{"id":687,"date":"2016-07-01T11:49:03","date_gmt":"2016-07-01T10:49:03","guid":{"rendered":"http:\/\/www.haxed.me.uk\/?p=687"},"modified":"2016-07-01T11:59:36","modified_gmt":"2016-07-01T10:59:36","slug":"whitelisting-ips-modsecurity-1-modsecurity-2","status":"publish","type":"post","link":"https:\/\/haxed.me.uk\/index.php\/2016\/07\/01\/whitelisting-ips-modsecurity-1-modsecurity-2\/","title":{"rendered":"Whitelisting IP’s in modsecurity 1 and modsecurity 2"},"content":{"rendered":"

Hey folks, so I have noticed that in the new modsecurity CRS version 2, that ‘chained’ rules are supported. This means that whitelisting IP’s has been altered slightly.<\/p>\n

Previously whitelisting in modsecurity v2 ip whitelisting was simpler like:
\n SecRule REMOTE_ADDR “^11.22.33.44” phase:1,nolog,allow,ctl:ruleEngine=off<\/p>\n

Now in modsecurity v2 the whitelist configuration must look something like
\n
\nSecRule REMOTE_ADDR \"^11\\.22\\.33\\.44$\" phase:1,log,allow,ctl:ruleEngine=Off,id:999945
\n<\/code><\/p>\n

Now it’s kind of weird, but I hear that chains are much more secure so in that regard maybe v2 has something awesome to offer. Just was head scratching on this one for a good 20 minutes!<\/p>\n

You might be wondering why you are receiving an error like ‘configtest failed’ when restarting apache2 using modsecurity. This is probably the fix for v2 you need.<\/p>\n","protected":false},"excerpt":{"rendered":"

Hey folks, so I have noticed that in the new modsecurity CRS version 2, that ‘chained’ rules are supported. This means that whitelisting IP’s has been altered slightly. Previously whitelisting in modsecurity v2 ip whitelisting was simpler like: SecRule REMOTE_ADDR … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[33,28,7,3],"tags":[],"class_list":["post-687","post","type-post","status-publish","format-standard","hentry","category-apache","category-interweb","category-management-tools","category-security"],"_links":{"self":[{"href":"https:\/\/haxed.me.uk\/index.php\/wp-json\/wp\/v2\/posts\/687","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/haxed.me.uk\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/haxed.me.uk\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/haxed.me.uk\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/haxed.me.uk\/index.php\/wp-json\/wp\/v2\/comments?post=687"}],"version-history":[{"count":1,"href":"https:\/\/haxed.me.uk\/index.php\/wp-json\/wp\/v2\/posts\/687\/revisions"}],"predecessor-version":[{"id":688,"href":"https:\/\/haxed.me.uk\/index.php\/wp-json\/wp\/v2\/posts\/687\/revisions\/688"}],"wp:attachment":[{"href":"https:\/\/haxed.me.uk\/index.php\/wp-json\/wp\/v2\/media?parent=687"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/haxed.me.uk\/index.php\/wp-json\/wp\/v2\/categories?post=687"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/haxed.me.uk\/index.php\/wp-json\/wp\/v2\/tags?post=687"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}