diff --git a/doc/Reference_Manual.html b/doc/Reference_Manual.html index e2cecfc1..51522634 100644 --- a/doc/Reference_Manual.html +++ b/doc/Reference_Manual.html @@ -20,15 +20,15 @@ href="http://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Special Atom Feed" href="http://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Special:RecentChanges&feed=atom"> SourceForge.net: Reference Manual - mod-security - - - - - @@ -55,7 +55,7 @@ type="text/css"> var wgUserLanguage = "en"; var wgContentLanguage = "en"; var wgBreakFrames = false; - var wgCurRevisionId = 373; + var wgCurRevisionId = 374; var wgVersion = "1.15.1"; var wgEnableAPI = true; var wgEnableWriteAPI = true; @@ -65,10 +65,10 @@ type="text/css"> var wgRestrictionMove = []; /*]]>*/ - + - - + +

Licensing

-

ModSecurity is available under two licenses. Users can choose to use -the software under the terms of the GNU General Public License version 2 - (licence text is included with the distribution), as an Open Source / -Free Software product. A range of commercial licenses is also available, - together with a range of commercial support contracts. For more -information on commercial licensing please contact Trustwave. +

ModSecurity is available under the Apache Software License v2 [1]

Note 
ModSecurity, mod_security, ModSecurity Pro, and ModSecurity Core Rules are trademarks or registered trademarks of @@ -1656,7 +1654,7 @@ used for geolocation lookups.

ModSecurity relies on the free geolocation databases (GeoLite City and GeoLite Country) that can be obtained from MaxMind [1]. +title="http://www.maxmind.com" rel="nofollow">[2].

SecGsbLookupDb

@@ -1671,7 +1669,7 @@ used for Google Safe Browsing (GSB) lookups. can be obtained from the Google GSB API [2]. +rel="nofollow">[3].

Note 
After registering and obtaining a Safe Browsing API key, you can automatically download the GSB using a tool @@ -1702,13 +1700,13 @@ httpd-guardian, which is part of the Apache httpd tools project [3]. The httpd-guardian tool is designed to defend + rel="nofollow">[4]. The httpd-guardian tool is designed to defend against denial of service attacks. It uses the blacklist tool (from the same project) to interact with an iptables-based (on a Linux system) or pf-based (on a BSD system) firewall, dynamically blacklisting the offending IP addresses. It can also interact with SnortSam [4]. Assuming +title="http://www.snortsam.net" rel="nofollow">[5]. Assuming httpd-guardian is already configured (look into the source code for the detailed instructions), you only need to add one line to your Apache configuration to deploy it: @@ -2106,7 +2104,7 @@ For more information, please go to the Apache documentation, under Configuration Sections [5]. This directive does not affect how configuration +rel="nofollow">[6]. This directive does not affect how configuration options are inherited.

In order to select the phase a rule executes during, use the phase action either directly in the rule or in using the @@ -3492,7 +3490,7 @@ UNIQUE_ID

href="http://httpd.apache.org/docs/2.2/mod/mod_unique_id.html" class="external autonumber" title="http://httpd.apache.org/docs/2.2/mod/mod_unique_id.html" -rel="nofollow">[6]. This module provides a magic token for each +rel="nofollow">[7]. This module provides a magic token for each request which is guaranteed to be unique across "all" requests under very specific conditions. The unique identifier is even unique across multiple machines in a properly configured cluster of machines. The @@ -3659,7 +3657,7 @@ cmdLine
Note 
This is a community contribution developed by Marc Stern [7] + rel="nofollow">[8]

In Windows and Unix, commands may be escaped by different means, such as: @@ -4204,7 +4202,7 @@ modsecurity.org

  • 420,000–429,999: reserved for ScallyWhack [8] +rel="nofollow">[9]
  • 430,000–699,999: unused (available for reservation)
  • 700,000–799,999: reserved for Ivan Ristic
  • 900,000–999,999: reserved for the OWASP ModSecurity Core Rule @@ -4212,7 +4210,7 @@ Set [9] project + rel="nofollow">[10] project
  • 1,000,000-1,999,999: unused (available for reservation)
  • 2,000,000-2,999,999: reserved for rules from Trustwave's SpiderLabs Research team @@ -4847,7 +4845,7 @@ script in the /util directory called runav.pl [10] that allows the file approval mechanism to + rel="nofollow">[11] that allows the file approval mechanism to integrate with the ClamAV virus scanner. This is especially handy to prevent viruses and exploits from entering the web server through file upload. @@ -5079,7 +5077,7 @@ SecRule STREAM_OUTPUT_BODY "@rsub s/<!--.*?-->//" "phase:4,t:none,nolog,pa

    Regular expressions are handled by the PCRE library [11]. ModSecurity +title="http://www.pcre.org" rel="nofollow">[12]. ModSecurity compiles its regular expressions with the following settings:

    1. The entire input is treated as a single line, even when there @@ -5115,7 +5113,7 @@ SecRule REQUEST_HEADERS:User-Agent "(?i)nikto"

      Regular expressions are handled by the PCRE library [12]. ModSecurity +title="http://www.pcre.org" rel="nofollow">[13]. ModSecurity compiles its regular expressions with the following settings:

      1. The entire input is treated as a single line, even when there @@ -5652,7 +5650,7 @@ Template argument size: 0/2097152 bytes Expensive parser function count: 0/100 --> - +
        Retrieved from "http://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Reference_Manual"
        @@ -5762,7 +5760,7 @@ pages
        2. href="http://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Reference_Manual&printable=yes&printable=yes" rel="alternate" title="Printable version of this page [alt-shift-p]" accesskey="p">Printable version @@ -5771,18 +5769,18 @@ href="http://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Referen
        - +