Variables not working on brute force rule (Litespeed+cPanel)

Free Modsecurity rules - Comodo Web Application Fi
#1

When a brute-force rule is triggered in Litespeed, it appears like this in the cPanel interface:

230000: COMODO WAF: Brute Force Attack Identified|Source %{tx.real_ip} (%{tx.brute_force_block_counter} hits since last alert)

As you can see, the IP and counter is not displayed. I hope this can be fixed in the next release.

Also, how long does the block last?

#2

Looks like LiteSpeed doesn’t support ModSecurity variable expansion in msg field, so the most suitable solution would be to request bug fix at LiteSpeed support.

#3

Will do, and reference this thread.

How long does the block last?

#4

By default brute_force_block_timeout=300 seconds.

#5

LiteSpeed just released a fix for this in version 5.1.12 and I can confirm that it’s working.

#6

It’s a definitely good news )