Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update modsecurity.yaml to expect 'client:' OR 'remote:' in APACHEERRORPREFIX2: #1038

Open
Staene opened this issue May 7, 2024 · 0 comments

Comments

@Staene
Copy link

Staene commented May 7, 2024

Describe the bug
In updating from AlmaLinux 9.3 to 9.4, Apache and a number of its modules were also updated. The Apache log format slightly changed, breaking both Fail2Ban and CrowdSec's modsecurity parsing. In my setup, the first iteration of [client: ...] in the logs was changed to [remote: ...]. Fail2Ban implemented a fix for this 3 months ago and I suggest that CrowdSec's modsecurity.yaml be edited to allow what is currently the first reference of [client: ...] to be either [client: ...] or [remote: ...] in APACHEERRORPREFIX2:

To Reproduce
Update Apache httpd to 2.4.57-8 as part of upgrading AlmaLinux 9.3 to AlmaLinux 9.4.

Expected behavior
I expected the Apache log format to stay consistent and for CrowdSec's modsecurity parser to continue to parse Apache error logs successfully.

Additional context
Editing the APACHEERRORPREFIX2: line in modsecurity.yaml, changing the first reference of [client: ...] to [remote: ...] fixed my problem.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant