Search code examples
tomcat7mod-security

mod-security: warning, not blocking

I've installed mod-security and can see from the logs that it is warning me in the case of an SQLi attempt. The attempt succeeds however, when I expect it to be prevented. Clearly I'm missing some very obvious setting, but I can't find it!

Any help appreciated.

Solution

  • Did you set

    SecRuleEngine On

    in "modsecurity.conf"? The default is 

    SecRuleEngine DetectionOnly

    Also see https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#SecRuleEngine