store | blogs | forums | twitter | facebook | wiki | mailing lists | downloads | support portal
Atomic Secure Linux
It is currently Wed May 22, 2013 8:06 pm

» Feed - Atomicorp

All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic Share/Bookmark  [ 5 posts ] 
Author Message
 Post subject: Googlebot
Unread postPosted: Sun Jul 31, 2011 7:55 am 
Offline
Forum User
Forum User

Joined: Fri May 06, 2011 8:16 pm
Posts: 99
Location: UK
Hi I had a similar trigger last week which I submitted a false positive for but its happened again and Google are penalising our sites as they cant crawl and seo is very much a part of what we do.

This hostname got blanked = crawl-66-249-67-201.googlebot.com

The false positive ID is

Time: July 31, 2011 08:04:45
Rule: 60128 - (null)

Is it possible to allow Google bot to do its thing with bar ?

Cheers


Top
 Profile  
 
 Post subject: Re: Googlebot
Unread postPosted: Sun Jul 31, 2011 12:47 pm 
Offline
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
User avatar

Joined: Thu Feb 07, 2008 7:49 pm
Posts: 3245
Location: Chantilly, VA
Quote:
The false positive ID is

Time: July 31, 2011 08:04:45
Rule: 60128 - (null)


Thank you the report, we are sorry to hear that you have run into a false positive but do appreciate you reporting it to us. We will get this resolved for you quickly.

To help us to determine the cause of this problem, we need a little more information. Although you have provided use with the time and rule ID for this event, this does not provide us with any of the information we need to help you with this problem. We require the modsecurity audit records for each event to see why this occurred.

We have written up a procedure to help you provide this information to us, and you can find it it here:

https://www.atomicorp.com/wiki/index.ph ... _Positives

If you could kindly follow that procedure and send us the information described there, we can get a fix for your issue out to you quickly.

Thank you in advance.

_________________
Michael Shinn
Atomicorp - Security For Everyone

Co-Author of Troubleshooting Linux Firewalls.


Top
 Profile  
 
 Post subject: Re: Googlebot
Unread postPosted: Sun Jul 31, 2011 2:58 pm 
Offline
Forum User
Forum User

Joined: Fri May 06, 2011 8:16 pm
Posts: 99
Location: UK
Hello Mike,

I submitted the false positive and i can see it in the support case portal.

Its numbered 9471 and I submitted the false positive through ASL earlier on today.

I will pm you the output I can see.

Thanks


mikeshinn wrote:
Quote:
The false positive ID is

Time: July 31, 2011 08:04:45
Rule: 60128 - (null)


Thank you the report, we are sorry to hear that you have run into a false positive but do appreciate you reporting it to us. We will get this resolved for you quickly.

To help us to determine the cause of this problem, we need a little more information. Although you have provided use with the time and rule ID for this event, this does not provide us with any of the information we need to help you with this problem. We require the modsecurity audit records for each event to see why this occurred.

We have written up a procedure to help you provide this information to us, and you can find it it here:

https://www.atomicorp.com/wiki/index.ph ... _Positives

If you could kindly follow that procedure and send us the information described there, we can get a fix for your issue out to you quickly.

Thank you in advance.


Top
 Profile  
 
 Post subject: Re: Googlebot
Unread postPosted: Sun Jul 31, 2011 3:51 pm 
Offline
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
User avatar

Joined: Thu Feb 07, 2008 7:49 pm
Posts: 3245
Location: Chantilly, VA
Quote:
I submitted the false positive and i can see it in the support case portal.

Its numbered 9471 and I submitted the false positive through ASL earlier on today.


Thank you, yes I see it. It looks like an apache 403 error, and not a modsecurity event. Thats generally either an actual apache error like permissions, or perhaps something apache is configured to not allow (index directories, etc.). Do you see any details in your apache logs about what apache is not allowing?

_________________
Michael Shinn
Atomicorp - Security For Everyone

Co-Author of Troubleshooting Linux Firewalls.


Top
 Profile  
 
 Post subject: Re: Googlebot
Unread postPosted: Tue Aug 02, 2011 10:37 pm 
Offline
Forum User
Forum User

Joined: Fri May 06, 2011 8:16 pm
Posts: 99
Location: UK
Hi I had a good look a this and its seems it was a apache configuration issue as the domain did not have an index file and the indexing of the directory was not allowed hence the error given to Google.

Its definitely not a ASL issue as I just rectified and hopefully when they come back tomorrow it will be all good.

On a side note I actually learned from this how to really control the rules which has helped me understand this all a little bit more.

After going through all the red flags that cropped up and editing the rules I realise the amount of power ASL can give.

Sorry for the false alarm gentlemen and ladies if your in the house ;0)

Good stuff !!


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic Share/Bookmark  [ 5 posts ] 

» Feed - Atomicorp

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 0 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group