[Tutorial] How To Manually Update Comodo ModSecurity Rules For CyberPanel

selfhosted · August 20, 2020, 2:09pm

I originally posted this in the Facebook group but Owen asked me to post it here also, so here we are. As you may not know even fresh installs of CyberPanel come with ModSecurity rules that are over 2 years old so you may not be as protected as you think. the below tutorial assumes you already have ModSecurity Comodo rules installed via CyberPanel admin area…

Step 1

go to https://waf.comodo.com/ and download the latest rules. It is important that you select NGINX rules as OpenLitespeed is not compatible with ModSecurity 2 rules.

Step 2

using sftp go to /usr/local/lsws/conf/modsec/comodo where you will see the old rules.

Step 3

check ownership on rules by opening any of the files and seeing who they are running as. it will either be cyberpanel:cyberpanel or lsadm:nobody. (I’m not sure which is correct but i’ve observed both on different servers)

Step 4

delete all files in /usr/local/lsws/conf/modsec/comodo except for modsecurity.conf and then upload all the updated files you downloaded from comodo.

Step 5

change owner for the files you uploaded according to what they were prior by using either of these commands depending on which is correct for your setup:

…

chown -R lsadm:nobody /usr/local/lsws/conf/modsec/comodo

…

chown -R cyberpanel:cyberpanel /usr/local/lsws/conf/modsec/comodo

Step 6

edit the following file: /usr/local/lsws/conf/httpd_config.conf

…

find the line beginning modsecurity_rules_file

…

keep these 2 lines:

modsecurity_rules_file /usr/local/lsws/conf/modsec/rules.conf

modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/modsecurity.conf

…

remove the lines from:

…

modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/00_Init_Initialization.conf

…

until

…

modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/28_Apps_OtherApps.conf

…

replace with new lines:

…

modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/00_Init_Initialization.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/01_Init_AppsInitialization.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/02_Global_Generic.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/03_Global_Agents.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/04_Global_Domains.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/05_Global_Incoming.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/06_Global_Backdoor.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/07_XSS_XSS.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/08_Global_Other.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/09_Bruteforce_Bruteforce.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/10_HTTP_HTTP.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/11_HTTP_HTTPDoS.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/12_HTTP_Protocol.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/13_HTTP_Request.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/14_Outgoing_FilterGen.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/15_Outgoing_FilterASP.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/16_Outgoing_FilterPHP.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/17_Outgoing_FilterSQL.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/18_Outgoing_FilterOther.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/19_Outgoing_FilterInFrame.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/20_Outgoing_FiltersEnd.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/21_PHP_PHPGen.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/22_SQL_SQLi.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/23_ROR_RORGen.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/24_Apps_Joomla.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/25_Apps_JComponent.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/26_Apps_WordPress.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/27_Apps_WPPlugin.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/28_Apps_WHMCS.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/29_Apps_Drupal.conf
modsecurity_rules_file /usr/local/lsws/conf/modsec/comodo/30_Apps_OtherApps.conf

Step 7

Restart litespeed and you’re good to go

Step 8 (optional)

In Cyberpanel go to: ModSecurity Rules Pack and click configure next to Comodo Modsecurity 3.0

you can then turn off any rule sets you don’t need. eg if all the sites on your server are wordpress then you can safely turn off drupal and joomla rules for very marginal improvement in efficiency.

Germanos · September 2, 2020, 7:37pm

Thank You, worked right away !

Germanos · September 4, 2020, 3:43pm

Did it a second time today.

ls -l gave me surprisingly: lsadm nogroup

So i did: chown -R lsadm:nogroup /usr/local/lsws/conf/modsec/comodo

Hope that’s right…please correct me if that’s not right

Numeriku · September 24, 2020, 7:38am

chown -R cyberpanel:cyberpanel /usr/local/lsws/conf/modsec/comodo this worked for my installation.

renato_nogueira · January 4, 2021, 7:58pm

Thank you. It works for me but i use owasp instead comodo.

subh · February 18, 2021, 1:46pm

Unable to download OWASP ModSecurity Core Rules and COMODO ModSecurity 3.0 mod security rules section.

After a fresh installation, when I am configuring the Mod security on the cyber panel I got an error for both OWASP and MODDECURITY 3.0.

I also checked both URLs .they are throwing 404 errors

for comodo =https://cyberpanel.net/modsec/comodo.tar.gz
for OWSAP =https://cyberpanel.net/modsec/owasp.tar.gz

Even at /usr/local/lsws/conf/modsec/ there is neither comodo folder nor owasp.

==============================================================

The installation i did today only.

