Page 1 of 1
ModSecurity
Posted: Mon 14. Dec 2020, 02:21
by benkhouya
Hi,
It will be a great plus for KeyHelp if you add an option for installing and managing ModSecurity using the web interface of your panel.
PS. Thank you very much for your good work!
Re: ModSecurity
Posted: Thu 17. Dec 2020, 13:38
by andromeda
As far i know it may be installed by hand.
I installed ModSecurity and ModEvasive and had no issue so fars, but i don't know if it may break KeyHelp auto update stuff (Unlikely?).
Best
Re: ModSecurity
Posted: Tue 1. Jul 2025, 23:55
by superjogi
I have from time to time problems with bots. Do we have libapache2-mod-evasive available?
Here I found a rather old install step by step:
viewtopic.php?t=53
Re: ModSecurity
Posted: Wed 2. Jul 2025, 10:03
by Florian
Hallo,
for Bots you can use the Keyhelp bad Bots Jail of Fail2ban. When it is not available in /etc/fail2ban you can find the Filter in /home/keyhelp/www/keyhelp/intgsall/templates/fail2ban/filter.d
Copy it to /etc/fail2ban/filter.d and activate it in /etc/fail2ban/jail.d/keyhelp.conf
Code: Select all
[kh-bad-bots]
# Keep disabled on a fresh system, as there may not be any log files yet.
# Available filter modes: [mode=normal] | [mode=aggressive] (this may block facebook)
enabled = true
port = http,https
filter = keyhelp-bad-bots[mode=normal]
logpath = /home/users/*/logs/*/access.log
backend = auto
maxretry = 1
You can also optimize the keyhelp-bad-bots.conf:
Code: Select all
badbots-normal = GPTBot|AmazonBot|Bytespider|Bytedance|fidget-spinner-bot|EmailCollector|WebEMailExtrac|ClaudeBot| TrackBack/1\.02|sogou music spider|seocompany|LieBaoFast|SEOkicks|Uptimebot|Cliqzbot|ssearch_bot|domaincrawler|AhrefsBot|spot|DigExt|Sogou|MegaIndex\.ru|majestic12|80legs|SISTRIX|HTTrack|Semrush|MJ12|Ezooms|CCBot|TalkTalk|Ahrefs|BLEXBot|Atomic_Email_Hunter/4\.0|atSpider/1\.0|autoemailspider|bwh3_user_agent|China Local Browse 2\.6|ContactBot/0\.2|ContentSmartz|DataCha0s/2\.0|DBrowse 1\.4b|DBrowse 1\.4d|Demo Bot DOT 16b|Demo Bot Z 16b|DSurf15a 01|DSurf15a 71|DSurf15a 81|DSurf15a VA|EBrowse 1\.4b|Educate Search VxB|EmailSiphon|EmailSpider|EmailWolf 1\.00|ESurf15a 15|ExtractorPro|Franklin Locator 1\.8|FSurf15a 01|Full Web Bot 0416B|Full Web Bot 0516B|Full Web Bot 2816B|Guestbook Auto Submitter|Industry Program 1\.0\.x|ISC Systems iRc Search 2\.1|IUPUI Research Bot v 1\.9a|LARBIN-EXPERIMENTAL \(efp@gmx\.net\)|LetsCrawl\.com/1\.0 \+http\://letscrawl\.com/|Lincoln State Web Browser|LMQueueBot/0\.2|LWP\:\:Simple/5\.803|Mac Finder 1\.0\.xx|MFC Foundation Class Library 4\.0|Microsoft URL Control - 6\.00\.8xxx|Missauga Locate 1\.0\.0|Missigua Locator 1\.9|Missouri College Browse|Mizzu Labs 2\.2|Mo College 1\.9|MVAClient|Mozilla/2\.0 \(compatible; NEWT ActiveX; Win32\)|Mozilla/3\.0 \(compatible; Indy Library\)|Mozilla/3\.0 \(compatible; scan4mail \(advanced version\) http\://www\.peterspages\.net/?scan4mail\)|Mozilla/4\.0 \(compatible; Advanced Email Extractor v2\.xx\)|Mozilla/4\.0 \(compatible; Iplexx Spider/1\.0 http\://www\.iplexx\.at\)|Mozilla/4\.0 \(compatible; MSIE 5\.0; Windows NT; DigExt; DTS Agent|Mozilla/4\.0 efp@gmx\.net|Mozilla/5\.0 \(Version\: xxxx Type\:xx\)|NameOfAgent \(CMS Spider\)|NASA Search 1\.0|Nsauditor/1\.x|PBrowse 1\.4b|PEval 1\.4b|Poirot|Port Huron Labs|Production Bot 0116B|Production Bot 2016B|Production Bot DOT 3016B|Program Shareware 1\.0\.2|PSurf15a 11|PSurf15a 51|PSurf15a VA|psycheclone|RSurf15a 41|RSurf15a 51|RSurf15a 81|searchbot admin@google\.com|ShablastBot 1\.0|snap\.com beta crawler v0|Snapbot/1\.0|Snapbot/1\.0 \(Snap Shots, \+http\://www\.snap\.com\)|sogou develop spider|Sogou Orion spider/3\.0\(\+http\://www\.sogou\.com/docs/help/webmasters\.htm#07\)|sogou spider|Sogou web spider/3\.0\(\+http\://www\.sogou\.com/docs/help/webmasters\.htm#07\)|sohu agent|SSurf15a 11 |TSurf15a 11|Under the Rainbow 2\.2|User-Agent\: Mozilla/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1\)|VadixBot|WebVulnCrawl\.unknown/1\.0 libwww-perl/5\.803|Wells Search II|WEP Search 00
Re: ModSecurity
Posted: Fri 4. Jul 2025, 19:12
by superjogi
Danke, habe ich jetzt im Einsatz. Superduper!