Mod_security is blocking xml files for updates servers because User Agent Header is missing.
Here is a sample of my Apache's log:
[Sun Apr 16 13:57:13 2017] [error] [client X] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_HEADERS. [file "/usr/local/apache2/conf/modsecurity/base_rules/modsecurity_crs_21_protocol_anomalies.conf"] [line "65"] [id "960009"] [rev "2.1.1"] [msg "Request Missing a User Agent Header"] [severity "NOTICE"] [tag "PROTOCOL_VIOLATION/MISSING_HEADER_UA"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "tilellit.pro"] [uri "/dev/joomla/[removed].xml"] [unique_id "WPNcGQoAQSEAABerhgkAAAK1"]
Labels |
Added:
?
|
Confirmed i'm taking care of that. Now we need to finde a creative useragent
Status | New | ⇒ | Closed |
Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2017-04-18 15:52:34 |
Closed_By | ⇒ | zero-24 |
Thread in the forum https://forum.joomla.org/viewtopic.php?f=715&t=949262