Squid: Problem blacklisted by some sites due to empty headers for HTTP requests

Questions to IPFire Addons.
Post Reply
tikok974
Posts: 77
Joined: January 3rd, 2017, 9:53 am

Squid: Problem blacklisted by some sites due to empty headers for HTTP requests

Post by tikok974 » March 22nd, 2017, 7:30 am

Hi everybody,

Because of empty Headers in our HTTP requests we have been blacklisted on our own site by our host. Here are the errors found on the server hosting the site:

Code: Select all

...
[Tue Mar 21 16:54:13 2017] [error] [client 82.174.149.84] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_HEADERS. [file "/opt/apache/conf/mods/modsecurity/modsecurity_myprovider_91_bruteforce.conf"] [line "164"] [msg "getslash_no_ua"] [hostname "www.mysite.fr"] [uri "/"] [unique_id "WNFMpVOmihYAAANZUB4AAAAa"]
...
...
I tried setting this setting :

Code: Select all

request_header_access User-Agent allow all
...in "/var/ipfire/proxy/advanced/acls/include.acl" and restarted Squid from the interface. The setting is well taken into account in "/etc/squid/squid.conf" but that does not change anything and my problem persists.

Can someone help me ?
thank you very much

juliejohn
Posts: 2
Joined: July 18th, 2019, 8:14 am
Contact:

Re: Squid: Problem blacklisted by some sites due to empty headers for HTTP requests

Post by juliejohn » July 18th, 2019, 8:34 am

I think you should revisit the host file and also modify index file of the website which is blacklisted.

tikok974
Posts: 77
Joined: January 3rd, 2017, 9:53 am

Re: Squid: Problem blacklisted by some sites due to empty headers for HTTP requests

Post by tikok974 » July 18th, 2019, 10:32 am

juliejohn wrote:
July 18th, 2019, 8:34 am
I think you should revisit the host file and also modify index file of the website which is blacklisted.
Hi Juliejohn,

Thanks for your reply but I don't understand what you're trying to explain to me !

Thanks

User avatar
Arne.F
Core Developer
Core Developer
Posts: 8522
Joined: May 7th, 2006, 8:57 am
Location: BS <-> NDH
Contact:

Re: Squid: Problem blacklisted by some sites due to empty headers for HTTP requests

Post by Arne.F » July 18th, 2019, 3:08 pm

Are you sure that this is caused by squid?

Sounds more like an IPS Rule that blocks the used User-Agent wich terminate the connection if it match.
Arne

Support the project on the donation!

Image

Image

Image
PS: I will not answer support questions via email and ignore IPFire related messages on my non IPFire.org mail addresses.

Post Reply