How to whitelist a specific URI in ModSecurity

Scenario

While working with ModSecurity you may find it more convenient to whitelist a specific URI instead of allowing an IP address or disabling a rule completely.  You can do this by editing just one configuration file on the system

Procedure

• Ensure you have SSH access as the root user, as that will be required to make these changes
• Use grep or another search function to locate the error in the Apache log (/etc/apache2/logs/error_log) to ensure you are whitelisting the correct URI.  You'll want to note the URI and the ID number of the rule that was tripped.
• Edit (or create the file if it does not yet exist) /etc/apache2/conf.d/whitelist.conf and add the following data where "/path/index.php"is the specific file you're working with:

  • <LocationMatch "/path/index.php">
    SecRuleRemoveById 20002221
    </LocationMatch>

• Ensure the whitelist is correctly configured by running the following command:

  • apachectl -t

• As long as the command from step 4 returns "Syntax OK" you are ready to restart Apache with this command and then your rule is in place:

  • /scripts/restartsrv_httpd