mod_security and google safe browsing

dzamanakos

• November 04, 2015 11:53

Hi, i've read about SecGsbLookupDb and mod_security and see that : Note : Deprecated in 2.7.0 after Google dev team decided to not allow the database download anymore. After registering and obtaining a Safe Browsing API key, you can automatically download the GSB using a tool like wget (where KEY is your own API key): wget sb.google.com/safebrowsing/update?client=api&apikey=KEY&version=goog-malware-hash:1:-1 i've read some articles in the internet (not mod_security specific), made an api key but cant find a way to download the database to my server. The url's mentioned in the posts return 404 error when wget url. Is there anyone that found a way to download it? Thank you,

• 

  cPanelMichael

  • November 11, 2015 19:38

  Hello :) Did you register with Google and obtain a safe browsing API key? Thank you.

  0
• 

  dzamanakos

  • November 12, 2015 07:25

  Yes i got an api key, but cant find a url that i can download a dat or something file with a wget... All the url's that i found in forums return an error and no data file is downloaded. Thank you,

  0
• 

  Infopro

  • November 12, 2015 09:23

  You might want to review the docs about this. Safe Browsing Lookup API Developer's Guide

  0
• 

  dzamanakos

  • November 12, 2015 10:20

  I've read about it, but i can understand that you can no longer download the database with a cron and do local queries.. Just query for a single or multiple url's to google and get the results. In the cpanel's mod security configuration it needs a local path to my server. I didnt find a recent working guide in google or forums.. Posted here if anyone was able to make it working recently.. Thank you again..

  0
• 

  Infopro

  • November 12, 2015 10:26

  You're trying to add this URL as a Vendor? I don't think that's possible.

  0
• 

  dzamanakos

  • November 12, 2015 11:27

  I see that in mod_security configuration there is an entry : Google Safe Browsing Database SecGsbLookupDb Specify a path for the Google Safe Browsing Database. That needs a local path of a database file. I've read that google no longer supports downloading their database and in mod_security they refer to a url that isnt working anymore. There are some old guides in the internet that trying to overide this, but the solutions dont work. I just wondered if someone has a way of make it work, either by local database file, or remote connections.. Thank you again..

  0
• 

  Infopro

  • November 12, 2015 11:39

  My mistake, thanks for the additional details.

  0
• 

  JonTheWong

  • January 09, 2016 08:00

  Any update on this?

  0
• 

  cPanelMichael

  • January 11, 2016 15:23

  Any update on this?

  
  Hello :) You will need to consult with Google if you have obtained an API key and there's no valid download location. The feature was deprecated in Mod_Security after Google began forcing the use of an API key to download the file. Thank you.

  0
• 

  mmurphy209

  • May 01, 2020 19:39

  I'm left wondering why it's still in a brand new cPanel install in 2020.

  0
• 

  cPanelLauren

  • May 01, 2020 19:43

  Because they include it with the installation. Information is noted in in the link to SecGsbLookupDb: [QUOTE=https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#secgsblookupdb] SecGsbLookupDb Description: Defines the path to the database that will be used for Google Safe Browsing (GSB) lookups. Syntax: SecGsbLookupDb /path/to/db Example Usage: SecGsbLookupDb /path/to/GsbMalware.dat Scope: Any Version: 2.6.0 Supported on libModSecurity: TBD ModSecurity relies on the free Google Safe Browsing database that can be obtained from the Google GSB API
  

  0

Please sign in to leave a comment.