How to add this to ModSecurity htaccess custom code

[webstar]

Hi,

I need to add this to my .htaccess file.

<IfModule security2_module>
	SecRuleRemoveById 114
</IfModule>

Where do I add this?

Thanks.

[AITpro Admin]

security2_module is the name of the ModSecurity module that you would load in the your httpd.conf file.  ModSecurity 2 no longer allows you to disable ModSecurity and I also assume that all htaccess code in an htaccess file will be ignored. Note: the IfModule condition for ModSecurity 2 is:  IfModule mod_security2.c.  So the code you posted above would have to go in the modsecurity.conf file and cannot be used in an htaccess file.

https://forum.ait-pro.com/forums/topic/mod-security-common-known-problems/
htaccess file code that no longer works/is ignored by ModSecurity 2

<IfModule mod_security2.c>
SecFilterEngine Off
SecFilterScanPOST Off
</IfModule>

https://community.bitnami.com/t/how-to-configure-security2-module-on-mamp-tested-ok/31886

httpd.conf

#LoadModule security2_module modules/mod_security2.so

# Mod security 
<IfModule security2_module> 
Include conf/extra/modsecurity.conf 
</IfModule>

[AITpro Admin]

This is what is in my Apache httpd.conf file for testing ModSecurity 2.  Additional information about ModSecurity 2 and the OWASP CRS rule set > https://forum.ait-pro.com/forums/topic/xampp-mod-security-setup-owasp-modsecurity-core-rule-set-setup/

LoadModule security2_module modules/mod_security2.so
Include conf/extra/modsecurity.conf
<IfModule security2_module>
Include modsecurity/owasp-modsecurity-crs/crs-setup.conf
Include modsecurity/owasp-modsecurity-crs/rules/*.conf
</IfModule>

[webstar]

Just to give you some background info, I wanted to allow access to the xml-rpc WordPress file because Jetpack suggested that it was unavailable (i.e. maybe it was blocked)

I contacted my host and they said, yes, it was disabled for security reasons. I could enable it in my control panel.

I did that, but, then I noticed my auto.htaccess file got quarantined. Not sure why that was, but, then I put the two together.

So, I asked my host what exactly changes when I enable xml-rpc in the control panel.

They told me that that code I mentioned above gets inserted into the .htaccess file because it removes the restriction the host has on xml-rpc.

So, not sure if that changes anything you said previously.

But, I can double check with my host in case the support person was wrong or something.

I’ll also check if the quarantined file actually had that change put into it. I assumed it got quarantined because of that, but, it’s possible something else got it quarantined.

I’ll get back to you on that.

 

[Author]

Posts