modsecurity 3.0.4 - Apache-Error with rules

[rudy500]

recusive error in Apache 2.4.41, PHP 7.4.16 fpm modsecurity 3.0.4-1bulid1, modsecurity CRS 3.2.0-1 and Ubuntu 20.04.2

don't see id code of rule and repeat this error everytime:

Apache-Error: [file "apache2_util.c"] [line 273] [level 3] [client XXX.XXX.XXX.XXX] ModSecurity: Rule 7fcb5152c980 [id "-"][file "/usr/share/modsecurity-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"][line "89"] - Execution error - PCRE limits exceeded (-8): (null). [hostname "xxxx.xxxx.xx"] [uri "/xxxx/xxxx/xxxx.php"] [unique_id "YFocJk5fc7dTaCi90TeixQAAAA8"]

Message: Rule 7fcb5152c980 [id "-"][file "/usr/share/modsecurity-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"][line "89"] - Execution error - PCRE limits exceeded (-8): (null).
Message: Rule 7fcb51507e40 [id "-"][file "/usr/share/modsecurity-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"][line "240"] - Execution error - PCRE limits exceeded (-8): (null).
Message: Rule 7fcb514f8948 [id "-"][file "/usr/share/modsecurity-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"][line "266"] - Execution error - PCRE limits exceeded (-8): (null).
Message: Rule 7fcb514f2c28 [id "-"][file "/usr/share/modsecurity-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"][line "317"] - Execution error - PCRE limits exceeded (-8): (null).
Message: Rule 7fcb514e51f8 [id "-"][file "/usr/share/modsecurity-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"][line "342"] - Execution error - PCRE limits exceeded (-8): (null).
Message: Rule 7fcb514df840 [id "-"][file "/usr/share/modsecurity-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"][line "367"] - Execution error - PCRE limits exceeded (-8): (null).
Message: Rule 7fcb514d6e68 [id "-"][file "/usr/share/modsecurity-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"][line "392"] - Execution error - PCRE limits exceeded (-8): (null).
Message: Rule 7fcb514d1a80 [id "-"][file "/usr/share/modsecurity-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"][line "417"] - Execution error - PCRE limits exceeded (-8): (null).
Message: Rule 7fcb514c6950 [id "-"][file "/usr/share/modsecurity-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"][line "442"] - Execution error - PCRE limits exceeded (-8): (null).

modsecurity.conf
SecPcreMatchLimit 150000
SecPcreMatchLimitRecursion 150000

---

php.ini (fpm):

pcre.backtrack_limit = 1000000
pcre.recursion_limit = 100000

---

ulimit -a:

core file size (blocks, -c) 0
data seg size (kbytes, -d) unlimited
scheduling priority (-e) 0
file size (blocks, -f) unlimited
pending signals (-i) 63703
max locked memory (kbytes, -l) 65536
max memory size (kbytes, -m) unlimited
open files (-n) 1024
pipe size (512 bytes, -p) 8
POSIX message queues (bytes, -q) 819200
real-time priority (-r) 0
stack size (kbytes, -s) 8192
cpu time (seconds, -t) unlimited
max user processes (-u) 63703
virtual memory (kbytes, -v) unlimited
file locks (-x) unlimited

[martinhsv]

Hi @rudy500 ,

If you are using ModSecurity v3 with Apache HTTP Server, please be aware that that is not recommended. For Apache HTTP Server, ModSecurity v2.9.3 is recommended.

As a general statement for ModSecurity, you have correctly identified useful configuration items to adjust. Your values are not particularly high and you could try adjusting them much higher (I would try at least 500000 or 1000000 -- and perhaps much higher again) for the three that you currently have set lower than that.

Finally, some CRS rules can by their nature be very taxing on the regex engine -- especially for certain types of responses. You may wish to spend some minutes identifying what sort of responses are triggering these errors, and then possibly exclude those rules from being executed in those cases.

[rudy500]

Hi @martinhsv,

Review your comments and apply changes but we have this comments:

---

Review versión of modsecurity library for Apache

rys@moodleweb:/var/log/apache2$ sudo dpkg -l libapache2-mod-security2
||/ Name Version Architecture Description
+++-========================-============-============-============================================
ii libapache2-mod-security2 2.9.3-1 amd64 Tighten web applications security for Apache

---

Apply Changes on modsecurity.conf

modsecurity.conf
SecPcreMatchLimit 1000000
SecPcreMatchLimitRecursion 1000000

---

We apply the changes that you indicated, in the same way some errors of pcre appear ...

1. Will it be necessary to increase these values again in the modsecurity.conf file?
2. Should we apply changes at the php-fpm level also matching these values?

[zimmerle]

@rudy500

The pcre limit values are set globally. Every other mod_ could be changing this value in run-time. It is common having php overwriting those values. If you happens to have the mod_php (or equivalent) loaded, double check the values you have for: pcre.backtrack_limit, pcre.recursion_limit.

You can find further instructions here -
https://www.php.net/manual/en/pcre.configuration.php