diff --git a/Reference-Manual-(v3.x).mediawiki b/Reference-Manual-(v3.x).mediawiki index 681016f..5d0c6e5 100644 --- a/Reference-Manual-(v3.x).mediawiki +++ b/Reference-Manual-(v3.x).mediawiki @@ -368,68 +368,13 @@ The possible values are: ; Note : HTTPS audit log type is currently only supported on libModSecurity. == SecCacheTransformations == -'''Description:''' Controls the caching of transformations, which may speed up the processing of complex rule sets. Caching is off by default starting with 2.5.6, when it was deprecated and downgraded back to experimental. - -'''Syntax:''' SecCacheTransformations On|Off [options] - -'''Example Usage:''' SecCacheTransformations On "minlen:64,maxlen:0" - -'''Scope:''' Any - -'''Version:''' 2.5.0; deprecated in 2.5.6. - -'''Supported on libModSecurity:''' No (Deprecated) - -The first directive parameter can be one of the following: -*'''On''': Cache transformations (per transaction, per phase) allowing identical transforma- tions to be performed only once. -*'''Off''': Do not cache any transformations, leaving all transformations to be performed every time they are needed. - -The following options are allowed (multiple options must be comma-separated): -*'''incremental:on|off''': Enabling this option will cache every transformation instead of just the final transformation. The default is off. -*'''maxitems:N''': Do not allow more than N transformations to be cached. Cache will be disabled once this number is reached. A zero value is interpreted as unlimited. This option may be useful to limit caching for a form with a large number of variables. The default value is 512. -*'''minlen:N''': Do not cache the transformation if the variable’s length is less than N bytes. The default setting is 32. -*'''maxlen:N''': Do not cache the transformation if the variable’s length is more than N bytes. A zero value is interpreted as unlimited. The default setting is 1024. +''Not supported in v3''' == SecChrootDir == -'''Description:''' Configures the directory path that will be used to jail the web server process. - -'''Syntax:''' SecChrootDir /path/to/chroot/dir - -'''Example Usage:''' SecChrootDir /chroot - -'''Scope:''' Main - -'''Version:''' 2.0.0-2.9.x - -'''Supported on libModSecurity:''' TBI - -This feature is not available on Windows builds. The internal chroot functionality provided by ModSecurity works great for simple setups. One example of a simple setup is Apache serving only static files, or running applications using built-in modules. Some problems you might encounter with more complex setups: -#DNS lookups do not work (this is because this feature requires a shared library that is loaded on demand, after chroot takes place). -#You cannot send email from PHP, because it wants to use sendmail and sendmail re- sides outside the jail. -#In some cases, when you separate Apache from its configuration, restarts and graceful reloads no longer work. - -The best way to use SecChrootDir is the following: -#Create /chroot to be your main jail directory. -#Create /chroot/opt/apache inside jail. -#Create a symlink from /opt/apache to /chroot/opt/apache. -#Now install Apache into /chroot/opt/apache. - -You should be aware that the internal chroot feature might not be 100% reliable. Due to the large number of default and third-party modules available for the Apache web server, it is not possible to verify the internal chroot works reliably with all of them. A module, working from within Apache, can do things that make it easy to break out of the jail. In particular, if you are using any of the modules that fork in the module initialisation phase (e.g., mod_fastcgi, mod_fcgid, mod_cgid), you are advised to examine each Apache process and observe its current working directory, process root, and the list of open files. Consider what your options are and make your own decision. - -; Note : This directive is not allowed inside VirtualHosts. If enabled, it must be placed in a global server-wide configuration file such as your default modsecurity.conf. +'''Not supported in v3''' == SecCollectionTimeout == -'''Description:''' Specifies the collections timeout. Default is 3600 seconds. - -'''Syntax:''' SecCollectionTimeout seconds - -'''Default:''' 3600 - -'''Scope:''' Any - -'''Version:''' 2.6.3-2.9.x - -'''Supported on libModSecurity:''' No +'''Not supported in v3''' == SecComponentSignature == '''Description:''' Appends component signature to the ModSecurity signature.