mod_security and Subversion (WebDAV?)

vbfischer · 03-22-2006, 08:23 AM

I can get Subversion to work ONLY if I disable mod_security. I believe this is because Subversion (using Apache) uses WebDAV, which uses methods besides GET, POST, etc.

Anyone know how to setup mod_secuity to allow Subversion? I'm guessing the most secure way would be to allow it only for the location to Subversion.

Thanks

unSpawn · 03-22-2006, 08:40 AM

Last time I checked DAV uses methods like LOCK, UNLOCK, PROPFIND, PROPPATCH, COPY, MOVE and MKCOL.
So AFAIK for each method you'd need some rule something like: "SecFilter "LOCK " pass". Maybe a <location> container works, just try it. FWIW, it's easier/faster/more efficient to post actual error messages.

vbfischer · 03-22-2006, 09:04 AM

Sorry, I made a conclusion on what the issue was, and forgot to mention the symptoms. This is what the SVN client (TortoiseSVN for Windows)is reporting:

Quote:

MKCOL of/svn/proj/!svn/wrk/3619e3f3-83b2-874a-815b-7f80fe548963/proj_web/trunk':
405 Method Not Allowed (http://www.<domain>.com)

I'll try the suggestions you made above.

Thanks for the response

vbfischer · 03-22-2006, 10:08 AM

Reenabled mod_security, and I'm getting a "403 Forbidden" error when its trying to do a PUT.

Here is my mod_security configuration:

Code:

LoadModule security_module    /usr/lib/httpd/modules/mod_security.so

# Enable mod_security
SecFilterEngine On

# Retrieve request payload
SecFilterScanPOST On

# Reasonable automatic validation defaults
SecFilterCheckURLEncoding On
SecFilterCheckCookieFormat Off
SecFilterNormalizeCookies Off
SecFilterCheckUnicodeEncoding Off

# Accept almost all byte values
SecFilterForceByteRange 0 255

# Reject invalid requests with status 403
SecFilterDefaultAction deny,log,status:403

# Only record the relevant information
SecAuditEngine RelevantOnly
SecAuditLog /var/log/httpd/audit_log

# Where to store temporary and intercepted files
SecUploadDir /var/log/httpd/files
# Do not store intercepted files for the time being
SecUploadKeepFiles Off

# Use 0 for the debug level in production
# and 4 for testing
SecFilterDebugLog /var/log/httpd/modsec_debug_log
SecFilterDebugLevel 0

SecServerSignature "Microsoft-IIS/5.0"

SecFilter PUT "allow"

unSpawn · 03-22-2006, 03:48 PM

Reenabled mod_security, and I'm getting a "403 Forbidden" error when its trying to do a PUT.
Maybe a <location> container works, just try it.

vbfischer · 03-23-2006, 10:23 AM

To answer my own question in case anyone else comes across this issue, unSpawn had the right idea.

The following worked great for me:

Code:

<Location /svn/proj>
  SecFilterEngine Off
</Location>

Where /svn/proj is the location of the subversion repository.

unSpawn · 03-23-2006, 02:18 PM

Code:

SecFilterEngine Off

So now it' doesn't filter anything AFAIK wrt /svnproj.
Shouldn't it be followed by what you want to filter for (like in the main portion of your config) leaving out only the WebDAV specific stuff?