Whitelist Mod_security rules for a CPanel account


Preface:
Sometimes you may arise an issue like this. When a client tries to install IFrames he gots the following error

"you don't have permission to access /e107_admin/cpage.php on this server"


This issue arises due to this installtion is blocked by a mod_security rule

Recover the issue
First  you’ll need to get the Rule ID number. You can find these either in the apache error log (grep for your IP) or if you have CSF installed and keep getting your IP blocked, check /etc/csf/csf.deny to see if its listing the mod_security rule that you were blocked from.

ie

#grep <ip> /usr/local/apache/logs/error_log
or
#grep <ip> /etc/csf/csf.deny

From here you will get the application ID

Once you have the rule’s id number, you will need to create the following file

vi /usr/local/apache/conf/userdata/std/2/USER/<domain.com>/<anything>.conf

For example
vi /usr/local/apache/conf/userdata/std/2/USER/example.com/modsec.conf

Now open the .conf file and add the below mentioned lines in it.


<IfModule mod_security2.c>
SecRuleRemoveById <NUMBER>
</IfModule>


Be sure to replace <NUMBER> with the Rule ID number of the mod_security rule you need to whitelist. Save the file, and then run the following commands, replacing <CPANEL USER> with the actual cpanel user name.

/scripts/ensure_vhost_includes --user=<CPANEL USER>
/usr/local/cpanel/bin/apache_conf_distiller --update
/usr/local/cpanel/bin/build_apache_conf

:)

No comments: