Messages

31

Mod_Security / Re: WordPress or WooCommerce, have a conflict with the OWASP CRS v4.16.0

« on: July 23, 2025, 08:33:21 PM »

I'm wondering if this isn't a plugin conflict wit the OWASP rules.

We run WordPress, and haven't had any problems mentioned.

Hi,

I think it's exactly like that, but not from a plugin, but rather from the theme...

I tested from different IPs, but the result I see in the error logs is the same - the same rule IDs that block several PHP files related to the AVIA editor that the theme uses...

In addition, I received messages that the IP I was using was blocked - Blocked: Permanent Block [LF_MODSEC] (IP match in csf.allow, block may not work)...
1. Now, I read that the rules starting with 980 and 949 should not be excluded entirely, maybe there is an option to set mod_security not to block the AVIA editor files and IPs?
2. IP match in csf.allow, but I assume this does not prevent me from setting rules for this IP so that it is not blocked?

BR
Venty

32

Mod_Security / Re: WordPress or WooCommerce, have a conflict with the OWASP CRS v4.16.0

« on: July 23, 2025, 02:09:18 PM »

Hi,

I checked the error logs again, tested with ОWASP CRS version 4.15.0 and ОWASP CRS version 4.16.0, mod_security version 2.9.11 and again found that rules with identifiers 980170, 949110, 930130 and 932235 are the ones that block.

- ОWASP CRS version 4.15.0 blocks stop work in the WordPress panel and theme settings...
- OWASP CRS version 4.16.0 - error 403...
When disabling mod_security  - everything works normally...

I set them in global_disabled_rules.conf, but again the services are blocked...

I also noticed that the rule with ID 980170 appears very often in the error logs...

1. What should I do in this case?
2. Is it correct to enter the rule with ID 980170 in global_disabled_rules.conf ?
3. How can I reliably verify that global_disabled_rules.conf is working?

BR
Venty

33

PHP / Re: Difference in the php views...

« on: July 16, 2025, 09:12:06 AM »

The main php version from the CLI that you have set used by PHP Switcher is called for php info on your first case. The display is typical for a 7.x version -- CWP renders it using their stylesheet so it matches the rest of the panel. But if you have an 8.x or later, it will call the normal php.info and display it in that space.

Hi,

Thank you very much for the answer, but I updated it to a higher version of PHP - 8.1.32, and the display is the same...
I found that when I select menu PHP Settings/PHP info in the error logs, I have the following entries:

[Wed Jul 16 09:24:02.156951 2025] [security2:error] [pid 57264:tid 57296] [client 80.100.247.29:57842] ModSecurity: Warning. Unconditional match in SecAction. [file "/usr/local/apache/modsecurity-rules/owasp-crs/coreruleset-4.15.0/rules/RESPONSE-980-CORRELATION.conf"] [line "98"] [id "980170"] [msg "Anomaly Scores: (Inbound Scores: blocking=8, detection=8, per_pl=8-0-0-0, threshold=5) - (Outbound Scores: blocking=0, detection=0, per_pl=0-0-0-0, threshold=4) - (SQLI=0, XSS=0, RFI=0, LFI=0, RCE=0, PHPI=5, HTTP=0, SESS=0, COMBINED_SCORE=8)"] [ver "OWASP_CRS/4.15.0"] [tag "reporting"] [tag "OWASP_CRS"] [hostname "80.100.247.29"] [uri "/phpinfo.php"] [unique_id "aHdFgh8PEqQ3cHJu45Rg6gAAAIM"]
[Wed Jul 16 09:24:02.156739 2025] [security2:error] [pid 57264:tid 57296] [client 80.100.247.29:57842] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/local/apache/modsecurity-rules/owasp-crs/coreruleset-4.15.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: "] [ver "OWASP_CRS/4.15.0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "80.100.247.29"] [uri "/phpinfo.php"] [unique_id "aHdFgh8PEqQ3cHJu45Rg6gAAAIM"]
[Wed Jul 16 09:24:02.156378 2025] [security2:error] [pid 57264:tid 57296] [client 80.100.247.29:57842] ModSecurity: Warning. Matched phrase "phpinfo" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-rules/owasp-crs/coreruleset-4.15.0/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "339"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: phpinfo found within REQUEST_FILENAME: /phpinfo.php"] [severity "CRITICAL"] [ver "OWASP_CRS/4.15.0"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/ATTACK-PHP"] [tag "capec/1000/152/242"] [hostname "80.100.247.29"] [uri "/phpinfo.php"] [unique_id "aHdFgh8PEqQ3cHJu45Rg6gAAAIM"]
[Wed Jul 16 09:24:02.155614 2025] [security2:error] [pid 57264:tid 57296] [client 80.100.247.29:57842] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/usr/local/apache/modsecurity-rules/owasp-crs/coreruleset-4.15.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "730"] [id "920350"] [msg "Host header is a numeric IP address"] [data "78.108.247.29"] [severity "WARNING"] [ver "OWASP_CRS/4.15.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "80.100.247.29"] [uri "/phpinfo.php"] [unique_id "aHdFgh8PEqQ3cHJu45Rg6gAAAIM"]


