What is Mod_Security and why is it important
Mod_security is an apache module that helps to protect your website from various attacks. It is used to block commonly known exploits by use of regular expressions and rule sets and is enabled on all InMotion servers by default. Mod_Security can potentially block common code injection attacks which strengthens the security of the server. If you need to disable the mod_security rules we can show you how, and help you do so.
When coding a dynamic website, sometimes users forget to write code to help prevent hacks by doing things such as validating input. Mod_security can help in some cases those users that run sites that don't have security checks in their code.
This is a simple SQL injection where visiting this would cause the database to DROP and delete the users table from the database. If you are running Mod_Security on your server it will block this from running. Typically, you would see a 406 error in this case if mod_security is enabled. To read more about 406 errors read our article. You set up rules for Mod_security to check http requests against and determine if a threat is present.
Recognizing Mod_Security is pretty easy. Any website that calls a string forbidden by a mod_security rule will give a 406 error instead of displaying the page. On our shared servers if you would like to disable mod_security for one or all of your domains, this can be done using our Modsec manager plugin for cPanel.
If you'd like to simply disable a certain rule that is being triggered instead of disabling mod_security for the entire domain, please contact our Live Support team.
If you are a VPS or Dedicated customer you can disable mod_security for the entire server as well. This can be accomplished in WHM by selecting "No Configuration" from WHM >Mod Security. Please take note, that mod_security is enabled as an extra layer of security and removing it can expose you to potential risks.
Manually Disabling Mod_Security on a VPS or Dedicated Server
Some applications may require you to disable mod_security for them to function correctly. This is perfectly fine and since the set_modsec tool is only available on shared servers you will need to disable mod_security for a single domain:
- SSH into the server and open the httpd.conf file. Find the VirtualHost entry for that specific domain. Uncomment out the include line that looks like this:
- Copy the line you uncommented and mkdir
- Insert the rule to turn off mod_security
- Restart Apache
NOTE this line tells Apache to INCLUDE into the VirtualHost config ANY file ending in .conf. This is an advanced task and if you are unfamiliar with the command line, we suggest you contact our support team for further assistance.
mkdir -p /usr/local/apache/userdata/std/2/USER/DOMAIN.COM
echo "SecRuleEngine Off" > /usr/local/apache/userdata/std/2/USER/DOMAIN.COM/modsec.conf
service httpd restart
Disabling Specific Mod_Security Rules on VPS and Dedicated
Using SecRuleRemoveById, you can disable individual mod_security rules. To find the ID to disable, you need to look in the apache error log (/usr/local/apache/logs/error_log). You can grep for the domain that is having the problem and ModSecurity to find the problem:
grep domain.com /usr/local/apache/logs/error_log | grep ModSecurity
These lines will provide a section that looks like this: [id "950004"] The number is the ID of the ModSecurity rule that you will disable. You can then enter the following line in an applicable .htaccess file (replacing the ID of your matched error with the 950004 example used below):
Note: Do NOT include the SecRuleEngine Off line, as this will totally disable ModSecurity.
2013-07-30 9:43 am
This is all well and good, however on our dedicated server that icon does not exist.
Also you should see the InMotion article telling us of the IMPORTANCE of mod_security and it's role.
On our dedicated server mod_security has a known issue that causes 406 errors, and despite over a month of trying to get this resolved we have yet to receive a solution.
2013-07-30 10:01 am
Thank you for your comment. We are happy to help you troubleshoot the issue that is causing 406 errors, but I would need more information, such as the domain name.
As explained in this article the the button for disabling mod_sec is only available for Shared Servers:
"On our shared servers if you would like to disable mod_security for one or all of your domains, this can be done using our Modsec manager plugin for cPanel."
On VPS and Dedicated servers, you have a higher level of access, so you can modify/disable specific mod_sec rules via SSH or completely disable it in WHM as suggested in the article:
"If you are a VPS or Dedicated customer you can disable mod_security for the entire server as well. This can be accomplished in WHM by selecting "No Configuration" from WHM >Mod Security. "
If you have any further questions, feel free to post them below.