Hide SecruleEngine status options from users - Security Risk

[sahostking]

Hi

We don't like giving customers the option of disabling mod security as most customers would just disable the whole modsecuirty rather than just the particular rule giving them issues.

Is there a way we can do this and hide that feature from them?

 

[smtalk]

You may add CMD_MODSECURITY to never_commands list in directadmin.conf.

 

[sahostking]

Ok thanks

That looks like it takes it away from Admin swell so now we cannot disable rules. But only on OWASP

If I use comodo CWAF then all is fine as it has its own plugin feature we could use.

 

[smtalk]

Ok thanks

That looks like it takes it away from Admin swell so now we cannot disable rules. But only on OWASP

If I use comodo CWAF then all is fine as it has its own plugin feature we could use.

commands.deny and Feature sets are other ways to do it