1 <IfModule mod_security.c>
2
3 # Only inspect dynamic requests
4 # (YOU MUST TEST TO MAKE SURE IT WORKS AS EXPECTED)
5 #SecFilterEngine DynamicOnly
6
7 SecFilterEngine On
8
9 # Reject requests with status 500
10 SecFilterDefaultAction "deny,log,status:500"
11
12 # Some sane defaults
13 SecFilterScanPOST On
14 SecFilterCheckURLEncoding On
15 SecFilterCheckCookieFormat On
16 SecFilterCheckUnicodeEncoding Off
17 SecFilterNormalizeCookies On
18 # enable version 1 (RFC 2965) cookies
19 SecFilterCookieFormat 1
20
21 SecServerResponseToken Off
22
23 #If you want to scan the output, uncomment these
24 #SecFilterScanOutput On
25 #SecFilterOutputMimeTypes "(null) text/html text/plain"
26
27 # Accept almost all byte values
28 SecFilterForceByteRange 1 255
29
30 # Server masking is optional
31 #fake server banner - NOYB used - no one needs to know what we are using
32 SecServerSignature "KiOrKY 's Httpd"
33
34 #SecUploadDir /tmp
35 #SecUploadKeepFiles Off
36
37 # Only record the interesting stuff
38 SecAuditEngine RelevantOnly
39 SecAuditLog etc/apache22/logs/audit_log
40
41 # You normally won't need debug logging
42 SecFilterDebugLevel 0
43 SecFilterDebugLog etc/apache22/logs/modsec_debug_log