shutting down

[ghost]

did mod_security shut down my ssl certificate?

[Fri Oct 21 10:45:01.587882 2016] [:error] [pid 9530] [client 127.0.0.1] ModSecurity: Warning. Operator LT matched 5 at TX:inbound_anomaly_score. [file
"/usr/share/modsecurity-crs/base_rules/modsecurity_crs_60_correlation.conf"] [line "33"] [id "981203"] [msg "Inbound Anomaly Score (Total Inbound Score: 3, SQLi=0, XSS=0): Request from Known SPAM Source (Previous RBL Match)"]
[hostname "localhost"] [uri "/index.html"] [unique_id "WAnxrZ-LKMoAACU6QAoAAAAA"] [Fri Oct 21 10:45:03.507210 2016] [mpm_prefork:notice] [pid 9505] AH00169: caught SIGTERM, shutting down AH00016: Configuration Failed AH00016:
Configuration Failed

[dune73]

Brodie,

These are two log lines combined into one.

This is the correct version:

[Fri Oct 21 10:45:01.587882 2016] [:error] [pid 9530] [client 127.0.0.1]
ModSecurity: Warning. Operator LT matched 5 at TX:inbound_anomaly_score.
[file
"/usr/share/modsecurity-crs/base_rules/modsecurity_crs_60_correlation.conf"]
[line "33"] [id "981203"] [msg "Inbound Anomaly Score (Total Inbound
Score: 3, SQLi=0, XSS=0): Request from Known SPAM Source (Previous RBL
Match)"] [hostname "localhost"] [uri "/index.html"] [unique_id
"WAnxrZ-LKMoAACU6QAoAAAAA"]

[Fri Oct 21 10:45:03.507210 2016] [mpm_prefork:notice] [pid 9505]
AH00169: caught SIGTERM, shutting down AH00016: Configuration Failed
AH00016: Configuration Failed

As you can see, the timestamp is vastly different and the
rule 981203 runs very late in the lifecycle of a request.

Rest assured, it was not modsec.

Ahoj,

Christian

On Fri, Oct 21, 2016 at 05:52:10AM -0700, brodie wrote:

did mod_security shut down my ssl certificate?

You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
#622