Change to OFF the ModSecurity on by default in new sites

Facundo

• September 18, 2015 10:27

Hello! I want to change by default that all new sites, domains or subdomains created in WHM/cPanel start with Mod Security ON, to OFF. I don't want to disable ModSecurity from the server, just to that new function start disabled, and then if the user like, they can enabled in their cPanel As an extra, i want to know how to disable ModSecurity by command line, SQL or whatever for a single user/account. Thanks, Facundo

• 

  cPanelMichael

  • September 21, 2015 05:57

  Hello :) I believe the functionality you are looking for is available in the following third-party plugin from ConfigServer:

  0
• 

  Facundo

  • September 21, 2015 15:59

  Thank you Michael, i don't know that plugin. Anyway, my problem continues... i need to manualy disable a lot of domains (3/4 clicks for each account!) and all new ones. Nobody know how can i do this in an efficient way?

  0
• 

  cPanelMichael

  • September 21, 2015 17:05

  There are no native options that allow you to disable Mod_Security for all domain names at once. The manual method of doing this is by modifying the Apache include file for each domain name. The plugin referenced in my last response is likely the easiest way to do this:

  0
• 

  Facundo

  • September 21, 2015 17:48

  If ther isnt' a native option, i want to make it for my own... please help me with this: From where (or where is stored) the cPanel take the information for know if the ModSecurity is on or off? Because if i edit the httpd.conf, cPanel "database? don't know the changes May be with that, i can create a custom (beggining) template for all new domains or sub-domains to start with ModSec OFF

  0
• 

  cPanelMichael

  • September 22, 2015 16:04

  From where (or where is stored) the cPanel take the information for know if the ModSecurity is on or off? Because if i edit the httpd.conf, cPanel "database? don't know the changes

  
  Here are the steps you can take to disable Mod_Security for an individual account through the command line: 1. Create a directory for the domain you want to exclude:
  mkdir -p /usr/local/apache/conf/userdata/std/2/USERNAME/DOMAIN.TLD
  2. Create a mod_security conf file:
  touch /usr/local/apache/conf/userdata/std/2/USERNAME/DOMAIN.TLD/mod_security.conf
  3. Add the following line in that file:
  SecRuleEngine Off
  4. Save the file and then run:
  /scripts/ensure_vhost_includes --user=USERNAME
  Thank you.

  0
• 

  Facundo

  • September 22, 2015 16:15

  Great advance, thans a lot! :) I can resolve part of my problems with a customization that not will not reflected in cPanels, but is almost something;)

  0

Please sign in to leave a comment.