Modsecurity Ajax Error: Internal server Error

[rz300]

After installing modsec from official instructions my site doesn't work correctly. Admin side from cms is build with ajax and something else and it doesn't work.

        location / {
        ModSecurityEnabled on;
        ModSecurityConfig /etc/modsecurity/modsecurity.conf;
        testcookie off;
        root /srv/rewired.ru/www;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-for $remote_addr;
        proxy_set_header Host $host;
        proxy_pass http://rewired/;
        proxy_connect_timeout 180s;
        proxy_send_timeout 90;
        proxy_read_timeout 180s;
        proxy_set_header Connection close;
        proxy_pass_header Content-Type;
        proxy_pass_header Content-Disposition;
        proxy_pass_header Content-Length;
        proxy_cache_valid any 10m;
        proxy_buffer_size 8k;
        }

tail from nginx error.log

2015/01/20 14:21:14 [error] 13250#0: *323475 upstream prematurely closed connection while reading response header from upstream, client: 178.140.252.82, server: id-st.ru, request: "POST /admin/update/index.php HTTP/1.1", upstream: "http://127.0.0.1:8080/admin/update/index.php", host: "rewired.ru", referrer: "http://rewired.ru/admin/"
2015/01/20 14:26:52 [error] 29780#0: *4 upstream prematurely closed connection while reading response header from upstream, client: 178.140.252.82, server: id-st.ru, request: "GET /admin/ HTTP/1.1", upstream: "http://127.0.0.1:8080/admin/", host: "rewired.ru"
2015/01/20 14:26:52 [error] 29781#0: *14 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 178.140.252.82, server: id-st.ru, request: "GET / HTTP/1.1", upstream: "http://127.0.0.1:8080/", host: "plitka-zel.ru"
2015/01/20 14:26:53 [error] 29841#0: *16 connect() failed (111: Connection refused) while connecting to upstream, client: 178.140.252.82, server: id-st.ru, request: "GET /favicon.ico HTTP/1.1", upstream: "http://127.0.0.1:8080/favicon.ico", host: "rewired.ru"
2015/01/20 14:26:53 [error] 29844#0: *18 connect() failed (111: Connection refused) while connecting to upstream, client: 178.140.252.82, server: id-st.ru, request: "GET /favicon.ico HTTP/1.1", upstream: "http://127.0.0.1:8080/favicon.ico", host: "plitka-zel.ru"
2015/01/20 14:27:10 [alert] 29845#0: *31 no upstream configuration, client: 178.140.252.82, server: id-st.ru, request: "POST /admin/update/index.php HTTP/1.1", host: "rewired.ru", referrer: "http://rewired.ru/admin/"
2015/01/20 14:27:42 [alert] 29782#0: *45 no upstream configuration, client: 178.140.252.82, server: id-st.ru, request: "POST /admin/xsl/index.php HTTP/1.1", host: "rewired.ru", referrer: "http://rewired.ru/admin/"

any ideas?

[zimmerle]

Hi @rz300,

Which branch are you using? I recommend the utilization of the branch: nginx_refactoring

Check if your site became workable by setting SecRequestBodyAccess to off. More info on SecRequestBodyAccess: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#secrequestbodyaccess

[rz300]

main branch, thanks it works, but if SecRequestBodyAccess is off, security of the server is going low?

[zimmerle]

Hi @rz300 few minutes ago I've merge #904 into nginx_refactoring branch. It should fix this issue, please confirm that the issue is fixed.

[zimmerle]

No longer a concern in libModSecurity. Marking it as won't fix for 2.x. Further information about libModSecurity available here:
https://github.com/SpiderLabs/ModSecurity/tree/v3/master