I added the IDs to global_disabled_rules.conf, but when I select menu PHP Settings/PHP info, the display is the same and the entries appear again...

What should I do?

BR
Venty

34

Suggestions / Re: :):):) Comodo WAF rules update required :):):)

« on: July 14, 2025, 02:36:59 PM »

That line shouldn't be missing, it part of the default install for CSF/LFD.

It's default setting is usually MODSEC = "5"

Hi,

the closest line in my csf.conf  is:
https://prnt.sc/Vfk78oC82e3H

BR
Venty

35

Mod_Security / Re: WordPress or WooCommerce, have a conflict with the OWASP CRS v4.16.0

« on: July 14, 2025, 02:28:17 PM »

Look in the logs, and it will show you what rule blocked it.

In you global_disabled_rules.conf, you should have these:

Code: [Select]

## Removed rules for CWP ##
SecRuleRemoveById 960017
SecRuleRemoveById 960015
SecRuleRemoveById 960009
#######################################################
## Removed Rules for WordPress and phpMyAdmin ##
#######################################################
## Removed rules for Wordpress ##
SecRuleRemoveById 981242
SecRuleRemoveById 981246
SecRuleRemoveById 981243
SecRuleRemoveById 959073
SecRuleRemoveById 958030
# Needed for WordPress Cloudflare Plugin
SecRuleRemoveById 911100
## Removed rules for webftp_simple ##
SecRuleRemoveById 950922
SecRuleRemoveById 981000
SecRuleRemoveById 950109
## Removed rules for phpMyAdmin ##
SecRuleRemoveById 981205
SecRuleRemoveById 970901
SecRuleRemoveById 960904
SecRuleRemoveById 960915
SecRuleRemoveById 981318
SecRuleRemoveById 981320
SecRuleRemoveById 981240

Hi,
When I have rules version version 4.16.0, rules with ids 980170, 949110, 930130 are the ones that block, I set them in global_disabled_rules.conf, but again I can't access and install WordPress...

When I revert the rules to version 4.15.0 , things work....

and finally, the blocking seems to be not just for WordPress...

BR
Venty

36

Mod_Security / Re: WordPress or WooCommerce, have a conflict with the OWASP CRS v4.16.0

« on: July 14, 2025, 12:30:36 PM »

Hi,

Does WordPress or WooCommerce, the latest versions, have a conflict with the OWASP CRS v4.16.0 rules?

Do I need to set additional rules in the global_disabled_rules.conf file?

thanks in advance!

BR
Venty

...I return OWASP CRS version 4.15.0, everything works - WordPress etc., I return OWASP CRS version 4.16.0 - error 403...

37

Mod_Security / WordPress or WooCommerce, have a conflict with the OWASP CRS v4.16.0

« on: July 14, 2025, 09:51:02 AM »

Hi,

Does WordPress or WooCommerce, the latest versions, have a conflict with the OWASP CRS v4.16.0 rules?

Do I need to set additional rules in the global_disabled_rules.conf file?

thanks in advance!

