Modsecurity issue IIS 7.5

[rdnordst]

I am attempting to install and setup modsecurity 2.9.0 in an IIS environment. Install and setup is pretty straight forward. I have made sure that I have the 2013 visio studio runtimes for x64 installed. I installed modsecurity and added a secrule for testing. I then made the changes to the web.config and added the modsecurity=true configfile = "xx". Event ID 1 is in my event viewer with 5 entries. No other events no logs nothing. Any suggestions.

[straav]

So here is some stuff to do to verify what your problem is. Try running dependency walker on the ModSecurityIIS.dll and make sure you have all the libs.

If that comes through ok, the IIS module should be ok (check the IIS Manager to see if it listed as a active Module)

If both of those test ok, try a simplified default config (checking permissions, here I have used c:\temp for log scribbling, but not what I plan for production but gives a testing space where you can set permissions how every you want to do your testing):

SecRuleEngine On
SecDebugLog "c:\temp\debug.log"
SecDebugLogLevel 6
SecAuditLogType Serial

# Directory where the files will be stored
# MUST NOT BE THE SAME AS THE APACHE LOGS FOLDER
SecAuditLogStorageDir c:\temp

# The index of all files created
# YOU MUST NOT ALLOW NON-ROOT USERS TO WRITE
# TO THE BASE FOLDER
SecAuditLog c:\temp\index.log

# Choose what to log   everything (default is ABCFHZ)
SecAuditLogParts ABCDEFGHZ

SecAuditEngine On
SecDefaultAction "phase:1,deny,log,status:403"
SecRule ARGS "zzz" phase:1,log,deny,status:503,id:1

SecResponseBodyAccess On
SecStreamOutBodyInspection On
SecRequestBodyAccess On
SecStreamInBodyInspection On
SecContentInjection On

now the only blocking rule is
SecRule ARGS "zzz" phase:1,log,deny,status:503,id:1
so a test request on the host of
http://localhost/?a=zzz
Should give you a 503 error.

If so you should be ready to put a real rule set in place.

[rdnordst]

Thanks for the reply.
I checked everything, used your suggested settings and ran a test. I still have the same events showing up in the event viewer and there are no logs being generated. My server is 2008 IIS 7.5 tried 2 different version of mod security 2.8.0 and 2.9.0. Currently I have 2.8.0 installed and here are the event viewer logs. When 2.9.0 is installed its the exact same events but instead of Event ID 0 it will be Event ID 1.
It generates 5 events
The description for Event ID 0 from source ModSecurity cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
ModSecurity: LIBXML compiled version="2.9.1"
ModSecurity: LUA compiled version="Lua 5.1"
ModSecurity: PCRE compiled version="8.33 "; loaded version="8.33 2013-05-28"
ModSecurity: APR compiled version="1.4.8"; loaded version="1.4.8"
ModSecurity for IIS (STABLE)/2.8.0-RC1 (http://www.modsecurity.org/) configured.

[straav]

So no failed dependancies in dependency walker?

and set to the testing config above with
appcmd.exe set config /section:"system.webServer/ModSecurity" /"enabled:true" /"configFile:C:\PATHGOESHERE\modsecurity_iis.conf"

Sorry if I am being redundant, just wanting to make sure we have followed the same steps.

[rdnordst]

I ran Dependency Walker and ran into issues. The responses I saw indicated that it was a false positive. Basically its saying im missing the following dll's. I have 2008, 2010, 2012, and 2013 runtimes installed. Now I can waist time trying to track this down but most agreed its unnecessary. What do you think?
API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL
API-MS-WIN-CORE-WINRT-ERROR-L1-1-0.DLL
API-MS-WIN-CORE-WINRT-L1-1-0.DLL
API-MS-WIN-CORE-WINRT-ROBUFFER-L1-1-0.DLL
API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL
API-MS-WIN-SHCORE-SCALING-L1-1-1.DLL
DCOMP.DLL
IESHIMS.DLL
MFPLAT.DLL
WLANAPI.DLL

[dcoli]

Did you ever find a solution to this?

[straav]

We have been using the version installed with the current version of plesk for this. Of note when looking at plesk and how it has mod_sec installed, it has placed the 32 and the 64 bit version in. That has been working for us (though still not moved to our prod boxes).

[rdnordst]

I did not find a solution to this. I have put it on the back burner for awhile now. I plan on trying again someday soon and hope that something has changed. I was not able to get it to work on several servers all running the same os and same version of IIS. I even asked a coworker who set it up on a majority of linux servers and together we stood no chance. If you have any ideas on how to get it to work I’d love to hear it.

