Support

JasonWSInc · #1 01-21-2012, 07:58 PM

Hi there. I could use some help getting LiteSpeed Request Filters figured out please. I'm attaching some screenshots to show my current configuration. Problem: With the configuration you see in the screenshots, LiteSpeed is not "passing" on either of the two Request Filter Rule Sets that I've got, can you please explain why? Both the Rules are being denied, but I only want them to be logged, and then pass through silent, allowing access (this is just a test so I can understand how things work).

My Default Action is: log,deny,status:403
Each Rule Set has the Action: msg:"[message]",pass

I guess I'm not understanding something? After reading the documentation on mod_security, I thought that a Disruptive Action of "pass" in the Rule Set, would override that of the Default Action, which is "deny". Is that not correct?

NiteWave · #2 01-22-2012, 09:27 PM

Quote:

I thought that a Disruptive Action of "pass" in the Rule Set, would override that of the Default Action, which is "deny". Is that not correct?

I did local test, the result is : yes, should override.

the attached picture is not clear.

JasonWSInc · #3 01-22-2012, 11:34 PM

Thanks. Here are better screenshots.
http://img16.imageshack.us/img16/8712/snag0039.png
http://img827.imageshack.us/img827/5732/snag0038.png

Quote:

I did local test, the result is : yes, should override.

Sorry, does that mean that my assumption is correct then? My rules SHOULD be passing, instead of triggering a 403 status and denying the request?

What is happening is that these rules which are configured to "pass" are still being denied with a 403 status. I'm not sure if I have something configured incorrectly, or I'm missing something, or if it's a bug. Any help is appreciated. Thank you so much!

NiteWave · #4 01-22-2012, 11:50 PM

still can't view the image.

Quote:

My rules SHOULD be passing

right

JasonWSInc · #5 01-22-2012, 11:55 PM

Thank you. I'll test again just to be sure.

I posted links to the images. Here they are:

http://img16.imageshack.us/img16/8712/snag0039.png
http://img827.imageshack.us/img827/5732/snag0038.png

I tried uploading them to the forum, but your system re-sized them on me.

webizen · #6 01-23-2012, 12:47 PM

Quote:

Originally Posted by JasonWSInc

Thank you. I'll test again just to be sure.

...

You should enable audit logging to troubleshoot.