Apache mod-security

Ivan Ristic | 2 Mar 15:51

Re: RE: Mod_security question

Spence, Ian (ELS-CAM) wrote:
> Ivan
> 
> Our target platform is Windows server.
> 
> Given the download page states testing has stopped for Windows would you
> advise on deploying 1.9 codebase on Windows? I am very interesting in
> deploying your suggested enhancement "SecFilterExternal".

   Well, "stopped testing" is not entirely accurate. The truth is I never
   test mod_security on Windows. I develop and test on Linux, but I only
   compile and run a set of automated tests on Windows. This does not
   mean mod_security does not run or runs badly on Windows. In fact, I
   have had many reports from people who are happily running it on
   Windows. I am merely stating the facts to let people to make their
   own minds.

--

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click

headers

Spence, Ian (ELS-CAM | 1 Mar 17:39

RE: Mod_security question

Ivan

Our target platform is Windows server.

Given the download page states testing has stopped for Windows would you
advise on deploying 1.9 codebase on Windows? I am very interesting in
deploying your suggested enhancement "SecFilterExternal".

Ian Spence

-----Original Message-----
From: Ivan Ristic [mailto:ivanr <at> webkreator.com] 
Sent: 01 March 2005 15:04
To: Spence, Ian (ELS-CAM)
Cc: mod-security-users <at> lists.sourceforge.net
Subject: Re: Mod_security question

Spence, Ian (ELS-CAM) wrote:
> Ivan
> 
> Can mod_security check on a token parameter in the URL?
> 
> E.g. _http://server/app?token=digestTokenValue_
> 
> I want the receiving web server to check the token value against an 
> agreed algorithm, for a start it will be MD5 digested.
> 
> I notice with the mod_security rules you can trap on certain parameter 
> values i.e. regex, but given a match can you run a script and then 
> depending on the result of the script, either reject or accept the

(Continue reading)