By aaronmeister on

I'm in the middle of developing a new redesign of a site and have been doing most of the development on a WAMP stack.

I've recently migrated the site to a development domain that I have using backup and migrate. The website functions perfectly with no issues, except when I want to either enable or disable a module. I've cleared the database several times and the results are the same and I always get this error:

Forbidden
You don't have permission to access /admin/modules/list/confirm on this server.

Apache/1.3.42 Ben-SSL/1.60 Server at www.clusterfunkmedia.com Port 80

Below is the log, which certainly points to a security issue, but I am not knowledgeable in some of the gobblygook:

[Mon Oct 22 20:21:14 2012] [error] [client 173.169.111.231] mod_security: Access denied with code 403. Pattern match "r57shell|cmd=(download_file|safe_dir|ftp_brute|mysql_dump|mail|db_show|mk|ch_)|ftp_mode|db_port|ftp_server_port|loc_file|new_name|s_text|php_eval|test[0-9]_file|(e_name|s_dir)=\\\\/usr\\\\/local|frmdt_|HTTP_SHELL|exec cmd[[:space:]]*=|_BEGIN_|_FIM_|exec[[:space:]]*\\\\(|system[[:space:]]*\\\\(|exit;|passthru|echo |\\\\.txt>|cd[[:space:]]+\\\\/|mkdir |;[[:space:]]*GET |;[[:space:]]*perl |lwp-request|wget |tclsh |telnet |curl |lynx |send-contactus=.*author_name=.*php" at POST_PAYLOAD [severity "EMERGENCY"] [hostname "www.clusterfunkmedia.com"] [uri "/admin/modules/list/confirm?render=overlay"] [unique_id "UIXi@n8AAAEAACHYPt4"]

I would really appreciate any help to get this cleared away so I can continue with the next step of development.

⋅ Categories: Drupal 7.x

Comments

vm’s picture

vm commented

safe mode should be disabled: http://drupal.org/requirements/php

you don't mention the version of PHP or MySQL. considering the the PHP build is using mod_security, I presume you are using a version less than 5.3 (recommended) for Drupal 7. mode_security is deprecated in PHP 5.3 and above.

deruitern’s picture

deruitern commented

The log entry indicates that the server has a web application firewall called ModSecurity installed. You will need to tune the firewall to allow Drupal to run properly, or look at disabling it.

aaronmeister’s picture

aaronmeister commented

MySQL database 5.1.54
PHP 5.2.17

This is currently an addon domain, which does not offer the same benefits as the primary domain, such as Apache 2 and php 5.3. I may have to just go ahead and get a full-blown new account, which might be better in the long run anyway.

Thanks for the help.