skwokie's questions

I'm trying to debug some network connection issues and I see:

systemd-timesyncd: Network configuration changed, trying to establish connection.

in syslog. I've tried to google it but I can't find a good definition of it. Is it something I need to worry about? Is the configuration change only in the context of timesyncd? Thanks.

I've installed nginx with modsec with the following versions:

Modsec verion: v3.0.3
Nginx version: 1.13.6

and I've excluded rule 933160 as followed:

SecRule REQUEST_URI "@beginsWith /a/b/c/d" \
        "phase:2,log,pass,id:20501,ctl:ruleRemoveById=933160"

however, the rule still triggers the following warning:

ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:e(?:t(?:_(?:e(?:xception|rror)_handler|magic_quotes_runtime|include_path)|defaultstub)|ssion_s(?:et_save_handler|tart))|qlite_(?:(?:(?:unbuffered|single|array)_)?query|create_(?:aggregate (2095 characters omitted)' against variable `ARGS:9ce92bb7' (Value: `<TitleBarStyle size='14'> <text xpos='6'>AcmeCorp John</text> <text xpos='6' ypos='16'>206-596-7084< (156 characters omitted)' ) [file "/usr/local/owasp-modsecurity-crs-3.0.2/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "311"] [id "933160"] [rev "1"] [msg "PHP Injection Attack: High-Risk PHP Function Call Found"] [data "Matched Data: eval($sys.hidetabs?@dispW,($sys.ntabs==4)?@lkpg1,@lkpg1v2) found within ARGS:9ce92bb7: <TitleBarStyle size='14'> <text xpos='6'>AcmeCorp John</text> <text xpos='6' ypos='16'>206-596-7084</text> <Notifications list='*' width='$eval($sys.hidetabs?@dispW,($sys.ntabs==4)?@lkpg1,@lkpg1v2)' align='right' xpos='0'> </Notifications> </TitleBarStyle>"] [severity "2"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "OWASP_CRS/WEB_ATTACK/PHP_INJECTION"] [tag "OWASP_TOP_10/A1"] [hostname "172.18.0.2"] [uri "/a/b/c/d"] [unique_id "159354754554.932910"] [ref "o139,58v77,256"]

Can someone please help and point out what I've missed anything?

I've the following logs rotation set up in the OS for nginx's and modsec's logs, and it works for nginx's logs but not for modsec's. The result for modsec is that, it made a copy for the log file but it keeps on writing to the old one as followed:

-rw-r--r-- 1 root root 26996998524 Apr 30 12:00 modsec_debug.log.1
drwxr-xr-x 3 root root        4096 Apr 29 10:31 .
-rw-r--r-- 1 root root           0 Apr 29 10:31 modsec_debug.log

Can someone please tell me what I've missed? Other than 'kill -USR1 cat /var/run/nginx.pid', should I run something else? Please note that the nginx is running inside a container and I have this volume mapping: /var/log/nginx:/usr/local/openresty/nginx/logs

Other info: openresty: 1.13.6.2 Modsec: 3.0.3 Os version: Ubuntu 18.04.3 LTS

/var/log/nginx/*.log {
        daily
        missingok
        rotate 14
        compress
        delaycompress
        notifempty
        create 0640 root root
        maxsize 500M
        minsize 500M
        sharedscripts
        prerotate
                if [ -d /etc/logrotate.d/httpd-prerotate ]; then \
                        run-parts /etc/logrotate.d/httpd-prerotate; \
                fi \
        endscript
        postrotate
                docker exec www-proxy /bin/sh -c 'kill -USR1 `cat /var/run/nginx.pid`'
        endscript
}

/var/log/nginx/modsec/*.log {
        daily
        missingok
        rotate 14
        compress
        delaycompress
        notifempty
        create 0640 root root
        maxsize 500M
        minsize 500M
        sharedscripts
        prerotate
                if [ -d /etc/logrotate.d/httpd-prerotate ]; then \
                        run-parts /etc/logrotate.d/httpd-prerotate; \
                fi \
        endscript
        postrotate
                docker exec www-proxy /bin/sh -c 'kill -USR1 `cat /var/run/nginx.pid`'
        endscript
}

Thanks.

When I use nc to test a port as followed, it prints out a result with '(?)' in it. I've looked up the man page and also online but I can't find an answer. Can someone please shed some lights? Thanks.

# nc -v -u -w 3 localhost 10003
localhost [127.0.0.1] 10003 (?) open

I have netcat-traditional 1.10-41.1

I've installed openssl-3 inside my php-apache Docker container and I'd like to configure Apache to use openssl-3. Can someone please tell me how?

• openssl-3: installed from https://github.com/openssl/openssl, master branch
• Docker container: php:7.0.32-apache (https://hub.docker.com/_/php)
• Apache version: 2.4.25

Thanks!