我把security2模块安装到了我的apache服务器上，把下面几行添加到我的httpd.conf中：
<IfModule security2_module> Include crs/owasp-modsecurity-crs/modsecurity_crs_10_setup.conf Include crs/owasp-modsecurity-crs/base_rules/*.conf </IfModule> 当我想通过http访问我的服务器时，我得到如下信息：“ Forbidden You don't have permission to access / on this server ”
然后我去了该模块日志，我看到以下错误：
--72348f1e-B-- GET / HTTP/1.1 Host: 192.8.9.70 Connection: keep-alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.124 Safari/537.36 Accept-Encoding: gzip, deflate, sdch Accept-Language: en-US,en;q=0.8,es;q=0.6,da;q=0.4 --72348f1e-F-- HTTP/1.1 403 Forbidden Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Length: 202 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 --72348f1e-E-- --72348f1e-H-- Message: Access denied with code 403 (phase 2). Pattern match "^[\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/httpd/crs/owasp-modsecurity-crs/base_rules/modsecurity_crs_21_protocol_anomalies.conf"] [line "98"] [id "960017"] [rev "2"] [msg "Host header is a numeric IP address"] [data "192.8.9.70"] [severity "WARNING"] [ver "OWASP_CRS/2.2.9"] [maturity "9"] [accuracy "9"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [tag "http://technet.microsoft.com/en-us/magazine/2005.01.hackerbasher.aspx"] Action: Intercepted (phase 2) Stopwatch: 1435777069259012 1803 (- - -) Stopwatch2: 1435777069259012 1803; combined=768, p1=644, p2=93, p3=0, p4=0, p5=30, sr=382, sw=1, l=0, gc=0 Response-Body-Transformed: Dechunked Producer: ModSecurity for Apache/2.7.3 (http://www.modsecurity.org/); OWASP_CRS/2.2.9. Server: Apache Engine-Mode: "ENABLED"
我假设有一些configuration不好的模块。 任何帮助表示赞赏。
看起来像mod_security完美的工作。 它阻止了请求，因为Host头只包含一个IP地址，这就是这个规则的意思 。
你应该使用一个实际的主机名来引用你的网站，在生产中。 在开发中也是一个好主意，但是如果您需要在开发中使用IP地址，则可以始终禁用该规则。