From: dcoli [mailto:notifications@github.com]
Sent: Wednesday, April 20, 2016 3:37 PM
To: SpiderLabs/ModSecurity ModSecurity@noreply.github.com
Cc: Nordstrom, Richard Nordstrom.Richard@epa.gov; Author author@noreply.github.com
Subject: Re: [SpiderLabs/ModSecurity] Modsecurity issue IIS 7.5 (#916)

Did you ever find a solution to this?

—
You are receiving this because you authored the thread.
Reply to this email directly or view it on GitHubhttps://github.com//issues/916#issuecomment-212572858

[dcoli]

I actually got it to work on a couple of machines for a while. The first
machine I installed VS 2015 insteac of 2013, but uninstalling ModSecurity
and then installing 2013 and reinstalling ModSecurity seemed to work. This
was okay until I realized there was a problem and uninstalled it. Now I
can't get it to work again. Am trying all the steps again, plus restarting
the machine after every step.

On the second machine I just installed vcredist_64 and 32 (sp?) and then
ModSecurity, which worked fine. But there was a problem in which some
content was being blocked for both whitelisted local and external users,
and only uninstalling ModSecurity fixed it. I haven't tried to reinstall on
that machine, since it was breaking core functionality, and its a shared
staging server.

On Apr 21, 2016 8:39 AM, "rdnordst" notifications@github.com wrote:

I did not find a solution to this. I have put it on the back burner for
awhile now. I plan on trying again someday soon and hope that something has
changed. I was not able to get it to work on several servers all running
the same os and same version of IIS. I even asked a coworker who set it up
on a majority of linux servers and together we stood no chance. If you have
any ideas on how to get it to work I’d love to hear it.

From: dcoli [mailto:notifications@github.com]
Sent: Wednesday, April 20, 2016 3:37 PM
To: SpiderLabs/ModSecurity ModSecurity@noreply.github.com
Cc: Nordstrom, Richard Nordstrom.Richard@epa.gov; Author <
author@noreply.github.com>
Subject: Re: [SpiderLabs/ModSecurity] Modsecurity issue IIS 7.5 (#916)

Did you ever find a solution to this?

—
You are receiving this because you authored the thread.
Reply to this email directly or view it on GitHub<
https://github.com/SpiderLabs/ModSecurity/issues/916#issuecomment-212572858>

—
You are receiving this because you commented.
Reply to this email directly or view it on GitHub
#916 (comment)

[rdnordst]

I am going to give your second machine install a try. Maybe I can get it to finally start and see if I can push through the issues. If I find anything I’ll be sure to let you know. But I probably wont start the install until next week or so.

From: dcoli [mailto:notifications@github.com]
Sent: Thursday, April 21, 2016 9:46 AM
To: SpiderLabs/ModSecurity ModSecurity@noreply.github.com
Cc: Nordstrom, Richard Nordstrom.Richard@epa.gov; Author author@noreply.github.com
Subject: Re: [SpiderLabs/ModSecurity] Modsecurity issue IIS 7.5 (#916)

I actually got it to work on a couple of machines for a while. The first
machine I installed VS 2015 insteac of 2013, but uninstalling ModSecurity
and then installing 2013 and reinstalling ModSecurity seemed to work. This
was okay until I realized there was a problem and uninstalled it. Now I
can't get it to work again. Am trying all the steps again, plus restarting
the machine after every step.

On the second machine I just installed vcredist_64 and 32 (sp?) and then
ModSecurity, which worked fine. But there was a problem in which some
content was being blocked for both whitelisted local and external users,
and only uninstalling ModSecurity fixed it. I haven't tried to reinstall on
that machine, since it was breaking core functionality, and its a shared
staging server.

On Apr 21, 2016 8:39 AM, "rdnordst" <notifications@github.commailto:notifications@github.com> wrote:

I did not find a solution to this. I have put it on the back burner for
awhile now. I plan on trying again someday soon and hope that something has
changed. I was not able to get it to work on several servers all running
the same os and same version of IIS. I even asked a coworker who set it up
on a majority of linux servers and together we stood no chance. If you have
any ideas on how to get it to work I’d love to hear it.

From: dcoli [mailto:notifications@github.com]
Sent: Wednesday, April 20, 2016 3:37 PM
To: SpiderLabs/ModSecurity <ModSecurity@noreply.github.commailto:ModSecurity@noreply.github.com>
Cc: Nordstrom, Richard <Nordstrom.Richard@epa.govmailto:Nordstrom.Richard@epa.gov>; Author <
author@noreply.github.commailto:author@noreply.github.com>
Subject: Re: [SpiderLabs/ModSecurity] Modsecurity issue IIS 7.5 (#916)

Did you ever find a solution to this?

