[Resolved] Turn off ModSecurity directives in htaccess

I

IrPr

Well-Known Member
#1
#1
Hi there,

It seems that ModSecurity it could be disabled in htaccess using this directive:
Code: 
SecFilterEngine Off
Well, It means an attacker can easily bypass modsec rules using htaccess file
Tested myself and it's possible to disable and bypass modsec rules by htaccess, and to me, its a very big security hole

I found here that its possible to disable htaccess support for ModSecurity during compile:

If you do not trust your users (e.g. running in a web hosting environment) then you should never allow them access to ModSecurity. The .htaccess facility is useful for limited administration control decentralisation, keeping ModSecurity configuration with the application code. But it is not meant to be used in situations when the users may want to subvert the configuration. If you are running a hostile environment you should turn off the .htaccess facility completely by custom-compiling ModSecurity with the -DDISABLE_HTACCESS_CONFIG switch.
Click to expand...
Now im asking for a feature to disable/enable ModSec rules support inside htaccess files to be implemented in LSWS admin console

Regards.
 
Last edited by a moderator:
N

NiteWave

Administrator
#4
#4
now in 4.0.17, mod_security directive in .htaccess can be disabled, configuration is at server level, in admin console. please download and test ... not formally release yet but may be soon.
 
I

IrPr

Well-Known Member
#5
#5
NiteWave said:
now in 4.0.17, mod_security directive in .htaccess can be disabled, configuration is at server level, in admin console. please download and test ... not formally release yet but may be soon.
Click to expand...
Special thanks
tested and its working properly

Regards
 
N

NiteWave

Administrator
#7
#7
tested on our cPanel box, the setting:

admin console->Server->Request Filter->Disable .htaccess Override:Yes

apply for virtual hosts defined in apache httpd.conf.
 
You must log in or register to reply here.
Top