ModSecurity is a Web Application Firewall (WAF) that check every HTTP and HTTPS requests before the website application can load on the browser and can block any requests if found suspicious.
In DirectAdmin ModSecurity rule is sets as OWASP and Comodo.
Following is a symptom of a ModSecurity triggered as false positive is:
HTTP ERROR 403
OR
HTTP ERROR 406
The Apache/Nginx may generate an error log that may look similar to:
ModSecurity: Access denied with code 406
Note: It is not all the blocked http or https requests are offensive but ModSecurity some time blocked legitimate requests as look suspicious.
1. There are three different ways to disable ModSecurity
First Method:- Disable ModSecurity for ONE domain
This method is advisable to be adopted (Best Practice of Disabling ModSecurity).
Step 1 — Login to DirectAdmin
Open your DirectAdmin panel:
https://YOUR-SERVER-IP:2222or
https://your-hostname:2222LocateWeb Application FirewallorModSecurity
Note that the three different interfaces are depending on the version of your directadmin.
The websites name appears. Select the domain name after making the troubleshoot.
Disable the Web Application Firewall
You should find an option similar to:
Select:
Then save the configuration.
The website can be tested now by loading it on a browser and there will be no previous error. As the site loaded and working fine online, then ModSecurity
was responsible for the error
Second Method:- Disable ModSecurity globally
This is very risk as the top security layer on the server is disabled. The global configuration applies at the top-level web-server configuration and is inherited by virtual hosts. Therefore, disabling it globally affects the websites on the server.
Using GUI, ModSecurity can be Disable globally in DirectAdmin as given below:
Login to DirectAdmin as administrator and follow the guide:
Admin Level
↓
Server Manager
↓
ModSecurity
↓
Global Configuration
Locate the “Web Application Firewall”
Select Disabled
Save it.
Third Method:- Disable ModSecurity globally from SSH
This process required a root access. You can login to the server via SSH as root user to disable ModSecurity through DirectAdmin’s CustomBuild system, use
Bash:
da build set modsecurity no
da build updateDirectAdmin’s CustomBuild system controls the ModSecurity installation and configuration. DirectAdmin documents enabling it with:
Bash:
da build set modsecurity yesThe corresponding Custom Build configuration is the appropriate place to manage the server-wide feature.
Instead of disabling it completely, DirectAdmin’s community guidance also uses:
Bash:
da build set modsecurity noIt is not advisable to use the removal command as in the case of troubleshooting a website error but temporarily disable it to troubleshoot the problem.
Important note: It is not a good practice to disable ModSecurity on the entire server immediately because of one website is experiencing an issue. DirectAdmin have a means of controlling ModSecurity per-domain .