FM / imh-modsec

/etc/apache2/conf.d/imh-modsec

Name	Size	Mode	Actions
html/	-	0755	rm
01_base_rules.conf	19822	0644	edit dl rm
05_additional_directives.conf	6950	0644	edit dl rm
15_bad_requests.conf	2300	0644	edit dl rm
19_bad_bots.conf	5363	0644	edit dl rm
20_known_hacks.conf	4886	0644	edit dl rm
21_spam_scripts.conf	1599	0644	edit dl rm
31_shellshock.conf	806	0644	edit dl rm
40_wordpress.conf	9511	0644	edit dl rm
40_xmlrpc.conf	2374	0644	edit dl rm
47_premium_web_builder.conf	83	0644	edit dl rm
alibaba_cidrtrack.lua	12769	0644	edit dl rm
alibaba_network.txt	1789	0644	edit dl rm
bot_budget_bots.txt	113	0644	edit dl rm
bot_ratelimit.lua	2921	0644	edit dl rm
imh-renumber.csv	2460	0644	edit dl rm

Edit: /etc/apache2/conf.d/imh-modsec/15_bad_requests.conf (2300B)

# both.conf
# Contains rules which are designed to block disruptive behavior such as stress
# testing and security scans

# Block benchmark functions in the url
SecRule ARGS "benchmark\([0-9]{5,1000}\," \
    "deny,log,auditlog,status:406,t:none,t:lowercase,t:htmlEntityDecode,\
    t:removeWhitespace,msg:'Benchmark function call in request args',id:'13425',\
    tag:'WEB_ATTACK/SQL INJECTION',severity:'4'"

# Block attempts to abuse download plugins for php files in parent directories
SecRule ARGS_GET "(?:\/|)\.{2}\/.+\.php" \
    "log,deny,status:406,auditlog,id:14205,rev:1,severity:2,\
    msg:'Attempting to access php files from parent dir'"

# Rate limit cPanel/webmail/webdisk/cpcontacts/cpcalendars subdomains: 10 requests per minute per IP
# Matches hostnames like cpanel.example.com, webmail.example.com, webdisk.example.com
# Excludes authenticated sessions (URIs containing /cpsessNNNN/)
# Tracks globally per-IP (not per-hostname)

# Initialize the IP collection for rate limiting
SecAction "id:13094,phase:1,pass,nolog,initcol:ip=%{remote_addr}"

# Skip rate limit counting for authenticated sessions and static assets
SecRule REQUEST_URI "@rx /(cpsess[0-9]+|cPanel_magic_revision_[0-9]+|.well-known)/" \
    "id:13095,phase:2,pass,nolog,skipAfter:END_CPANEL_RATELIMIT"

# Increment counter for cpanel/webmail/webdisk/cpcontacts/cpcalendars subdomains
SecRule REQUEST_HEADERS:Host "@rx ^(cpanel|webmail|webdisk|cpcontacts|cpcalendars)\." \
    "id:13096,phase:2,pass,nolog,\
    setvar:ip.ratelimit_cpanel=+1,\
    expirevar:ip.ratelimit_cpanel=60"

# Deny if over limit
SecRule IP:RATELIMIT_CPANEL "@gt 10" \
    "id:13097,phase:2,deny,status:429,chain,\
    setenv:RATELIMITED_CPANEL,\
    log,msg:'RATELIMITED CPANEL/WEBMAIL/WEBDISK %{remote_addr}'"
    SecRule REQUEST_HEADERS:Host "@rx ^(cpanel|webmail|webdisk|cpcontacts|cpcalendars)\."

SecMarker "END_CPANEL_RATELIMIT"

ErrorDocument 429 "Too Many Requests"

# Block attempts to access httpoxy exploit
SecRule &REQUEST_HEADERS:Proxy "@gt 0" \
    "id:1000005,log,deny,status:406,msg:'httpoxy denied'"

# all.conf # Block access to sensitive dotfiles (.env, .git) SecRule REQUEST_URI "\/\.(?:env|git)" \ "phase:1,log,deny,status:406,auditlog,id:14206,rev:1,severity:2,\ msg:'Blocking access to sensitive dotfiles'" # both.conf # Contains rules which are designed to block disruptive behavior such as stress # testing and security scans # Block benchmark functions in the url SecRule ARGS "benchmark\([0-9]{5,1000}\," \ "deny,log,auditlog,status:406,t:none,t:lowercase,t:htmlEntityDecode,\ t:removeWhitespace,msg:'Benchmark function call in request args',id:'13425',\ tag:'WEB_ATTACK/SQL INJECTION',severity:'4'" # Block attempts to abuse download plugins for php files in parent directories SecRule ARGS_GET "(?:\/|)\.{2}\/.+\.php" \ "log,deny,status:406,auditlog,id:14205,rev:1,severity:2,\ msg:'Attempting to access php files from parent dir'" # Rate limit cPanel/webmail/webdisk/cpcontacts/cpcalendars subdomains: 10 requests per minute per IP # Matches hostnames like cpanel.example.com, webmail.example.com, webdisk.example.com # Excludes authenticated sessions (URIs containing /cpsessNNNN/) # Tracks globally per-IP (not per-hostname) # Initialize the IP collection for rate limiting SecAction "id:13094,phase:1,pass,nolog,initcol:ip=%{remote_addr}" # Skip rate limit counting for authenticated sessions and static assets SecRule REQUEST_URI "@rx /(cpsess[0-9]+|cPanel_magic_revision_[0-9]+|.well-known)/" \ "id:13095,phase:2,pass,nolog,skipAfter:END_CPANEL_RATELIMIT" # Increment counter for cpanel/webmail/webdisk/cpcontacts/cpcalendars subdomains SecRule REQUEST_HEADERS:Host "@rx ^(cpanel|webmail|webdisk|cpcontacts|cpcalendars)\." \ "id:13096,phase:2,pass,nolog,\ setvar:ip.ratelimit_cpanel=+1,\ expirevar:ip.ratelimit_cpanel=60" # Deny if over limit SecRule IP:RATELIMIT_CPANEL "@gt 10" \ "id:13097,phase:2,deny,status:429,chain,\ setenv:RATELIMITED_CPANEL,\ log,msg:'RATELIMITED CPANEL/WEBMAIL/WEBDISK %{remote_addr}'" SecRule REQUEST_HEADERS:Host "@rx ^(cpanel|webmail|webdisk|cpcontacts|cpcalendars)\." SecMarker "END_CPANEL_RATELIMIT" ErrorDocument 429 "Too Many Requests" # Block attempts to access httpoxy exploit SecRule &REQUEST_HEADERS:Proxy "@gt 0" \ "id:1000005,log,deny,status:406,msg:'httpoxy denied'"