Random HTTP 403 Errors

Random HTTP 403 Errors

eftir Raymond Frangie -
Number of replies: 3

Latest Version and Build of Moodle (3.5 20180628) and I'm getting these random 403 errors. Forcing a refresh on the page using Ctrl+F5 tends to load the page properly. I see there has been a solution since some posts in 2008 of disabling Apache's SecFilterEngine but this is an extremely poor answer.

Attn: Moodle Developers! Please provide a proper response without lowering security to fix this 403 Issue...

The answer of the following code block in a .htaccess file, although may fix the problem, is unacceptable.

<ifmodule mod_security.c>
    SecFilterEngine Off
    SecFilterScanPOST Off
</ifmodule>

Thanks in Advance,

Ray

Average of ratings: -
In reply to Raymond Frangie

Re: Random HTTP 403 Errors

eftir Dan Marsden -
Mynd av Core developers Mynd av Particularly helpful Moodlers Mynd av Peer reviewers Mynd av Plugin developers Mynd av Plugins guardians Mynd av Testers Mynd av Translators

Moodle is quite a complex piece of software and as you have found isn't compatible with many tools like mod_security out of the box. There are probably a number of rules within mod_security that you can tweak to allow Moodle to function while mod_security is enabled but I am not aware of anyone that has spent the time compiling a list of the different settings that need to be modified - most people just give up and disable it. Many of the issues with mod_security relate to "features" in Moodle that cannot be easily designed to meet mod_security's default rule set without decreasing the functionality or completely removing the feature.

If mod_security is really important to your site you might consider spending some time searching the forums for people that have modified other settings and you may want to experiment with the mod_security settings yourself. If you manage to compile a list of configuration changes please make sure you share them with the community so that others may benefit.

Alternatively if you continue to have issues hosting your Moodle site you might consider asking a Moodle Partner to help with hosting or managing the hosting of your site.

Average of ratings: -
In reply to Raymond Frangie

Re: Random HTTP 403 Errors

eftir Dave Ball -
Did you find a solution to this issue?
Average of ratings: -
In reply to Dave Ball

Re: Random HTTP 403 Errors

eftir Raymond Frangie -

Hi Guys,

Apologies on the delay and thanks for the responses.

Yep, the issue was that Moodle is triggering the default configuration of mod_evasive for Apache. mod_evasive is a DoS Protection module.

Relaxing the configuration slightly has stopped the 403's from occurring.

For those interested, the following is our configuration, inside /etc/apache2/mods-enabled/evasive.conf

<IfModule mod_evasive20.c>
    DOSHashTableSize    5000
    DOSPageCount    10
    DOSSiteCount    100
    DOSPageInterval    1
    DOSSiteInterval    1
    DOSBlockingPeriod    10

    DOSEmailNotify    email@address.com
    DOSSystemCommand    whatever_command_you_want
    DOSLogDir    "/var/log/mod_evasive"
</IfModule>


Hope this helps?

Cheers,

Ray


Average of ratings:Useful (1)