into this website). We are the oldest and most experienced mod_security rule authors out there. We were putting out rules long before mod_security was acquired and then acquired again. More sites use our rules and have been using then longer than everyone else combined. If you use our rules, you're in good company.
I have a false positive, how do report it?
Solution:
Send the false positive to “support@atomicorp.com” or press the “Report False Positive” button in the ASL GUI. Fps are usually resolved and an update is released the same day they are reported, and during normal business hours usually within a few hours.
You can also follow the Reporting False Positives procedure. That provides detailed instructions about how to report a false positive if you can not use the GUI, or if you choose to report it from the command line.
How do you exclude a domain from the modsecurity rules?
Solution:
[See Disabling Modsecurity for a Domain http://www.atomicorp.com/wiki/index.php/Mod_security#Disabling_Mod_security_per_domain]
This is very dangerous, it is not recommended and is not supported as it leaves the entire domain open to all web based attacks. If you find that you are experiencing any false positives please report them to support@atomicorp.com - we will fix the false positives.
Does a real time subscription include both the modsecurity and clamav rules?
Yes, realtime subscribers get instant access to the latest modsecurity and clamav signatures. We release updates daily based on new attacks we detect from our honeypots, new methods our labs develop, as well as fixes and improvements.
Can I setup a cronjob to automatically update the rules?
Absolutely. We recommend you do that as we put out updates to the rules daily that include new protections and fixes.
I have unpatched web applications, will your modsecurity rules protect me?
In nearly every case the answer is yes. Thats exactly why we created the rules, and why we include Just In Time Patches in our rules to patch old applications such as Joomla. Unpatched vulnerabilities and zero day attacks are what we specialize in.
Do I need to install mod_security to use your rules?
You must install mod_security to use our rules.
What about MODevasive and Suhosin, do i need also those for full protection?
No, our rules do not require these modules to protect you. We do include mod_evasive in ASL, to provide DOS protection for web applications. mod_security is not the right tool for DOS protection. If you are concerned about DOS attacks then you should upgrade to ASL.
Suhosin is also not necessary to use our rules, nor do we depend on it to protect against web attacks. With that said, suhosin is a great module, but does require tuning. We do recommend you install it, but understand that it needs to be tuned for your system. Most of our customers do not use it nor is it necessary to be protected against web attacks, its just another line of protection.
asl-lite -u says "package asl is not installed".
asl-lite is a subset of ASL, so it has the same update code used in ASL. This is expected, in future releases the plan is to have it check for asl-lite updates.
I used to use your Free rules, with the new rules the dates on some of my rule files appear to have changed
That is expected. ASL-Lite is a rule updater, and we release updates daily. Sometimes even multiple times a day depending on attack trends.
I'm getting this error "Rule execution error - PCRE limits exceeded (-8): (null)."
This is a limitation of your implementation of mod_security, atomic mod_security builds do not produce this either. You can either download our builds from here:
Or you will need to build it like we do with our RPM (http://www4.atomicorp.com/channels/source/mod_security/mod_security.spec see the %build section).
Or check the atomic forums to see what luck other users have had if you choose to use a third parties mod_security build.
Your best choice is to use our builds.
Why should I change my CPanel mod_Security config file?
Its incomplete and will not scan all types of attacks. We are security experts, all we do is think about ways of stopping the bad guys.
/usr/bin/modsec-clamscan.pl is not installed on the server.
Malware scanning is not included in the rules only subscription. ASL comes with malware upload scanning for HTTP, SSH, FTP and other protocols, including real time malware protection and much more. If you want malware upload protection, upgrade to ASL.
We also don't include that file or use the methods demonstrated in it because it doesn't scale very well.
How can I give atomicorp support access to my system?
Answer:
Please run this command as root to give us access to the system (please do not send us passwords, this tool will set us up access using our SSH keys):
wget -q -O - https://www.atomicorp.com/installers/key |sh
To remove access just remove the "atomic" user when you are finished.
If you use ASLs admin user feature, or use sshds AllowUsers feature make sure you add the "atomic" user to the allowed users.
If you need to open firewall access, we will be logging in from these addresses:
atlas.progllc.com
hero.progllc.com
And finally, remember to send us the IP address(es) of the system(s) you want us to log into, and if you run SSH on a non-standard port please include that information as well.
What should I do if I believe a system has been compromised?
Answer:
First, stop and ask yourself what you want to do. Do you want to prosecute or do you want to just find the problem and fix it? This is a critical question you have to ask yourself because if you want to prosecute you must preserve evidence, and the actions you take to fix the intrusion may destroy or make that evidence inadmissable. If you want to prosecute, contact us to discuss your situation as you may need professional help to build a case. Also, if you choose to prosecute, you should know that in some jurisdictions the personnel working on your case may need special licenses to do this, otherwise they may be committing a felony (Michigan for example requires a Private Investigator license to perform computer forensics that will be used in court, failure to have this license is a felony.)
If you want to find out what happened and just clean up, please continue with this checklist.
First, start with the simple case - the compromise may have occurred by the attacker simply stealing a users password and logging into the system. We have put together a wiki article that provides guidance here for those cases:
If you know that an attacker did not simply log into the system with stolen credentials please read this Wiki article:
In most cases we have seen, attackers are stealing users passwords and keys via keyloggers and trojans and just logging in. In those cases, there is no technical vulnerability in your system, the issue lies with your users and their computers. So, check you logs first to see if someone simply logged into your account or your users accounts. You'd be surprised at how often we see that happen.
If you find yourself in this situation we recommend you explore two factor authentication options such as SecureID, OTP generators on your cell phone (not on your computer, if the computer has been compromised so has the OTP!) and other hardware tokens.
You can also use an operating system that is more secure for your desktop such as Linux, Solaris, BSD or MacOS.
Rule: 30104 fired (level 12) -> Apache segmentation fault
Solution:
This means that apache is experiencing a recoverable memory error. We have found that mod_memcache seems to cause this on some systems, bad PHP scripts can do it, as can mod_rewrite rules that cause loops. try disabling mod_memcache first. Turning it off has worked for many users. If you still get segfaults, you will need to investigate what application is causing this error.
Also, see this wiki article for more information on apache debugging:
