Need some help with mod_security

baldur2630 · 01-16-2012, 08:03 AM

I have a CentOS 6.2 server with a website on it. I just installed mod_security. It seems to work OK (well the site does!), but I'm getting some strange error messages in my logs : -

ModSecurity: Failed to access DBM file "/etc/httpd/logs//global":

ModSecurity: Failed to access DBM file "/etc/httpd/logs//ip": Permission denied

I'm by no means a Linux 'expert', I can find my way around, but I have NO idea what a // means in a path, or why I'm getting these messages.

Can someone please advise me (in simple language) how to fix this?

ranelson · 01-16-2012, 08:22 AM

hello,

// = /

you normally see this when a script is missing a variable for a path.

x/y/$z/test where $z=''

ModSecurity is trying to access two DBM files in /etc/httpd/logs/

They are ether missing or the file and or directory permissions are wrong

baldur2630 · 01-16-2012, 08:28 AM

Well neither file exists. or are they folders? What should the permissions be if I create them or is there some other way to create them? Mod_security is a part of the CentOS repositories, because I installed it with yum. Why didn't it create all the folders / files it should have done - bug perhaps?

unSpawn · 01-17-2012, 04:05 PM

Quote:

Originally Posted by baldur2630

Why didn't it create all the folders / files it should have done - bug perhaps?

Apparently an ongoing issue, see https://bugzilla.redhat.com/show_bug.cgi?id=569360.

As for

Quote:

damned script kiddies. They are just hammering this server, 24 x 7 and taking up most of my bandwidth.

(I mean https://www.centos.org/modules/newbb...35325&forum=59)
Hammering maybe but as long as the server returns ^3xx or ^4xx return codes that's OK: they're going nowhere with their incessant scanning.
OTOH it's highly doubtful they exhaust your bandwidth (do some accounting and show?) but you could (temporarily) rate-limit traffic, see here and there.