Atomicorp

We have SSH running on two ports. Port 22 which is only open to specific IPs, and another port which is open but with restricted features available. Is there any support in ASL for multiple SSH ports? I see rules like HIDS 5706 and 5701 which presumably work on a single port. If you change the SSH p...

Trying this on a fresh but identical server type, the yum repo was setup by asl, and the Atomic kernel was installed and booted with no problems. Either the hosting provider fixed something in the newer images, or more likely I had tweaked something that broke this. Atomic support has graciously tri...

Checking the repos against a backup showed the repos were fresh in spite of the time stamps, so I manually added tortix-kernel-xen to tortix.repo and installed Atomic kernel 3.2.69-81.xen.art.x86_64. System did not come up :-/ This is on a Rackspace server which as far as I have read is tested and k...

Since tortix-kernel-xen is not in my Atomic repos, I'm thinking maybe my old tortix/asl repos were not updated by the install, and that is why it's missing? My tortix.repo for instance is dated 1/17/2014. I also have asl.repo, atomic.repo and tortix.common.repo, and only asl.repo has a current date ...

I get the following error trying to install the ASL kernel for my xen system: Error getting repository data for tortix-kernel-xen, repository not found I get this whether I try to install the ASL xen kernel through the ASL install, or via yum with: yum --disableexcludes=all --enablerepo=tortix-kerne...

Great! I'd like to try the trial on our test server first to make sure everything works. I think I'll need to open another account to put the trial on the test server since we already have a rules only subscription, but let me know if there is a better way to do this.

Thanks!

Kirk

Does ASL have the capability to block an IP at the firewall level when that IP exceeds a mod_security state limit such as this?: /var/log/httpd/error_log:[Sun Nov 08 21:50:19 2015] [warn] ModSecurity: Access denied with code 400. Too many threads [255] of 100 allowed in WRITE state from 177.141.142....

Is there any way for rules only users to install the asl-4.0 yum repo in order to get the atomic release of mod_evasive? I could use the atomic rpm, or I could use the epel repo, but assuming it is advisable to use the atomic release outside of ASL, it would be nice to have access to the repo. Thank...

Thanks, that makes sense, although I do hope aum has the capability to update clam some day, subject of course to the users setup. I notice the rules only clam signatures license states: The Real Time Atomic CLAMAV Signatures are licensed by the server. For each license you can also run the rules on...

Thanks Michael. I'm glad to see there is an option to upgrade from a rules account to ASL. Not only do I see more and more what ASL can do by looking at the rule sets, but when I find I am reading things backwards, I have to wonder if it's wise to configure my security solutions by hand! I will defi...

Thanks! I knew I was missing something. Since I'm used to updating rule sets manually, I didn't realize this should be done through the config. Going over the rest of the rule sets, I have a few more questions. 00_asl_z_antievasion.conf Since our newer mod sec version does not support this rule set ...

I'm new to AUM and used to managing rule sets manually. First question I have that I can't find the answer to, the default 00_mod_security.conf installed by AUM loads all rule sets including for instance 99_asl_a_redactor.conf, which according to the description in the WAF rule families wiki should ...

I guess my confusion from the start was in thinking ANY of the includes were meant to go outside of the IfModule section. If it takes a little effort to sort this out, it is still nothing compared to the effort it would take to get other mod security rule sets working without issue. Even with all th...

Thanks I got it now. The first time I read your replies I missed something and sent a further inquiry which hasn't shown up, maybe the moderator can delete it? Now I see that both your replies are crystal clear. Just needed another cup of tea before my brain was fully working

Thanks,

Kirk

Thanks mikeshinn. But is what faris says true? <IfModule mod_security2.c> # This is the ModSecurity Core Rules Set. # Basic configuration goes in here Include modsecurity.d/modsecurity_crs_10_config.conf # Rule management is handled by ASL Include modsecurity.d/*asl*.conf </IfModule> If the line 'In...