News and Updates
ModSecurity v2.5.5
(June 6, 2008)
ModSecurity v2.5.5 is a maintenance release, which fixes a few bugs and compatibility problems (e.g. the WordPress upload issue).
ModSecurity v2.5.4
(May 8, 2008)
ModSecurity v2.5.4 is a maintenance release, which fixes an issue with transformation caching that would, in some
cases, cause targets to be incorrectly transformed.
ModSecurity Console v1.0.5
(May 7, 2008)
ModSecurity Console v1.0.5 fixes a small bug when displaying multipart requests.
ModSecurity v2.5.3
(April 25, 2008)
ModSecurity v2.5.3 is a maintenance release, which fixes a few small defects in the code and in the rules.
This version also allows macros to be expanded in the expirevar and deprecatevar actions.
ModSecurity Console v1.0.4
(April 25, 2008)
ModSecurity Console v1.0.4 fixes a small regression introduced in v1.0.3.
ModSecurity Console v1.0.3
(April 15, 2008)
ModSecurity Console v1.0.3 brings performance improvements, SSL mode by default,
and support for the new K part of the audit log (available since ModSecurity v2.5).
ModSecurity v2.1.7 and v2.5.2
(April 3, 2008)
ModSecurity v2.1.7 and v2.5.2 are maintenance releases, which fix a few small issues.
What Is ModSecurity?
ModSecurity is a web application firewall that can work either embedded or as a reverse proxy.
It provides protection from a range of attacks against web applications and allows for HTTP
traffic monitoring, logging and real-time analysis.
It is also an open source project that aims to make the web application firewall
technology available to everyone.
Books
Apache Security is a comprehensive Apache Security resource, written by Ivan Ristic
for O'Reilly. Two chapters (Apache Installation and Configuration and PHP) are available as free
download, as are the Apache security tools created for the book.
Preventing Web Attacks with Apache. Building on his groundbreaking SANS presentations on Apache security, Ryan C. Barnett reveals why your Web servers represent such a compelling target, how significant exploits are performed, and how they can be defended against.
|
Support/Mailing lists
Community support is available on the
mod-security-users/lists.sourceforge.net mailing list. You must
subscribe first (by clicking here)
in order to post. The list archives are available as
News (NNTP),
Threaded HTTP,
Bloggy HTTP,
and RSS.
Commercial support and appliances based on ModSecurity can be
obtained from Breach Security.
Getting Started
External Links
ModSecurity 2.0 with Ivan Ristic
ModSecurity is an open source web application firewall that runs as an Apache module, and version 2.0 offers many new features and improvements. Federico Biancuzzi interviewed Ivan Ristic to discuss the new logging system, events tracking and correlation, filtering AJAX or AFLAX applications, and just-in-time patching for closed source applications.
Web Application Firewalls Primer
Introduction to Web Application Firewalls, published in INSECURE Magazine 1.5.
Talks
Our talks are available for download following the links below:
|