Could you anyome please assist me.

thanks

maxin · February 22, 2021, 5:48pm

@subh

you can edit the file

/usr/local/CyberCP/plogical/modSec.py and change the mirrorpath from “cyberpanel.net” to “cyberpanel.sh”

mirrorPath = “cyberpanel.sh”

and try install and it will be ok

dclozier · November 30, 2021, 11:02pm

I’m seeing the following error - any ideas?

/usr/local/lsws/bin/openlitespeed -t
t:none,t:urlDecode2021-11-30 16:51:44.514921 [ERROR] [26709] [Module:mod_security]setSecRule(type 1)
secdebugloglevel 0
secdebuglog /usr/local/lsws/logs/modsec.log
secauditengine on
secauditlogrelevantstatus "^(?:5|4(?!04))"
secauditlogparts AFH
secauditlogtype Serial
secauditlog /usr/local/lsws/logs/auditmodsec.log
secruleengine On
secresponseaccess off
  failed, ret -1, reason: 'Rules error. File: <<reference missing or not informed>>. Line: 10. Column: 22. Invalid input:  secresponseaccess off'.
2021-11-30 16:51:44.515899 [ERROR] [26709] [Module:mod_security]setSecRule(type 2) /usr/local/lsws/conf/modsec/comodo/modsecurity.conf failed, ret -1, reason: 'Rules error. File: <<reference missing or not informed>>. Line: 10. Column: 22. Invalid input:  secresponseaccess offRules error. File: /usr/local/lsws/conf/modsec/comodo/modsecurity.conf. Line: 195. Column: 17

I can’t seem to find secresponseaccess in the modsecurity.conf file.

This was caused by me when trying to fix very slow page loading with WordPress/Divi theme. Based on the following:

