Random HTTP 403 Errors

Random HTTP 403 Errors

ved Raymond Frangie -
Antal besvarelser: 3

Latest Version and Build of Moodle (3.5 20180628) and I'm getting these random 403 errors. Forcing a refresh on the page using Ctrl+F5 tends to load the page properly. I see there has been a solution since some posts in 2008 of disabling Apache's SecFilterEngine but this is an extremely poor answer.

Attn: Moodle Developers! Please provide a proper response without lowering security to fix this 403 Issue...

The answer of the following code block in a .htaccess file, although may fix the problem, is unacceptable.

<ifmodule mod_security.c>
    SecFilterEngine Off
    SecFilterScanPOST Off
</ifmodule>

Thanks in Advance,

Ray

Gennemsnitsbedømmelse: -
I svar til Raymond Frangie

Re: Random HTTP 403 Errors

ved Dan Marsden -
Billede af Core developers Billede af Particularly helpful Moodlers Billede af Peer reviewers Billede af Plugin developers Billede af Plugins guardians Billede af Testers Billede af Translators

Moodle is quite a complex piece of software and as you have found isn't compatible with many tools like mod_security out of the box. There are probably a number of rules within mod_security that you can tweak to allow Moodle to function while mod_security is enabled but I am not aware of anyone that has spent the time compiling a list of the different settings that need to be modified - most people just give up and disable it. Many of the issues with mod_security relate to "features" in Moodle that cannot be easily designed to meet mod_security's default rule set without decreasing the functionality or completely removing the feature.

If mod_security is really important to your site you might consider spending some time searching the forums for people that have modified other settings and you may want to experiment with the mod_security settings yourself. If you manage to compile a list of configuration changes please make sure you share them with the community so that others may benefit.

Alternatively if you continue to have issues hosting your Moodle site you might consider asking a Moodle Partner to help with hosting or managing the hosting of your site.

Gennemsnitsbedømmelse: -
I svar til Raymond Frangie

Re: Random HTTP 403 Errors

ved Dave Ball -
Did you find a solution to this issue?
Gennemsnitsbedømmelse: -
I svar til Dave Ball

Re: Random HTTP 403 Errors

ved Raymond Frangie -

Hi Guys,

Apologies on the delay and thanks for the responses.

Yep, the issue was that Moodle is triggering the default configuration of mod_evasive for Apache. mod_evasive is a DoS Protection module.

Relaxing the configuration slightly has stopped the 403's from occurring.

For those interested, the following is our configuration, inside /etc/apache2/mods-enabled/evasive.conf

<IfModule mod_evasive20.c>
    DOSHashTableSize    5000
    DOSPageCount    10
    DOSSiteCount    100
    DOSPageInterval    1
    DOSSiteInterval    1
    DOSBlockingPeriod    10

    DOSEmailNotify    email@address.com
    DOSSystemCommand    whatever_command_you_want
    DOSLogDir    "/var/log/mod_evasive"
</IfModule>


Hope this helps?

Cheers,

Ray


Gennemsnitsbedømmelse:Useful (1)