SecGuardianLog |/path/to/httpd-guardian+
Description: Configures the user's registered Honeypot Project + HTTP BL API Key to use with @rbl. +
Syntax: SecHttpBlKey [12 char access key]
+
Example Usage: SecHttpBlKey whdkfieyhtnf
+
Scope: Main +
Version: 2.7.0 +
If the @rbl operator uses the dnsbl.httpbl.org RBL (http://www.projecthoneypot.org/httpbl_api.php) you +must provide an API key. This key is registered to individual users and + is included within the RBL DNS requests. +
Description: Configures how to respond when rule processing @@ -2158,8 +2179,8 @@ class="mw-headline"> SecRuleEngine
Removes common comments chars (/*, */, --, #). +
+Removes each occurrence of comment (/* ... */, --, #). Multiple +consecutive occurrences of which will not be compressed. +
Replaces NUL bytes in input with space characters (ASCII 0x20). @@ -3928,7 +3958,13 @@ does the opposite of blocking. There can only be one disruptive action per rule (if there are multiple disruptive actions present, or inherited, only the last one will take effect), or rule chain (in a chain, a disruptive action can only appear in the first rule). -
SecRule REMOTE_ADDR "@rbl sbl-xbl.spamhaus.org" "phase:1,t:none,pass,nolog,auditlog,msg:'RBL Match for SPAM Source',tag:'AUTOMATION/MALICIOUS',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.automation_score=+%{tx.warning_anomaly_score},setvar:tx.anomaly_score=+%{tx.warning_anomaly_score}, \
setvar:tx.%{rule.id}-AUTOMATION/MALICIOUS-%{matched_var_name}=%{matched_var},setvar:ip.spammer=1,expirevar:ip.spammer=86400,setvar:ip.previous_rbl_check=1,expirevar:ip.previous_rbl_check=86400,skipAfter:END_RBL_CHECK"
+Description: Performs regular expression data substitution when applied to either the STREAM_INPUT_BODY or STREAM_OUTPUT_BODY @@ -5427,9 +5471,9 @@ MULTIPART_STRICT_ERROR, RULE, SESSION, USERID, among others.
At this time it is only possible to have three collections in which +
At this time it is only possible to havefive collections in which data is stored persistantly (i.e. data available to multiple requests). -These are: IP, SESSION and USER. +These are: GLOBAL, RESOURCE, IP, SESSION and USER.
Every collection contains several built-in variables that are available and are read-only unless otherwise specified:
@@ -5452,9 +5496,12 @@ since creation.To create a collection to hold session variables (SESSION) use action setsid. To create a collection to hold user variables (USER) use action - setuid. To create a collection to hold client address variables (IP) -use action initcol. + setuid. To create a collection to hold client address variables (IP), +global data or resource-specific data, use action initcol.
+