—
You are receiving this because you authored the thread.
Reply to this email directly or view it on GitHub<
https://github.com/SpiderLabs/ModSecurity/issues/916#issuecomment-212572858>

—
You are receiving this because you commented.
Reply to this email directly or view it on GitHub
#916 (comment)

—
You are receiving this because you authored the thread.
Reply to this email directly or view it on GitHubhttps://github.com//issues/916#issuecomment-212925995

[dcoli]

I just got it working on my first machine. The only thing I could tell that
was different this time was that first installed 2.7, which doesn't at all
autoconfigure your config files (doesn't even produce them). I decided not
to go that route. So I shut down w3 services and uninstalled using msiexec
on the command line. When I went to install 2.9 again it said it couldn't
proceed because of the presence of 5 or 6 dll's from an earlier version. I
renamed those and then successfully installed 2.9 from the command line. I
entered the a test rule and it worked.

However, I'm seeing the occasional problem with webpages which were working
previously, even with DetectionOnly mode set. I think in one of my login
pages the POST body is being stripped.

On Thu, Apr 21, 2016 at 10:38 AM, rdnordst notifications@github.com wrote:

I am going to give your second machine install a try. Maybe I can get it
to finally start and see if I can push through the issues. If I find
anything I’ll be sure to let you know. But I probably wont start the
install until next week or so.

From: dcoli [mailto:notifications@github.com]
Sent: Thursday, April 21, 2016 9:46 AM
To: SpiderLabs/ModSecurity ModSecurity@noreply.github.com
Cc: Nordstrom, Richard Nordstrom.Richard@epa.gov; Author <
author@noreply.github.com>
Subject: Re: [SpiderLabs/ModSecurity] Modsecurity issue IIS 7.5 (#916)

I actually got it to work on a couple of machines for a while. The first
machine I installed VS 2015 insteac of 2013, but uninstalling ModSecurity
and then installing 2013 and reinstalling ModSecurity seemed to work. This
was okay until I realized there was a problem and uninstalled it. Now I
can't get it to work again. Am trying all the steps again, plus restarting
the machine after every step.

On the second machine I just installed vcredist_64 and 32 (sp?) and then
ModSecurity, which worked fine. But there was a problem in which some
content was being blocked for both whitelisted local and external users,
and only uninstalling ModSecurity fixed it. I haven't tried to reinstall
on
that machine, since it was breaking core functionality, and its a shared
staging server.

On Apr 21, 2016 8:39 AM, "rdnordst" <notifications@github.com<mailto:
notifications@github.com>> wrote:

I did not find a solution to this. I have put it on the back burner for
awhile now. I plan on trying again someday soon and hope that something
has
changed. I was not able to get it to work on several servers all running
the same os and same version of IIS. I even asked a coworker who set it
up
on a majority of linux servers and together we stood no chance. If you
have
any ideas on how to get it to work I’d love to hear it.

From: dcoli [mailto:notifications@github.com]
Sent: Wednesday, April 20, 2016 3:37 PM
To: SpiderLabs/ModSecurity <ModSecurity@noreply.github.com<mailto:
ModSecurity@noreply.github.com>>
Cc: Nordstrom, Richard <Nordstrom.Richard@epa.gov<mailto:
Nordstrom.Richard@epa.gov>>; Author <
author@noreply.github.commailto:author@noreply.github.com>
Subject: Re: [SpiderLabs/ModSecurity] Modsecurity issue IIS 7.5 (#916)

Did you ever find a solution to this?

—
You are receiving this because you authored the thread.
Reply to this email directly or view it on GitHub<

https://github.com/SpiderLabs/ModSecurity/issues/916#issuecomment-212572858>

—
You are receiving this because you commented.
Reply to this email directly or view it on GitHub
<
https://github.com/SpiderLabs/ModSecurity/issues/916#issuecomment-212900124>

—
You are receiving this because you authored the thread.
Reply to this email directly or view it on GitHub<
https://github.com/SpiderLabs/ModSecurity/issues/916#issuecomment-212925995>

—
You are receiving this because you commented.
Reply to this email directly or view it on GitHub
#916 (comment)

[dcoli]

Yes, it is definitely blocking POST fields in DetectionOnly mode. I tried turning off SecRequestBodyAccess and my login form began working.

[dcoli]

Need to add this to get posts to work: SecStreamInBodyInspection On

[zimmerle]

Hi Guys, I am closing that issue as I am seeing that you already had progress on that.