@jesu-villawolf said in What are ModSecurity best practices?:

Hi @sandeep, I've got something else today, the server is running and working like a charm, but when I install ModSecurity and enable OWASP or COMODO rules, if I try to work in the site everything stops working properly... First 403, then Uploading files..., then database migration..., then wordpress...

What I did was to to white list some of the rules I was finding in ModSecurity log by its ID, for example:

SecRuleRemoveById 980130 SecRuleRemoveById 949110 SecRuleRemoveById 941100 SecRuleRemoveById 911100 SecRuleRemoveById 920350 SecRuleRemoveById 913100 SecRuleRemoveById 920280

I haven't even started to work full on the site, I'll I have been doing is setting it up and all these trouble......!!

My real question is how can I better handle ModSecurity, so all my sites don't get all these false positive?? is there a known false positive list, just to add and let it be?? Can I just white list IP's, my IP and the servers IP maybe??.

Thanks in advance.

PS (IT'S UNINSTALLED FOR NOW..!!)

We work with the rules of comodo and what we do is teach customers to disable rules that affect them. So far we have no problems and they are managing themselves

@sandeep It has worked for me. Thank you!

@legend this can't be done via support forum you need to check this with the developer they should make varnish vcl file which need to support vhosts/sni system.

alternatively you can try php redis cache with magento which is way better than varnish.

@jesu-villawolf
here is the guide for creating swap.
https://www.mysterydata.com/create-and-add-swap-on-linux-os-cwp-centos-webpanel-and-vesta-cp/

swap doesn't harm anything ensure your disk read/write speed is above 100mbps for optimal performance all things will work like normal.

@legend said in magento 2.4 installation on cwp query:

@sandeep centos 7

in 7 that command runs perfectly. Try alternative command.

@josepp said in Php 8 in CWP:

@sandeep It seems that on the 26th they are going to release the stable version. You know we would be very happy to have this on CWP.

https://forum.mysterydata.com/topic/81/php-8-0-0-testing-cwp

many extensions are not yet compatible with php 8 like imagick, memcache, ssh2, ioncube etc. I'll post the installation instruction in my blog without 3rd party pecl extensions.

in CWP php 8 will be added after some time when this incompatible extensions get updates.

@legend said in magento sample deployment error:

: Connection timed out

Connection timed out means something is blocking connection possible backend firewall.

disable all firewall including csf and check.

@sandeep Hello!

I'm back with news!

After trying all these days, it seems that the web is working properly.

Thank you very much from your fans! P hahahaha

@legend hi centos 8 CWP have latest version of varnish 6

@legend you can use both webserver nginx + apache and elastic search is completely depends on script side compatibility its nothing to do with webservers.

here you can find some example :
https://www.mysterydata.com/how-to-install-magento-2-4-in-cwp-control-web-panel/

@legend its very tricky to configure magento varnish template in cwp, instead you can use redis cache which will also speed up magento

@vfeinbox it should be added in /etc/nginx/nginx.conf

remove this line : and restart vesta service

# Pagespeed pagespeed on; pagespeed FileCachePath /var/ngx_pagespeed_cache; location ~ "\.pagespeed\.([a-z]\.)?[a-z]{2}\.[^.]{10}\.[^.]+" { add_header "" ""; } location ~ "^/ngx_pagespeed_static/" { } location ~ "^/ngx_pagespeed_beacon" { }

@sandeep

http://prntscr.com/vi80wp

yes it is now, thank you very much;)

@sandeep
Thank you

@choqo yes it will auto install redis or memcached depends on selection check the service status.

finally found the solution :

run this commands one by one and it will get resolved remove any config done previously to /usr/lib/systemd/system/clamd.service

service clamd stop && service amavisd stop sed -i 's/TimeoutStartSec.*/TimeoutStartSec=10min/' /usr/lib/systemd/system/clamd.service systemctl daemon-reload service clamd start && service amavisd start

it will be included in clamd fix script in cwp soon

@josepp well you need to pass the script to bash/sh and add echo tail in log and add refresh meta to show the log viewer i.e. update the log according to your time defined in meta.