Difference between revisions of "Atomic ModSecurity Rules FAQ"

From Atomicorp Wiki
Jump to: navigation, search
Line 1: Line 1:
== Help! I need help! ==
See the [[Atomic ModSecurity Rules Support]] page for instructions on contacting support, opening a case and other tools you can use to get assistance.
== '''Are these the gotroot.com rules?'''==
== '''Are these the gotroot.com rules?'''==

Revision as of 16:47, 6 September 2010


Help! I need help!

See the Atomic ModSecurity Rules Support page for instructions on contacting support, opening a case and other tools you can use to get assistance.

Are these the gotroot.com rules?

Yes they are, the one and same (and that website is being merged into this website). We are the oldest and most experienced mod_security rule authors out there. We were putting out rules long before mod_security was acquired and then acquired again. More sites use our rules and have been using then longer than everyone else combined. If you use our rules, you're in good company.

Does a real time subscription include both the modsecurity and clamav rules?

Yes, realtime subscribers get instant access to the latest modsecurity and clamav signatures. We release updates daily based on new attacks we detect from our honeypots, new methods our labs develop, as well as fixes and improvements.

Can I setup a cronjob to automatically update the rules?

Absolutely. We recommend you do that as we put out updates to the rules daily that include new protections and fixes.

I have unpatched web applications, will your modsecurity rules protect me?

In nearly every case the answer is yes. Thats exactly why we created the rules, and why we include Just In Time Patches in our rules to patch old applications such as Joomla. Unpatched vulnerabilities and zero day attacks are what we specialize in.

Do I need to install mod_security to use your rules?

You must install mod_security to use our rules.

What about MODevasive and Suhosin, do i need also those for full protection?

No, our rules do not require these modules to protect you. We do include mod_evasive in ASL, to provide DOS protection for web applications. mod_security is not the right tool for DOS protection. If you are concerned about DOS attacks then you should upgrade to ASL.

Suhosin is also not necessary to use our rules, nor do we depend on it to protect against web attacks. With that said, suhosin is a great module, but does require tuning. We do recommend you install it, but understand that it needs to be tuned for your system. Most of our customers do not use it nor is it necessary to be protected against web attacks, its just another line of protection.

asl-lite -u says "package asl is not installed".

asl-lite is a subset of ASL, so it has the same update code used in ASL. This is expected, in future releases the plan is to have it check for asl-lite updates.

I used to use your Free rules, with the new rules the dates on some of my rule files appear to have changed

That is expected. ASL-Lite is a rule updater, and we release updates daily. Sometimes even multiple times a day depending on attack trends.

I'm getting this error "Rule execution error - PCRE limits exceeded (-8): (null)."

This is a limitation of your implementation of mod_security, atomic mod_security builds do not produce this either. You can either download our builds from here:

Atomicorp RPM repository

Or you will need to build it like we do with our RPM (http://www4.atomicorp.com/channels/source/mod_security/mod_security.spec see the %build section).

Or check the atomic forums to see what luck other users have had if you choose to use a third parties mod_security build.

Your best choice is to use our builds.

Why should I change my CPanel mod_Security config file?

Its incomplete and will not scan all types of attacks. We are security experts, all we do is think about ways of stopping the bad guys.

/usr/bin/modsec-clamscan.pl is not installed on the server.

Malware scanning is not included in the rules only subscription. ASL comes with malware upload scanning for HTTP, SSH, FTP and other protocols, including real time malware protection and much more. If you want malware upload protection, upgrade to ASL.

We also don't include that file or use the methods demonstrated in it because it doesn't scale very well.

Personal tools