github.com/SpiderLabs/owasp-modsecurity-crs

Too many false positives to list

opened 11:58PM - 13 Aug 19 UTC

closed 07:59PM - 21 Aug 19 UTC

Ed-AITpro

Without all out ranting here and exploding like I feel like exploding it would b…e great if you could provide some sort of Mod Security whitelisting method that could be used in a WordPress Plugin's code to tell Mod Security not to falsely flag every single thing as a threat. The problem with trying to deal with all the false flags in Mod Security is this > A customer contacts me and I confirm that yep this is another case of Mod Security falsely seeing a threat. The functionality of my plugin is broken of course during the process of getting the end user to contact their web host support folks. 9 times out of 10 the web host support folks have no idea what they are doing and the problem goes unsolved. I have literally had 1,000's of end users abandon my plugin due to Mod Security incorporated into newer cPanel versions. Mod Security itself is great. The available methods to fix Mod Security problems is a nightmare for everyone involved. I'm not sure if there is a way to safely create a usable bypass or whitelisting method for Mod Security from a website vs doing config changes server-side. What I mean by safely is that if a hacker can use the whitelisting/bypass method then that renders Mod Security ineffective. Let's say a Mod Security whitelisting method/bypass was created with certain conditions such as "if the WordPress plugin is installed on the website then it is safe to assume it is not a threat" You would of course convert that statement into a code if statement. Personally I think it was a huge mistake for cPanel to include Mod Security without also supplying pre-built tools for end users so that they could fix Mod Security problems themselves. Contacting web host support does not work 9 times out of 10 because web host support techs do not know what they are doing. The majority of the time they respond back with something like we have fixed the SecRules that were causing the problem or we disabled Mod Security for this site or hosting account and neither are true in 90% of all the cases i have been dealing with for the past year. so that tells me the web host support techs have no idea how to actually fix Mod Security problems or how to disable Mod Security. I'm keeping this as civilized as possible, but I am at my wits end with this stuff. I have lost a very significant amount of end users, customers, time and money. I don't actually expect you to do anything at all to make this nightmare more reasonable so I think the only solution is going to be to use some sort of encryption methods to bypass Mod Security altogether. What is absolutely overkill insanity to me is that Mod Security reads the body content of plugin page if a form is submitted from that page. Seriously??? see this Mod Security disaster below. ``` [Tue Aug 13 16:35:12.108856 2019] [:error] [pid 8344:tid 2036] [client 127.0.0.1:58098] [client 127.0.0.1] ModSecurity: Warning. Pattern match "(?i)(?:supplied argument is not a valid MySQL|Column count doesn't match value count at row|mysql_fetch_array\\\$\\\$|on MySQL result index|You have an error in your SQL syntax;|You have an error in your SQL syntax near|MySQL server version for the right ..." at RESPONSE_BODY. [file "C:/xampp/apache/modsecurity/owasp-modsecurity-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"] [line "373"] [id "951230"] [msg "mysql SQL Information Leakage"] [data "Matched Data: Warning: JavaScript is disabled in your Browser</span><br />BPS plugin pages will not display visually correct and all BPS JavaScript functionality will not work correctly.</div></noscript>\\x0a\\x0a\\x09\\x09\\x0a\\x09\\x09<script type=\\x22text/javascript\\x22>\\x0a\\x09\\x09/* <![CDATA[ */\\x0a\\x09\\x09jQuery(document).ready(function($){\\x0a\\x09\\x0a\\x09\\x09\\x09$(\\x22html, body\\x22).animate({ scrollTop: \\x2250px\\x22 }, 400, function(){\\x0a \\x09\\x09\\x09\\x09$(\\x22html, body\\x22).animate({ scrollTop: \\x22..."] [severity "CRITICAL"] [ver "OWASP_C [hostname "demo9.local"] [uri "/wp-admin/admin.php"] [unique_id "XVNJLzsBsvuo17DcrKWzkwAAAIg"], referer: http://demo9.local/wp-admin/admin.php?page=bulletproof-security%2Fadmin%2Fquarantine%2Fquarantine.php [Tue Aug 13 16:35:12.292363 2019] [:error] [pid 8344:tid 2036] [client 127.0.0.1:58098] [client 127.0.0.1] ModSecurity: Warning. Matched phrase "Call to undefined function" at RESPONSE_BODY. [file "C:/xampp/apache/modsecurity/owasp-modsecurity-crs/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf"] [line "47"] [id "953100"] [msg "PHP Information Leakage"] [data "Matched Data: Call to undefined function found within RESPONSE_BODY: <!DOCTYPE html>\\x0a\\x0a\\x0a<html xmlns=\\x22http://www.w3.org/1999/xhtml\\x22 class=\\x22wp-toolbar\\x22\\x0a\\x09lang=\\x22en-US\\x22\\x09>\\x0a\\x0a<head>\\x0a<meta http-equiv=\\x22Content-Type\\x22 content=\\x22text/html; charset=UTF-8\\x22 />\\x0a\\x09<title>Quarantine ~ B..."] [severity "ERROR"] [ver "OWASP_CRS/3.1.1"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-disclosure"] [tag "OWASP_CRS/LEAKAGE/ERRORS_PHP"] [tag "WASCTC/WASC-13"] [tag "OWASP_TOP_10/A6"] [tag "PCI/6.5.6"] [hostname "demo9.local"] [uri "/wp-admin/admin.php"] [unique_id "XVNJLzsBsvuo17DcrKWzkwAAAIg"], referer: http://demo9.local/wp-admin/admin.php?page=bulletproof-security%2Fadmin%2Fquarantine%2Fquarantine.php [Tue Aug 13 16:35:12.299370 2019] [:error] [pid 8344:tid 2036] [client 127.0.0.1:58098] [client 127.0.0.1] ModSecurity: Warning. Pattern match "(?:\\\\b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scanf|write|open|read)|gz(?:(?:encod|writ)e|compress|open|read)|s(?:ession_start|candir)|read(?:(?:gz)?file|dir)|move_uploaded_file|(?:proc_|bz)open|call_user_func)|\\\\$_(?:(?:pos|ge)t|session))\\\\b" at RESPONSE_BODY. [file "C:/xampp/apache/modsecurity/owasp-modsecurity-crs/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf"] [line "76"] [id "953110"] [msg "PHP source code leakage"] [data "Matched Data: session_start found within RESPONSE_BODY: <!DOCTYPE html>\\x0a\\x0a\\x0a<html xmlns=\\x22http://www.w3.org/1999/xhtml\\x22 class=\\x22wp-toolbar\\x22\\x0a\\x09lang=\\x22en-US\\x22\\x09>\\x0a\\x0a<head>\\x0a<meta http-equiv=\\x22Content-Type\\x22 content=\\x22text/html; charset=UTF-8\\x22 />\\x0a\\x09<title>Quarantine ~ BPS Pro Automa..."] [severity "ERROR"] [ver "OWASP_CRS/3.1.1"] [tag "app [hostname "demo9.local"] [uri "/wp-admin/admin.php"] [unique_id "XVNJLzsBsvuo17DcrKWzkwAAAIg"], referer: http://demo9.local/wp-admin/admin.php?page=bulletproof-security%2Fadmin%2Fquarantine%2Fquarantine.php [Tue Aug 13 16:35:12.319318 2019] [:error] [pid 8344:tid 2036] [client 127.0.0.1:58098] [client 127.0.0.1] ModSecurity: Warning. Operator GE matched 4 at TX:outbound_anomaly_score. [file "C:/xampp/apache/modsecurity/owasp-modsecurity-crs/rules/RESPONSE-959-BLOCKING-EVALUATION.conf"] [line "69"] [id "959100"] [msg "Outbound Anomaly Score Exceeded (Total Score: 13)"] [tag "anomaly-evaluation"] [hostname "demo9.local"] [uri "/wp-admin/admin.php"] [unique_id "XVNJLzsBsvuo17DcrKWzkwAAAIg"], referer: http://demo9.local/wp-admin/admin.php?page=bulletproof-security%2Fadmin%2Fquarantine%2Fquarantine.php [Tue Aug 13 16:35:12.320289 2019] [:error] [pid 8344:tid 2036] [client 127.0.0.1:58098] [client 127.0.0.1] ModSecurity: Warning. Operator GE matched 4 at TX:outbound_anomaly_score. [file "C:/xampp/apache/modsecurity/owasp-modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf"] [line "96"] [id "980140"] [msg "Outbound Anomaly Score Exceeded (score 13): PHP source code leakage; individual paranoia level scores: 13, 0, 0, 0"] [tag "event-correlation"] [hostname "demo9.local"] [uri "/wp-admin/admin.php"] [unique_id "XVNJLzsBsvuo17DcrKWzkwAAAIg"], referer: http://demo9.local/wp-admin/admin.php?page=bulletproof-security%2Fadmin%2Fquarantine%2Fquarantine.php ```

