What is Mod_Security and why is it important

Mod_security is an apache module that helps to protect your website from various attacks. Mod_Security is used to block commonly known exploits by use of regular expressions and rule sets. Mod_Security is enabled on all InMotion Servers by default. Mod_Security can potentially block common code injection attacks which strengthens the security of the server. If you need to disable mod_security we can show you how, and help you do so.

When coding a dynamic website, sometimes users forget to write code to help prevent hacks by doing things such as validating input. Mod_security can help in some cases those users that run sites that don't have security checks in their code.

http://www.webapp.com/login.php?username=admin'">DROP%20TABLE%20users--

This is a simple SQL injection where visiting this would cause the database to DROP and delete the users table from the database. If you are running Mod_Security on your server it will block this from running. Typically, you would see a 406 error in this case if mod_security is enabled. To read more about 406 errors read our article. You set up rules for Mod_security to check http requests against and determine if a threat is present. 

Recognizing Mod_Security is pretty easy. Any website that calls a string forbidden by a mod_security rule will give a 406 error instead of displaying the page. On our shared servers if you would like to disable mod_security for one or all of your domains, this can be done using our Modsec manager plugin for cPanel.

If you'd like to simply disable a certain rule that is being triggered instead of disabling mod_security for the entire domain, please e-mail support@inmotionhosting.com to open a support ticket. If you send an email, for verification purposes please provide us with the original cPanel password, the current AMP password, or the last four digits of the current credit card on file.

If you are a VPS or Dedicated customer you can disable mod_security for the entire server as well. This can be accomplished in WHM by selecting "No Configuration" from WHM >Mod Security. Please take note, that disabling mod_security is enabled as an extra layer of security and removing it can expose you to potential risks. 

Manually Disabling Mod_Security on a VPS or Dedicated Server

Some applications may require you to disable mod_security for them to function correctly. This is perfectly fine and since the set_modsec tool is only available on shared servers you will need to disable mod_security for a single domain:

1. SSH into the server and open the httpd.conf file. Find the VirtualHost entry for that specific domain. Uncomment out the include line that looks like this:

Include "/usr/local/apache/conf/userdata/std/2/USERNAME/DOMAIN.COM/*.conf"

NOTE this line tells Apache to INCLUDE into the VirtualHost config ANY file ending in .conf. This is an advanced task and if you are unfamiliar with the command line, we suggest you contact our support team for further assistance. 

2. Copy the line you uncommented and mkdir

mkdir -p /usr/local/apache/userdata/std/2/USER/DOMAIN.COM

3. Insert the rule to turn off mod_security

echo "SecRuleEngine Off" > /usr/local/apache/userdata/std/2/USER/DOMAIN.COM/modsec.conf

4. Restart Apache

service httpd restart

Disabling Specific Mod_Security Rules on VPS and Dedicated

Using SecRuleRemoveById, you can disable individual mod_security rules. To find the ID to disable, you need to look in the apache error log (/usr/local/apache/logs/error_log). You can grep for the domain that is having the problem and ModSecurity to find the problem:

grep domain.com /usr/local/apache/logs/error_log | grep ModSecurity

These lines will provide a section that looks like this: [id "950004"] The number is the ID of the ModSecurity rule that you will disable. You can then enter the following line in an applicable .htaccess file (replacing the ID of your matched error with the 950004 example used below):

SecRuleRemoveById 950004

Note: Do NOT include the SecRuleEngine Off line, as this will totally disable ModSecurity.