CWAF Blocking BackupBuddy Send

Sending files remotely to iThemes Stash is being blocked by CWAF. The only error that appeared was 16767. I excluded that rule and it didn’t fix the problem.

I still don’t know what rule is causing this, but I know it is within cwaf_05.conf. I figured this out by wiping the contents of each file until the remote connection worked again. If anyone knows which rule would be causing this, I would be most appreciative to know.

Other rules I’ve run into that were being blocked in WordPress are as follows: 12015 12014 15500 19901 20020 19900 11000 11071 11070 16413 11085

Very Best,

Corey

Thank you for your feedback.

Please provide your log files. You can PM me if your logs contains sensitive data.

Please forgive my ignorance here, but I’m not sure where they are located. Let me know and I’ll grab a copy.

Thanks,

~ Corey

Where did you get info about rules 12015 12014 15500 19901 20020 19900 11000 11071 11070 16413 11085? Possible there are should be logs also. That coud be /var/logs/httpd/

I got those rules from the Mod_Security readout in WHM.

I uninstalled everything so I could try to the the CPanel Agent working. (It installed before, but threw errors in the UI.) If there were logs, I’m guessing they are gone now.

Unfortunately, I still can’t get the agent re-installed at all now. I created another post about that.

As for BackupBuddy getting “Blocked”. It turns out that the reason the remote file sends were getting blocked is because NL was banned from the server. Apparently iThemes uses a server there for “Stash”. That was news to me.

If I can get this installed again I will keep an eye out for those rules getting flagged and send the logs - no problem.

Thanks,

~ Corey

New rules Version 0.35 released.