SecServerSignature "Apache"
SecFilterScanPOST On

# Require Content-Length to be provided with every POST request
SecFilterSelective REQUEST_METHOD "^POST$" chain
SecFilterSelective HTTP_Content-Length "^$"

# Don't accept transfer encodings we know we don't handle (and you don't need it anyway)
SecFilterSelective HTTP_Transfer-Encoding "!^$"

SecFilterSelective ARGS_VALUES "[[:space:]](cc|bcc|to)[[:space:]]*\:.*\@"

# Protecting from XSS attacks through the PHP session cookie
SecFilterSelective ARG_PHPSESSID "!^[0-9a-z]*$"
SecFilterSelective COOKIE_PHPSESSID "!^[0-9a-z]*$"

SecFilter "viewtopic\.php\?" chain
SecFilter "chr\(([0-9]{1,3})\)"

SecFilterSelective REQUEST_URI "(cd[[:space:]]+.+|echo[[:space:]]+.+|perl[[:space:]]+.+|python[[:space:]]+.+|rpm[[:space:]]+.+|lynx[[:space:]]+.+|links[[:space:]]+.+|mkdir[[:space:]]+.+|elinks[[:space:]]+.+|wget[[:space:]]+.+|(s|r)(cp|sh)[[:space:]]+.+|net(stat|cat)[[:space:]]+.+|rexec[[:space:]]+.+|smbclient[[:space:]]+.+|t?ftp[[:space:]]+.+|(nc)?ftp[[:space:]]+.+|curl[[:space:]]+.+|telnet[[:space:]]+.+|gcc\s+.+|cc[[:space:]]+.+|g\+\+[[:space:]]+.+|system\(|exec\(|uname[[:space:]]+-a|\.htgroup|\.htaccess|///cgi-bin|/cgi-bin///|/~root|/~ftp|/~nobody|<script)"

SecFilter "javascript\://"
SecFilter "_PHPLIB\[libdir\]"

SecFilterSelective THE_REQUEST "/htgrep" chain
SecFilter "hdr=/"

#SecFilterDefaultAction "pass,exec:/home/modsec.php"

# WEB-ATTACKS wget command attempt
SecFilterSelective THE_REQUEST "wget "

# WEB-ATTACKS uname -a command attempt
SecFilterSelective THE_REQUEST "uname -a"

# WEB-ATTACKS .htgroup access
SecFilterSelective THE_REQUEST "\.htgroup"

# WEB-ATTACKS .htaccess access
SecFilterSelective THE_REQUEST "\.htaccess"

# WEB-CLIENT Javascript URL host spoofing attempt
SecFilter "javascript\://"

# WEB-MISC cross site scripting \(img src=javascript\) attempt
SecFilter "img src=javascript"

# WEB-MISC cd..
SecFilterSelective THE_REQUEST "cd\.\."

# WEB-MISC ///cgi-bin access
SecFilterSelective THE_REQUEST "///cgi-bin"

# WEB-MISC /cgi-bin/// access
SecFilterSelective THE_REQUEST "/cgi-bin///"

# WEB-MISC /~root access
SecFilterSelective THE_REQUEST "/~root"

# WEB-MISC /~ftp access
SecFilterSelective THE_REQUEST "/~ftp"

# WEB-MISC htgrep attempt
SecFilterSelective THE_REQUEST "/htgrep" chain
SecFilter "hdr=/"

# WEB-MISC htgrep access
SecFilterSelective THE_REQUEST "/htgrep" log,pass

# WEB-MISC .history access
SecFilterSelective THE_REQUEST "/\.history"

# WEB-MISC .bash_history access
SecFilterSelective THE_REQUEST "/\.bash_history"

# WEB-MISC /~nobody access
SecFilterSelective THE_REQUEST "/~nobody"

# WEB-PHP PHP-Wiki cross site scripting attempt
SecFilterSelective THE_REQUEST "<script"

# WEB-PHP strings overflow
SecFilterSelective THE_REQUEST "\?STRENGUR"

# WEB-PHP PHPLIB remote command attempt
SecFilter "_PHPLIB\[libdir\]"

/var/log/bfd.log

 bfd -a

MAILTO=
SHELL=/bin/sh
*/10 * * * * root /usr/local/sbin/bfd -q >> /var/log/bfd.log

BFD version 0.9 <bfd@r-fx.org>
Copyright (C) 1999-2004, R-fx Networks <proj@r-fx.org>
Copyright (C) 2004, Ryan MacDonald <ryan@r-fx.org>
This program may be freely redistributed under the terms of the GNU GPL

24.158.60.76 sshd
24.171.128.253 sshd
24.226.127.215 sshd
59.120.43.88 sshd
61.144.224.28 sshd
61.172.192.3 sshd
61.178.20.170 sshd
61.219.198.34 sshd
61.233.28.130 sshd
62.111.189.167 sshd
62.194.80.137 sshd
64.251.14.182 sshd
66.147.238.14 sshd
66.221.67.64 sshd
67.127.61.253 sshd
68.228.218.72 sshd
69.144.172.111 sshd
80.53.131.30 sshd
83.228.113.166 sshd
85.41.39.34 sshd
134.241.2.218 sshd
151.8.3.179 sshd
194.228.71.66 sshd
200.155.52.143 sshd
200.85.41.90 sshd
201.51.165.241 sshd
202.108.13.91 sshd
203.131.132.66 sshd
203.158.191.6 sshd
203.200.93.135 sshd
203.43.65.189 sshd
206.40.148.132 sshd
206.51.238.182 sshd
209.160.64.51 sshd
210.228.173.152 sshd
211.125.77.65 sshd
211.154.205.252 sshd
211.162.74.225 sshd
211.21.74.146 sshd
213.98.51.34 sshd
216.193.225.138 sshd
216.227.243.105 sshd
216.97.49.226 sshd
217.160.130.123 sshd
217.172.181.107 sshd
218.189.146.172 sshd
218.87.6.201 sshd
219.129.237.66 sshd
219.133.55.47 sshd
221.254.107.187 sshd