h1197664
0
1
web
web
0
/
60M
1
0
$SERVER_ROOT/conf/mime.properties
0
86400
1
$SERVER_ROOT/admin/
/tmp/lshttpd/swap
Default
*:80
0
Example
*
Example
$SERVER_ROOT/DEFAULT/
$VH_ROOT/conf/vhconf.xml
1
1
1
0
0
centralConfigLog
$SERVER_ROOT/conf/templates/ccl.xml
Default
PHP_SuEXEC
$SERVER_ROOT/conf/templates/phpsuexec.xml
Default
EasyRailsWithSuEXEC
$SERVER_ROOT/conf/templates/rails.xml
Default
1
5
LSAPI_MAX_REQS=1000
LSAPI_MAX_IDLE=60
60
0
60
0
50
1
300
3
250M
300M
200
300
2000
200
300
1000
5
0
0
0
best
4096
20M
256K
40M
null
8192
16380
10M
4K
10M
1
6
1
text/*,application/x-javascript,application/xml
1
6
1M
300
$SERVER_ROOT/logs/error.log
DEBUG
0
10M
1
$SERVER_ROOT/logs/access.log
30
10M
1
1
0
index.html
0
.htaccess
1
image/*=A604800, text/css=A604800, application/x-javascript=A604800
/
/etc/*
/dev/*
$SERVER_ROOT/conf/*
$SERVER_ROOT/admin/conf/*
20
11
10
0
60
120
250M
300M
400
450
0
0
0
0
10000
10000
15
300
1
0
000
000
0
0
deny,log,status:403
1
XSS attack
log,deny,status:403,msg:'XSS attack'
1
SecFilterSelective ARGS "(alert|expression|eval|url)[[:space:]]*\("
SecFilterSelective ARGS "(&\{.+\}|(&#[[0-9a-fA-F]]|\x5cx[0-9a-fA-F]){2})"
SecFilterSelective ARGS "((javascript|vbscript):|style[[:space:]]*=)"
SecFilterSelective ARGS "(fromCharCode|http-equiv|<.+>|innerHTML|dynsrc|-->)"
SecFilterSelective ARGS "document\.(body|cookie|location|write)"
SecFilterSelective ARGS_VALUES "jsessionid|phpsessid|onReadyStateChange|xmlHttp"
SecFilterSelective ARGS "<(applet|div|embed|iframe|img|meta|object|script|textarea)"
# JavaScript event handlers
SecFilterSelective ARGS "on(Abort|Blur|Click|DblClick|DragDrop|Error|Focus|KeyUp|KeyDown|KeyPrerss|Load|Mouse(Down|Out|Over|Up)|Move|Reset|Resize|Select|Submit|Unload)"
SQL injection
log,pass,msg:'SQL Injection attack'
1
#SQL generic
SecFilterSelective ARGS "drop[[:space:]]+(database|table|column|procedure)"
SecFilterSelective ARGS "delete[[:space:]]+from|create[[:space:]]+table|update.+set.+=|insert[[:space:]]+into.+values"
SecFilterSelective ARGS "select.+from|bulk[[:space:]]+insert|union.+select|alter[[:space:]]+table"
SecFilterSelective ARGS "or.+1[[:space:]]*=[[:space:]]1|or 1=1--'|'.+--"
SecFilterSelective ARGS "into[[:space:]]+outfile|load[[:space:]]+data|/\*.+\*/"
ALL