1 Topic by torbz (edited by torbz 2007-07-18 14:38)

  • Registered: 2007-07-17
  • Posts: 10

Topic: mod_security, 406 error and htaccess files

Hi there,

I've read up on all of the troubleshooting topics regarding this issue. I just wanted to catalogue the progress with my ISP (webfusion/pipex uk) as I've challenged them to find the problem.

I sent this after explaining my problem and they asked for the control panel login on the forum:


***E-mail 1***
Dear Pipiex/Webfusion support,
In reply to your request you can replicate my problem, log in to the forum installation as:
(www.newagenet.co.uk/hangfan/forum)
User: *******
Pass: *******
Then click on "user list" (2nd option in top menu) Select the user "hammertime" (4th name listed) Then click on "Administration" in the left hand vertical menu.
From there you should be able assign account type (user, moderator etc.) or delete/ban them

When you attempt any of these actions, the server throws up a 406 error, stating the resource cannot be found.

Searching on the net reveals a possible mod_security setting that may interfere with this sort of http operation.
I'm merely regurgitating stuff here, I have no experience in this area (as yet!).

I hope this helps resolve the problem,

Take care,

Torbz
***************

They then replied:


***REPLY 1****
Hi,

When you attempt to delete a user or any of teh actions as you have stated you receive a 406 error as the file it is looking for to action the delete command wither has become corrupted or it can't find teh command in the script.

It is looking for:

/hangfan/forum/profile.php

You can check the forums on teh internet for this error, can youy please confirm when you first received this error. We have not carried out any php updates or upgrades in the last few weeks so this should not be the cause. Please also check teh file permissionns for the above file as they should be 755.

If you can provide further information on this we can try to help you reolve this or provide further information for you to try.

Regards

Minesh Patel
WebFusion 2nd Line Support
PIPEX
********************

I basically then told them that the issue wasn't punBB and definitely the mod_security settings and that they should look in to it further.

They replied:

****Reply 2****
Hi,

Thank you for your email.

We do run Mod_security on the server, if you could let us know the page you are having problems with we can ask the engineers to adjust the rules for you.

In the meantime you can turn mod_security off by adding a .htaccess file with the following line.

SetEnv MODSEC_ENABLE "Off"

I hope that this helps.

Regards,

Keith Boyd
Webfusion 2nd Line Support
PIPEX
*************

So, I fiddled about for half an hour with their code, then looked into it further and tried all sorts of variations including:

SecFilterEngine Off
SecFilterScanPOST Off

which I'd found on other forums regarding similar mod_security issues.

none of it worked, despite me putting the .htaccess code in all the directories I could think of (root, the hangfan sub-directory and the forum sub directory).

Has anyone any advice on how to go forward? I've since sent them an e-mail saying it doesn't work and we'll see what reply comes, but never having heard of mod_security before, I'm left with too steep a learning curve to know what to do next.

Help and advice appreciated greatly!

thanks,

torbz
www.hangfan.co.uk
PunBB installation at www.hangfan.co.uk/forum

  • From: Leuven, Belgium
  • Registered: 2005-06-14
  • Posts: 2,653

Re: mod_security, 406 error and htaccess files

Switch host. Honestly, a support staff with such horrible spelling shouldn't be allowed to exist. It sounds like a bunch of 13 year olds.
I do think their code should work though, if written properly

SetEnv MODSEC_ENABLE "Off"

3 Reply by torbz

  • Registered: 2007-07-17
  • Posts: 10

Re: mod_security, 406 error and htaccess files

Is that the only line I should have in my htaccess file and should it be in the forum root folder?

I agree with the shoddy english situation but that's the free market for you...

The 2nd guy who replied seemed to have a better command of English!

I will try again (I did spot the &quot problem and did try it in the correct format). Still no luck though.

Will try again now.

Thanks,
torbz

4 Reply by torbz

  • Registered: 2007-07-17
  • Posts: 10

Re: mod_security, 406 error and htaccess files

Nope didn't make an ounce of difference. Still getting the same old....

