在12.04.1上安装了modsecurity后，apache2反向代理被破坏

这是我第一次遇到像这样的问题。 我mod_ajp on 8009使用mod_ajp on 8009 apache2后面有一个java应用程序设置。 我注意到我无法获得客户端的IP，所以我创build了另一个虚拟主机文件并切换到mod_jk 。 然后我使用mod_ajp禁用虚拟主机。 所以我的mod_jk一直工作正常，直到我开始从fanclub安全强化。 我已经应用notpad2.blogpost.com上显示的方法，我还是很好。 今天早上，我看到在modsecu_audit.log文件中的日志：

 Action: Intercepted (phase 1) Stopwatch: 1394809780952048 3090 (- - -) Stopwatch2: 1394809780952048 3090; combined=812, p1=492, p2=0, p3=0, p4=0, p5=253, sr=143, sw=67, l=0, gc=0 Response-Body-Transformed: Dechunked Producer: ModSecurity for Apache/2.6.3 (http://www.modsecurity.org/); OWASP_CRS/2.2.5. Server: Apache WebApp-Info: "default" "C35A8A3AB916218E923E5A8E6A73595B" "" --81b0e75f-Z-- 

在虚拟主机error.log我有下面的错误

 [Thu Mar 13 11:18:43 2014] [error] [client xxx.xxx.xxx.xxx] client denied by server configuration: [Thu Mar 13 11:18:44 2014] [error] [client xxx.xxx.xxx.xxx] ModSecurity: Access denied with code 403 (phase 2). String match "HTTP/1.1" at REQUEST_PROTOCOL. [file "/etc/modsecurity/owasp-crs/activated_rules/modsecurity_crs_20_protocol_violations.conf"] [line "220"] [id "960020"] [rev "2.2.5"] [msg "Pragma Header requires Cache-Control Header for HTTP/1.1 requests."] [severity "NOTICE"] [tag "RULE_MATURITY/5"] [tag "RULE_ACCURACY/7"] [tag "https://www.owasp.org/index.php/ModSecurity_CRS_RuleID-960020"] [tag "PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "http://www.bad-behavior.ioerror.us/documentation/how-it-works/"] [hostname "mysite.com"] [uri "/"] [unique_id "UyGUFAqzjt0AADfWBbEAAAAA"] [Thu Mar 13 11:23:52 2014] [error] [client xxx.xxx.xxx.xxx] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity/owasp-crs/activated_rules/modsecurity_crs_21_protocol_anomalies.conf"] [line "47"] [id "960015"] [rev "2.2.5"] [msg "Request Missing an Accept Header"] [severity "CRITICAL"] [tag "PROTOCOL_VIOLATION/MISSING_HEADER_ACCEPT"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "mysite.com"] [uri "/"] [unique_id "UyGVSAqzjt0AADfWBbIAAAAH"] 

在主要的apache error.log我有：

  [Fri Mar 14 15:07:11 2014] [error] [client xxx.xxx.xxx.xxx] ModSecurity: Access denied with code 403 (phase 1). Match of "streq %{SESSION.IP_HASH}" against "TX:ip_hash" required. [file "/etc/modsecurity/owasp-crs/activated_rules/modsecurity_crs_16_session_hijacking.conf"] [line "35"] [id "981059"] [msg "Warning - Sticky SessionID Data Changed - IP Address Mismatch."] [hostname "mysite.com"] [uri "/"] [unique_id "UyMbH8QokBEAAH5mFvgAAAAB"] [Fri Mar 14 15:09:35 2014] [notice] SIGUSR1 received. Doing graceful restart [Fri Mar 14 15:09:36 2014] [notice] Apache/2.2.22 (Ubuntu) mod_ssl/2.2.22 OpenSSL/1.0.1 mod_jk/1.2.32 configured -- resuming normal operations [Fri Mar 14 15:09:40 2014] [error] [client xxx.xxx.xxx.xxx] ModSecurity: Access denied with code 403 (phase 1). Match of "streq %{SESSION.IP_HASH}" against "TX:ip_hash" required. [file "/etc/modsecurity/owasp-crs/activated_rules/modsecurity_crs_16_session_hijacking.conf"] [line "35"] [id "981059"] [msg "Warning - Sticky SessionID Data Changed - IP Address Mismatch."] [hostname "mysite.com"] [uri "/"] [unique_id "UyMbtMQokBEAAH7dJ3sAAACB" 

我已经禁用了modsecurity，但是现在显示了默认的索引页面“it works”。 我甚至使用mod_ajp重新激活了已知的正在运行的虚拟主机，他们中的任何一个似乎都不再工作了。

• nginx反向代理或鱿鱼转发代理（透明）？
• Nginx反向代理重新打包分块响应
• Apache的反向代理404图像错误
• Rails应用程序（通过Apache代理）图像上传目录丢失
• ngnix代理https请求子文件夹

我知道页面被阻止等，但我不明白为什么反向代理将停止工作。

问题1是这是一个已知的问题或错误configuration？
问题2我如何获得虚拟主机备份？ 快速修复将删除modsecurity（即使我没有看到相关性）。

所有的build议都欢迎。 谢谢

 activated_rules/modsecurity_crs_20_protocol_violations.conf"]