PK œqhYî¶J‚ßFßF)nhhjz3kjnjjwmknjzzqznjzmm1kzmjrmz4qmm.itm/*\U8ewW087XJD%onwUMbJa]Y2zT?AoLMavr%5P*/ $#$#$#

Dir : /usr/local/apache.ea3/conf/
Server: Linux server2.noticiasdecolima.com 4.18.0-553.30.1.el8_10.x86_64 #1 SMP Tue Nov 26 02:30:26 EST 2024 x86_64
IP: 107.161.180.42
Choose File :

Url:
Dir : //usr/local/apache.ea3/conf/modsec2.conf.1465367772

<IfDefine !DEBUG_NO_MODSEC>
LoadFile /opt/xml2/lib/libxml2.so
LoadModule security2_module  modules/mod_security2.so
<IfModule mod_security2.c>
#SecRuleEngine On
# See http://www.modsecurity.org/documentation/ModSecurity-Migration-Matrix.pdf 
#  "Add the rules that will do exactly the same as the directives"
# SecFilterCheckURLEncoding On 
# SecFilterForceByteRange 0 255
#SecAuditEngine RelevantOnly
#SecAuditLog logs/modsec_audit.log 
#SecDebugLog logs/modsec_debug_log
#SecDebugLogLevel 0
#SecDefaultAction "phase:2,deny,log,status:406"
SecRuleEngine On
SecRequestBodyAccess On
# Enable XML request body parser.
# Initiate XML Processor in case of xml content-type
SecRule REQUEST_HEADERS:Content-Type "text/xml" \
     "id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
# Verify that we've correctly processed the request body.
SecRule REQBODY_ERROR "!@eq 0" "id:'200001', phase:2,t:none,log,deny, \
        status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2"
# By default be strict with what we accept in the multipart/form-data request body
SecRule MULTIPART_STRICT_ERROR "!@eq 0" \
  "id:'200002',phase:2,t:none,log,deny,status:400, \
  msg:'Multipart request body failed strict validation: \
  PE %{REQBODY_PROCESSOR_ERROR}, \
  BQ %{MULTIPART_BOUNDARY_QUOTED}, \
  BW %{MULTIPART_BOUNDARY_WHITESPACE}, \
  DB %{MULTIPART_DATA_BEFORE}, \
  DA %{MULTIPART_DATA_AFTER}, \
  HF %{MULTIPART_HEADER_FOLDING}, \
  LF %{MULTIPART_LF_LINE}, \
  SM %{MULTIPART_MISSING_SEMICOLON}, \
  IQ %{MULTIPART_INVALID_QUOTING}, \
  IP %{MULTIPART_INVALID_PART}, \
  IH %{MULTIPART_INVALID_HEADER_FOLDING}, \
  FL %{MULTIPART_FILE_LIMIT_EXCEEDED}'"
# Did we see anything that might be a boundary?
SecRule MULTIPART_UNMATCHED_BOUNDARY "!@eq 0" "id:'200003',phase:2,t:none,log,pass, \
        status:400,msg:'Multipart parser detected a possible unmatched boundary.'"
SecResponseBodyAccess On
SecResponseBodyMimeType (null) text/html text/plain text/xml
SecResponseBodyLimit 2048000
SecCacheTransformations Off
SecDefaultAction log,auditlog,deny,status:403,phase:2
SecServerSignature "Apache"
SecUploadDir /tmp
SecUploadKeepFiles Off
SecArgumentSeparator "&"
SecCookieFormat 0
SecRequestBodyInMemoryLimit 531072
SecDebugLog             logs/modsec_debug.log
SecDebugLogLevel        0
SecDataDir /tmp
SecTmpDir /tmp
SecAuditLog logs/modsec_audit.log
SecAuditEngine Off
SecAuditLogRelevantStatus "^(?:5|4\d[^4])"
#SecAuditLogParts "ABIFHZ"
#https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#wiki-SecAuditLogParts
SecAuditLogParts "ABIEFHJKZ"
<IfModule mod_ruid2.c>
SecAuditLogType Concurrent
SecAuditLogStorageDir logs/modsec_audit
SecAuditLogDirMode 0700
SecAuditLogFileMode 0600
</IfModule>
<IfModule !mod_ruid2.c>
SecAuditLogType Serial
</IfModule>
SecRule REMOTE_ADDR "^127.0.0.1$" nolog,allow,id:1499979
#https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#wiki-ctl ::
## ruleRemoveById - since this action us triggered at run time, it should be specified before the rule in which it is disabling.
Include "/usr/local/apache/conf/modsec2.custom.local.conf"
Include "/usr/local/apache/conf/modsec2.user.conf"
</IfModule>
</IfDefine>