  • From: Leuven, Belgium
  • Registered: 2005-06-14
  • Posts: 2,653

Re: mod_security, 406 error and htaccess files

Well, I would try replying back to him then. He seemed somewhat willing to help.
Do you have access to your access_log? If so, copy the lines where error 406 occurs (it's easy enough smile) and mail him.

6 Reply by torbz (edited by torbz 2007-07-18 15:46)

  • Registered: 2007-07-17
  • Posts: 10

Re: mod_security, 406 error and htaccess files

Well, I've written back a few hours ago, so we'll see what comes of it.
Have found log file and will scan through it now.

Found one line...among a dazzling myriad of data:
http://www.newagenet.co.uk/hangfan/foru … e.php?id=4 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+InfoPath.2;+.NET+CLR+1.1.4322)
www.newagenet.co.uk 82.153.65.208 - 2007-07-18 16:28:04 POST /hangfan/forum/profile.php section=admin&id=4&action=foo 406 276

Dunno if it would tell them anything new, but have sent it.

If you have a better suggestion for european based hosting with a 60gb + traffic, 6GB hdd space & 1500 e-mail account package, let me know.
I pay around £15 (~25 euros) a month currently on a shared linux/apache server package.

Thanks again for your speedy help too,

torbz

  • Smartys
  • Former PunBB Developer
  • Offline
  • Registered: 2004-04-30
  • Posts: 7,844

Re: mod_security, 406 error and htaccess files

It does sound like a bad mod_security rule

8 Reply by torbz (edited by torbz 2007-07-25 17:05)

  • Registered: 2007-07-17
  • Posts: 10

Re: mod_security, 406 error and htaccess files

The reply came...

****reply 3****
Hi,

Please can you provide the specific rule that needs removing and we can do this for you which should fix this issue.

Regards,

Matthew James
WebFusion 2nd Line Support
PIPEX
***************

to which I candidly replied:

Hi Matthew (or whoever gets this!)

If I had known what mod_security was all about, I might be able to help. However, I was relying on your tech support team to know where the issue lies.
I have given you all of the information required to replicate the problem, and it shouldn't take too much effort to find out what rule is causing the block.

I'd never heard of mod_security before this problem...so I'm definitely the wrong person to be asking!

Could you take the time to follow the steps I included in my previous e-mails, and find out what is going on?

Thank you


They then came back with@

****rpley 4****

Hi,

As previously mentioned, we do not know which mod_security rule needs removing in order for this to work.

The best thing to do would be to contact the software vendor or ask on their website/forum.

Regards,

Matthew James
WebFusion 2nd Line Support
PIPEX


***********

So, that, it seems, is that....they're not willing to help.

Does anyone know what mod_security rule does need to be changed?

thanks for any help!

Torbz

  • Smartys
  • Former PunBB Developer
  • Offline
  • Registered: 2004-04-30
  • Posts: 7,844

Re: mod_security, 406 error and htaccess files

No, since we don't have access to their ruleset or know what rule is being triggered. Could you ask them to check their logs and see what mod_security rule is triggering your errors?

  • Registered: 2007-08-24
  • Posts: 1

Re: mod_security, 406 error and htaccess files

Hi Torbz
I seem to be going through the exact same thing with webfusion. In my case whilst trying to install shopping cart software. Are they deliberately obfuscating? I wonder if there are more people out there who just give up - and I wonder if that is just what they want?

11 Reply by Utchin

  • Utchin
  • PunBB senior member
  • Offline
  • Registered: 2007-02-09
  • Posts: 760

Re: mod_security, 406 error and htaccess files

optimistic wrote:

Hi Torbz
I seem to be going through the exact same thing with webfusion. In my case whilst trying to install shopping cart software. Are they deliberately obfuscating? I wonder if there are more people out there who just give up - and I wonder if that is just what they want?

Switch host. I had to switch host as i was geting a punbb error. never round out.

Im sure we would and could find out the errors if we had access to a shot that dint work.

but we dont

Sorry. Unactive due to personal life.