Portal Home > Knowledgebase > Articles Database > Litespeed and Modsecurity
Litespeed and Modsecurity
| Posted by SAHostKing, 01-21-2013, 04:42 PM |
| Hi fellas,
Ive recently installed litespeed and enabled modsecurity. I'm currently testing with the delayed atomic rules which is free but I seem to get the error when using them:
mod_security: Access denied with code 406, [Rule: '' ''] [severity "WARNING"] [MatchedString ""]
All websites go down.
If I remove it then all works again. If I change from litespeed to apache and try it again with the rules all works fine.
Very strange. any ideas?
|
| Posted by TravisT-[SSS], 01-21-2013, 04:46 PM |
| What version of mod_sec and LiteSpeed?
LiteSpeed is not fully compatible with mod_Sec rules.
|
| Posted by SAHostKing, 01-23-2013, 07:16 AM |
| Sorry for the late reply.
It's ModSecurity for Apache/2.7.0
Litespeed - 4.2.1
|
| Posted by ovais, 01-23-2013, 08:29 AM |
| We could never get Litespeed working with Atomic and other rules. I just tried both 2.5 and 2.7 rules and getting exactly same error on all of websites.
|
| Posted by Dathorn-Andrew, 01-23-2013, 02:10 PM |
| As noted above LiteSpeed does not offer a truly compatible mod_security equivalent. The Atomic rules as-is will simply not work with LiteSpeed. I would agree that this is unfortunate. Many have been complaining about this for some time. Although their mod_security compatibility has gotten better, it is not quite there (yet?).
|
| Posted by ovais, 01-24-2013, 12:36 AM |
| And we are paying a premium cost for a product which doesn't seems to be doing what it is advertised for.
|
| Posted by Bodybuilder, 01-24-2013, 01:31 AM |
| LiteSpeed Technologies, Inc is almost dead already last time they released an update was August 02, 2011 and their Anti-DDoS Proxy Service has been delayed over 1 year.
|
| Posted by TravisT-[SSS], 01-24-2013, 01:40 AM |
| They never update their front page. Don't ask me why. A lot of their website is outdated but they are still actively releasing updates.
|
| Posted by Bodybuilder, 01-24-2013, 02:15 AM |
| At least that's good
|
| Posted by Ari Sultani, 01-24-2013, 02:17 AM |
| It is a little difficult to answer this issue, The error was not clear, nothing about the Rule or MatchedString.
Could you give us full error if you had?
|
| Posted by vB-WP-Admin, 01-24-2013, 06:40 AM |
| For updates you need to look at their forum, the latest version was released on the 9th of December, http://www.litespeedtech.com/support...ad.php?p=35013
|
| Posted by SAHostKing, 01-25-2013, 06:07 AM |
| That is the full error. This is what shows up in logs exactly. I usually when on apache get a Rule match like 367859 etc. Here I get a blank one.
Strange one.
|
| Posted by SAHostKing, 04-03-2013, 07:03 AM |
| The new versions seems to work well with Mod Security. Just thought I'd mention it.
|
| Posted by Infinitnet, 04-03-2013, 07:42 AM |
| Never had any issues with LiteSpeed and the ASL rules, except in 2010, but right now LiteSpeed can handle most mod_security rules very well. I've attached a (with LiteSpeed) working ASL ruleset to this post.
Attached Files
10_asl_rules.conf.tar.gz
(77.3 KB, 32 views)
|
| Posted by Jesse Mahoney, 04-03-2013, 05:26 PM |
| I would beg to differ I'm afraid. We have been successfully running LiteSpeed with the Atomic rulesets for over a year now. Whilst we may get a few more false positives under LS compared to Apache, it works great.
This has been under LiteSpeed 4.1.x and 4.2x, and Mod_Security 2.5.x and 2.7.x releases.
Indeed, their latest 4.2.2 release has been quite good as well, having addressed a few pesky bugs. It's most certainly still under active development, not just for bugs and security fixes either
|
Add to Favourites 
Print this Article
Also Read
