1 <IfModule mod_security.c>
  2
  3 # Only inspect dynamic requests
  4 # (YOU MUST TEST TO MAKE SURE IT WORKS AS EXPECTED)
  5 #SecFilterEngine DynamicOnly
  6
  7 SecFilterEngine On
  8
  9 # Reject requests with status 500
 10 SecFilterDefaultAction "deny,log,status:500"
 11
 12 # Some sane defaults
 13 SecFilterScanPOST On
 14 SecFilterCheckURLEncoding On
 15 SecFilterCheckCookieFormat On
 16 SecFilterCheckUnicodeEncoding Off
 17 SecFilterNormalizeCookies On
 18 # enable version 1 (RFC 2965) cookies
 19 SecFilterCookieFormat 1
 20
 21 SecServerResponseToken Off
 22
 23 #If you want to scan the output, uncomment these
 24 #SecFilterScanOutput On
 25 #SecFilterOutputMimeTypes "(null) text/html text/plain"
 26
 27 # Accept almost all byte values
 28 SecFilterForceByteRange 1 255
 29
 30 # Server masking is optional
 31 #fake server banner - NOYB used - no one needs to know what we are using
 32 SecServerSignature "KiOrKY 's Httpd"
 33
 34 #SecUploadDir /tmp
 35 #SecUploadKeepFiles Off
 36
 37 # Only record the interesting stuff
 38 SecAuditEngine RelevantOnly
 39 SecAuditLog etc/apache22/logs/audit_log
 40
 41 # You normally won't need debug logging
 42 SecFilterDebugLevel 0
 43 SecFilterDebugLog etc/apache22/logs/modsec_debug_log