Please disregard. Hopefully the new Comodo rules will do the trick.

Thanks!

dclozier · November 30, 2021, 11:13pm

I was also getting a unicode.mapping error but I think I fixed it.

Failed to locate the unicode map file from: unicode.mapping Looking at: 'unicode.mapping', 'unicode.mapping', '/usr/local/lsws/conf/modsec/comodo/unicode.mapping', '/usr/local/lsws/conf/modsec/comodo/unicode.mapping'. '.

I downloaded https://raw.githubusercontent.com/SpiderLabs/ModSecurity/v3/master/unicode.mapping to the comodo directory and set the owner/group and file permissions to match the others.

Kais · December 19, 2021, 11:23pm

Can I still use this tutorial to use commodo rules on Cyberpanel?

It seems COMMODO is banned from Admins backend?!?

die2mrw007 · December 20, 2021, 12:17pm

Comodo is removed because they are now subscription based model and not open.

Kais · December 20, 2021, 1:49pm

And how should I add COMODO if I pay for the subscription?
You have other tools in CyberPanel that needs payments (like Imunify360).
Think it´s not the very best good idea to delete former included services …

Additionally:

https://waf.comodo.com/

STILL SAYS THE COMODO RULEZ ARE FREE TO USE

Kais · December 20, 2021, 1:59pm

I just tried to register again for the FREE RULESSET of Comodo. And it worked as exspected!

I was able to register and I was able to download the needed NGIX gulez.

I got eMail with VALID serial key.

So question again: How can I add these rulez to my cyberpanel after you kicked it out of the menue?

Thanks for help

die2mrw007 · December 20, 2021, 2:53pm

It is free but it requires subscription. The inclusion of these rules was by just pulling it from their servers. Now that its restricted with subscription model, the direct download to cyberpanel installation (user side), doesn’t work. It needs to be mirrored somewhere with direct pull access which needs maintenance and the team currently is unable to maintain additional segment with the current limited developers behind cyberpanel project.

As cyberpanel is an open-source project, any developer who wish to contribute to the comodo ruleset, can be a part.

Kais · December 20, 2021, 4:21pm

Thanks for your answer. I took the subscription.

Is there a chanceoto insert it in the panel?

I cinfigured it via config files, but missing the options to acticate/deactivate single rules by cyberpanel gui

die2mrw007 · December 21, 2021, 3:22am

Not possible by simple method. But if you require, you can check the github branch of cyberpanel and see what files were changed in removing the comodo rules from cyberpanel… Redo those codes back in your cyberpanel setup and it will be back.

Kais · December 21, 2021, 8:48am

Ok, thank you for your adivice. It´s not possible for me to do this, because I will run in trouble each time I run updates. It´s a productive system for a customer running Cyberpanel Enterprise. So no chance to “experiment” lthis way

die2mrw007 · December 21, 2021, 9:08am

You can use OWASP rules. Why you going after comodo itself? ModSecurity Performance: Apache, nginx, and LiteSpeed ⋆ LiteSpeed Blog

The reason for deleting Comodo from cyberpanel project: ModSecurity rules outdated · Issue #653 · usmannasir/cyberpanel · GitHub

If you or any developer who can maintain this comodo branch can help contribute it.

[Tutorial] How To Manually Update Comodo ModSecurity Rules For CyberPanel

Unable to download OWASP ModSecurity Core Rules and COMODO ModSecurity 3.0 mod security rules section.

for comodo =https://cyberpanel.net/modsec/comodo.tar.gz for OWSAP =https://cyberpanel.net/modsec/owasp.tar.gz

The installation i did today only.

for comodo =https://cyberpanel.net/modsec/comodo.tar.gz
for OWSAP =https://cyberpanel.net/modsec/owasp.tar.gz