Hi<br><br>I have three questions,<br><br>Firstly something I had trouble with was skipping certain rules for certain files on certain vhosts. Basically what im saying is on a box running multiple vhosts a specific vhost say
<a href="http://www.example.com">www.example.com</a> was triggering an XSS rule ( id of 40002 ) with its page /styles.php. now a simple:<br><br></LocationMatch /styles.php> <br>SecFilterRemove 40002 <br></LocationMatch>
<br><br>would exclude it from that rule, but it would also exclude all other occurrences of /style.php on all other vhosts, which is not good. The only solution I found to that was, In the vhost file for <a href="http://www.example.com">
www.example.com</a> I inserted the above <LocationMatch> exclusion and it seemed to work. To test I copied the styles.php to another vhost on the same server and it triggered the rule, while the <a href="http://www.example.com">
www.example.com</a> was skipping the rule. Is this the correct way to solve this problem or am i missing something?<br><br>My second question <br><br>The exclude.conf rule set if this gets loaded into your "global rule set" it has a lot of common file names which are excluded rules for example, a Joomla rule for /index.php skips a couple of checks. This would mean for all occurrence's of
index.php on all vhosts index.php will never have those rules run against it? The only solution i see is to apply each exclusion on a per vhost basis if my above method does in fact work. ( I think it does )<br><br>Lastly my third question,
<br><br>If im using all the gotroot rule sets am I duplicating rules by using the rule sets from <a href="http://modsecurity.org">modsecurity.org</a> ?<br>Or should I run both?<br><br>Thanks for the all the work these rules make a huge difference.
<br><br>Regards<br>J-P Human<br>