Userdata files not working

Hello,

We have issues with useragent files not working.

For example we have blocked some agents:

Put your User-Agent blacklist here

MJ12bot
AhrefsBot

I see those also in this file:
/var/cpanel/cwaf/etc/userdata/userdata_bl_agents

Apache is checking this .conf file:
/var/cpanel/cwaf/etc/cwaf.conf ?

Inside that file I see these:
Include /var/cpanel/cwaf/rules/.conf
Include /var/cpanel/cwaf/etc/httpd/domains/
.conf
Include /var/cpanel/cwaf/etc/httpd/global/*.conf
Include /var/cpanel/cwaf/etc/httpd/custom_user.conf

When checking /var/cpanel/cwaf/rules/ I see symlink to userdata files:
lrwxrwxrwx 1 root root 48 Jan 22 14:38 userdata_bl_agents → /var/cpanel/cwaf/etc/userdata/userdata_bl_agents
lrwxrwxrwx 1 root root 49 Jan 22 14:38 userdata_bl_cookies → /var/cpanel/cwaf/etc/userdata/userdata_bl_cookies
lrwxrwxrwx 1 root root 49 Jan 22 14:38 userdata_bl_domains → /var/cpanel/cwaf/etc/userdata/userdata_bl_domains
lrwxrwxrwx 1 root root 52 Jan 22 14:38 userdata_bl_extensions → /var/cpanel/cwaf/etc/userdata/userdata_bl_extensions
lrwxrwxrwx 1 root root 49 Jan 22 14:38 userdata_bl_headers → /var/cpanel/cwaf/etc/userdata/userdata_bl_headers
lrwxrwxrwx 1 root root 45 Jan 22 14:38 userdata_bl_IPs → /var/cpanel/cwaf/etc/userdata/userdata_bl_IPs
lrwxrwxrwx 1 root root 50 Jan 22 14:38 userdata_bl_referers → /var/cpanel/cwaf/etc/userdata/userdata_bl_referers
lrwxrwxrwx 1 root root 46 Jan 22 14:38 userdata_bl_URLs → /var/cpanel/cwaf/etc/userdata/userdata_bl_URLs
lrwxrwxrwx 1 root root 50 Jan 22 14:38 userdata_login_pages → /var/cpanel/cwaf/etc/userdata/userdata_login_pages
lrwxrwxrwx 1 root root 48 Jan 22 14:38 userdata_wl_agents → /var/cpanel/cwaf/etc/userdata/userdata_wl_agents
lrwxrwxrwx 1 root root 54 Jan 22 14:38 userdata_wl_content_type → /var/cpanel/cwaf/etc/userdata/userdata_wl_content_type
lrwxrwxrwx 1 root root 49 Jan 22 14:38 userdata_wl_domains → /var/cpanel/cwaf/etc/userdata/userdata_wl_domains
lrwxrwxrwx 1 root root 52 Jan 22 14:38 userdata_wl_extensions → /var/cpanel/cwaf/etc/userdata/userdata_wl_extensions
lrwxrwxrwx 1 root root 45 Jan 22 14:38 userdata_wl_IPs → /var/cpanel/cwaf/etc/userdata/userdata_wl_IPs
lrwxrwxrwx 1 root root 49 Jan 22 14:38 userdata_wl_methods → /var/cpanel/cwaf/etc/userdata/userdata_wl_methods
lrwxrwxrwx 1 root root 46 Jan 22 14:38 userdata_wl_URLs → /var/cpanel/cwaf/etc/userdata/userdata_wl_URLs

Which file can I check to see if those files are included in Apache?

Hello Hedloff,

Thank you for your question.

Please check the /var/cpanel/cwaf/rules/03_Global_Agents.conf file:

/var/cpanel/cwaf/rules/03_Global_Agents.conf:SecRule REQUEST_HEADERS:User-Agent “@pmFromFile userdata_bl_agents”
/var/cpanel/cwaf/rules/03_Global_Agents.conf: “id:210832,msg:‘COMODO WAF: Blacklisted by userdata_bl_agents’,phase:2,capture,block,logdata:‘%{TX.0}’,t:none,rev:2,severity:4,tag:‘CWAF’,tag:‘Agents’”

Should you have any further questions, do not hesitate to ask.