Re: Apache module: mod_security

After a cursory glance, other than removing a some abstraction and making configuration a little more staight forward; I'm not sure how this differs from what can be done with mod_rewrite.

I didn't see anything in the attributes list that I can't reveiw and take action on with rewrite rules. With mod_rewrite, I can perform other options than blocking and logging. I can send them to a page of my choice (and a few stinkers come to mind! ;-). I can route their traffic back to themself. I can redirect/proxy them off to a honeypot, etc.

While this might be a good first step in the right direction (I spend a lot of time carving apache into a webbased application level gateways); I'd like to see a lot more than a simpler conf language and a gui (actually you can keep the gui).

1. how about using snort rules natively
2. how about data collection on the source of the connection
3. how about notifications
4. how about fat free donuts that don't taste like sawdust (oops! I gott get more sleep! :-)

The author's web site mentions some dissatisfaction with mod-rewrite but, other than payload examination, doesn't go into specifics. I'd like to hear more. The site is a little sparse of specifics.

I hope this keeps going, and more people get involved. I'll probably be pulling this down and looking at it for our environment. Even if I don't put it into production, it bears watching...

Bill Burge
Info Sec Officer
places, stuff....

• REPLY SEPARATOR ***********

>That's really cool! I think one of the salient features of it you didn't
Received on Tue Dec 10 10:47:10 2002

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek