On Oct 15, 2026, at 3:06 PM, Peter Murray <000000ab738da05e-dmarc-request_at_lists.clir.org> wrote:
> Interesting! I went to look at the project's website (https://modsecurity.org/).
> Are you using v2 or v3? Any special configuration options?
>
> --
> Peter
Version? Hmmm... [Eric goes off to look.] I have installed version 2.9.6:
ModSecurity for Apache/2.9.6 (http://www.modsecurity.org/)
To install the software I merely used yum to install mod_security itself:
yum install mod_security
And then a set of rules:
yum install -y mod_security_crs
Installation augmented my Web server's configuration files, and after restarting things just worked.
More specifically, mod_security sniffs each and every transaction against my Web server while comparing the transactions to mod_security's default rules and the extra set of rules. When a transaction is anomalous -- for whatever reason -- the user agent is flagged. After a user-agent is flagged more than 5 times, the user-agent's requests are denied.
mod_security's log files are verbose, to say the least. After watching them for a few days, there are three primary reason user-agents got flagged and then denied access:
1. Non-resolvable IP addresses - User-agents can send their IP address saying who they are, but the IP addresses are expected to be resolvable. They don't have to be resolvable but it is expected. Very often bad robots do not have resolvable IP addresses, and very often good robots as well as real people are using computers with resolvable IP addresses. Thus user-agents whose IP addresses are not resolvable get flagged and then ultimately denied.
2. SQL injection - Kewl library interfaces accept a query and return results filled with links. Those links return more results with more links. This is all very well, good, and fine for people, but for dumb computers, this sort of thing results in infinite loops. These links are often very long and include bunches o' syntax, and that syntax often appears to be SQL-injection attacks. Mod_securty flags such long links and has ultimately broken the infinite loops. For the most part, this works very well for me.
3. Stupid URLs - A new trick seems to be for a robot to find a query and add something like my-cool-site.com or sales_at_my-cool-site.com to the query, thus flooding your log files with unwanted cruft. Such queries get flagged and ultimately denied.
Since installing mod_security and doing nothing else, my robot traffic is no longer processed. Access denied has gone through the roof, and my computer can actually... compute.
After running mod_security for a while, one can post process the log files and do other cool things, like turn user-agents off at the firewall, add them to fail2ban, etc.
To me, when it comes to mod_security, so far so good.
--
Eric Morgan <eric_morgan_at_infomotions.com>
Received on Sun Oct 18 2026 - 12:53:31 EDT