Jump to content

Recommended Posts

I'm considering installing mod_security on my dedicated machine, but I am concerned about 1) what existing scripts it might break and 2) any mainstream scripts such as phpbb, etc that may have problems with it and 3) any other personal feelings you have about it. Good, bad, ugly. Thanks in advance!

Link to post
Share on other sites

mod_security by itself won't 'break' any script, as mod_security doesn't interact with any script you might have on the server.


What mod_security does is act as a sort of 'firewall' to the web server. All web page requests pass through mod_security, and mod_security examines the request according to the rules it is configured with. Based on these rules, the request is either rejected immediately (and the web server never sees the request at all), or the request is allowed, and mod_security passes the request along to Apache.


If mod_security is improperly configured, you can end up blocking access to not only your scripts but your web site as a whole. mod_security is a powerful tool, and it can easily block more than what you intend if you're not careful in setting up mod_security's rules. This is where you would have an issue with mod_security and some script you have installed such as phpBB.


For users like you who have a dedicated server, I would recommend installing and using mod_security if you have a need for it. I've used mod_security in the past on my shared hosting account here at TCH (blocking comment and trackback spammers on my Movable Type weblog), and it was *very* effective.


The most important thing in implementing mod_security filtering is to understand the rules you add to mod_security. Don't grab a list of 100 rules from some other web site and just drop them into your server without looking at and understanding what they do.


Hope this helps...

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Create New...