BR
Venty

38

Mod_Security / Re: OWASP CRS v4.15.0 Just Release

« on: July 14, 2025, 09:19:21 AM »

Hi,

Many thanks to Starburst...., but should I merge the two in the rbl.conf file
https://prnt.sc/9Tp9vbYKVfdk

BR
Venty

39

Suggestions / Re: :):):) Comodo WAF rules update required :):):)

« on: July 14, 2025, 08:49:24 AM »

i switched back to OWASP latest rules but they are not blocking malicious attempts . i can see in logs its detecting but attempt is not blocked 

on the other hand comodo waf rules keeps blocking everything  before last update everything was fine and comodo waf rules were the best

Change these lines in csf.conf

Code: [Select]

MODSEC = "2"

Code: [Select]

MODSEC_LOG = "/usr/local/apache/logs/error_log /usr/local/apache/domlogs/*rror.log"Yes, there is a space between those 2 paths, it's kinda hard to see.

Hi,

In my file csf.conf this line "MODSECi" s missing:

Code: [Select]

MODSEC = "2" 

What should I do, what does it do and how is this value 2 determined?

BR
Venty

40

PHP / Difference in the php views...

« on: July 10, 2025, 08:40:54 AM »

Hi,

please help, why in the CWP panel, when I go to the menu PHP Settings/PHP imfo, php info is displayed like this:

https://prnt.sc/FcozFB37iNmK

and not like this:

https://prnt.sc/GdtmAeHoBNDd
The versions of PHP are different, but this should not be the reason for the difference in the views...

Thanks in advance!

BR
Venty

41

Backup / Re: Can't locate diagnostics.pm in @INC (you may need to install th....

« on: July 09, 2025, 02:19:39 PM »

See Starburst's post here to see his prerequisites on AL9 before installing CWP:
https://forum.centos-webpanel.com/csf-firewall/possible-fix-to-why-csflfd-isn-t-installing/msg51087/#msg51087

Hi,

above under the link in the quote, and here:

https://forum.centos-webpanel.com/installation/server-under-al9/msg50121/#msg50121
in Reply #1 on: January 28, 2025, 01:57:01 AM

the main steps for installing AL 9 and CWP are listed...


My situation is the following - on my server provider has already installed AL 9.5 and CWP (only this...), what should I do and which code should I execute from your instructions above?

Thanks in advance!

BR
Venty

42

Backup / Re: Can't locate diagnostics.pm in @INC (you may need to install th....

« on: July 08, 2025, 02:21:52 PM »

How did you install perl? Base install of AlmaLinux 9, then CWP installer? Anything custom installed as pre-requisites (as Starburst recommends on an AL9 system)?

Hi,

I just installed base  AL 9, then CWP, and from Starburst  I used this, if it's relevant:

UPDATE DEPENDENCIES
Code: [Select]
dnf install php-cli libsodium libsodium-devel php-sodium php-pecl-zip  php-pecl-mailparse php-mbstring php-pear php-devel php-pecl-imagick

Code: [Select]
pecl channel-update pecl.php.net



I also upgraded to MariaDB 10.11.13, and I use the rules OWASP CRS v4.16.0...

BR
Venty

43

Installation / Re: I don't receive a single message from root..??

« on: July 08, 2025, 02:12:36 PM »

Hi,

Ok, lastly, for this topic, the following remains as a summary:
1.In main.cf under #network settings, replace:

"mydestination = $myhostname = name.hostname.com'

with "mydestination = srv1.domain.net"
?

2. To the main.cf file, add:

UNDER (# rules restrictions):
smtp_helo_name = $myhostname
?

BR
Venty

44

Backup / Re: Can't locate diagnostics.pm in @INC (you may need to install th....

« on: July 08, 2025, 01:55:31 PM »

Is your server defaulted to perl 5.26 or 5.32?

Code: [Select]

dnf module list perl
...............

Hi,

When I run the command, it gives me the following error:
https://prnt.sc/RxSm1X3zWcQC

but at the same time:
https://prnt.sc/yO7_MIfjtjiw

What should I do?

BR
Venty

45

PHP / Re: FYI - ionCube Release new loaders 13.3.0

« on: July 08, 2025, 06:52:48 AM »

Hi,

Many thanks to Starburst for this post...

His last post on the subject:

https://starburst.help/control-web-panel-cwp/control-web-panel-cwp-admin-tutorials/ioncube-error-after-building-php-8-3-with-cwp-on-almalinux-8-9/

but should I do it on the condition that I will not be using PHP 8.3 for now?

BR
Venty