which is better to have mod sec or mod uid

keat63

• February 16, 2015 11:31

Last week i updated to 11.48 and applied ModSec with OWASP, but i see that it has some incompatibility with ModRuid2. What's better to have, OWASP, ModRuid2 or both and live the the incompatibility.

• 

  quizknows

  • February 16, 2015 18:47

  I would generally say ModSecurity is most important as long as you have some form of symlink patch (Even the race condition protection in EA is "good enough") Most ModSecurity rules work OK with RUID2, just some that use collections will have some issues. For the most part the Atomicorp rules should be compatible. If I absolutely had to choose between RUID2 or ModSecurity, I'd ditch RUID2 in a heartbeat.

  0
• 

  cPanelMichael

  • February 19, 2015 13:34

  Hello :) Note that if you choose to not use Mod_Ruid2, the following document lists alternatives for symlink race condition protection: Symlink Race Condition Protection Thank you.

  0
• 

  dalem

  • February 20, 2015 00:52

  both works fine mod ruid2 & security running got root & comodo waf for the collections issue we just run a cron to clear the stale files

  0
• 

  keat63

  • February 20, 2015 08:42

  I have both, but MOdRuid2 is causing a few issues with Owasp ModSec. If there's no distinct advantage to ModSec over Ruid2 then i'll keep both.

  0
• 

  quizknows

  • February 20, 2015 15:26

  RUID2 prevents cross-account compromise, which SuPHP + symlink race condition protection does as well. RUID2 provides no protections for an individual account getting hacked though; that is what ModSecurity is for.

  0

Please sign in to leave a comment.