[DragonByte Tech]

Originally Posted by Alan_SP

You can't just like that change the way it works. And it really has strange set of rules by default. You need to work really hard on all rules to get it working without problems on site like DBTech's (they had need for many things in posts, like php code, html code, paths to directories (linux or more rarely windows)).

All in all, mod security is more of a hindrance than security. Of course, someone who took really long time maybe can found set of rules that would give additional security without blocking genuine people posting their problems.

You are so right. I lost count of how many hours I sat staring at the live ModSec log view when we recently switched servers and installed the new version of cPanel that had built-in ModSec support instead of it being something the host controlled via their Managed Hosting option.

That was like 5-6 months ago.

I'd say our rule set is pretty stable right now though, the message Doug tried to post was quite specific and I can't say I blame them for thinking it was suspicious (sorry Doug! It's that trench coat and the blackened sunglasses, you do look a bit shifty... ).

That being said, by default ModSec appears to come with rules that are only suitable for sites that offer absolutely no user input whatsoever, which is rare these days.


Fillip