On a new D6 site I installed today PHPIDS, latest versions. The logging is flooded with impact 7 warnings. It looks if every page and every image is PHPIDS-logged.
I don't understand which variable name(s) I have to enter where to disable the warning.
I looks that all tags are equal: Tags: xss, csrf, id, rfe, lfi.
Can you help me out?
From D5 sites I know how good PHPIDS works.
Thanks.

Example 1:
Details
Type phpids
Date Thursday, 2 September, 2010 - 20:32
User Guest
Location http://www.timmerdorpakersloot.nl/
Referrer
Message Total impact: 7
All tags: xss, csrf, id, rfe, lfi
Variable: __utmz | Value: 224266014.1282676059.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
Impact: 7 | Tags: xss, csrf, id, rfe, lfi

* Rule: (?:\({2,}\+{2,}:{2,})|(?:\({2,}\+{2,}:+)|(?:\({3,}\++:{2,})|(?:\$\[!!!\])
Description: Detects unknown attack vectors based on PHPIDS Centrifuge detection
Tags: xss, csrf, id, rfe, lfi

Severity notice

Example 2:
Type phpids
Date Thursday, 2 September, 2010 - 20:32
User Gast
Location http://www.timmerdorpakersloot.nl/system/files/sponsors.jpg
Referrer http://www.timmerdorpakersloot.nl/
Message Total impact: 7
All tags: xss, csrf, id, rfe, lfi
Variable: __utmz | Value: 224266014.1282676059.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
Impact: 7 | Tags: xss, csrf, id, rfe, lfi

* Rule: (?:\({2,}\+{2,}:{2,})|(?:\({2,}\+{2,}:+)|(?:\({3,}\++:{2,})|(?:\$\[!!!\])
Description: Detects unknown attack vectors based on PHPIDS Centrifuge detection
Tags: xss, csrf, id, rfe, lfi

Severity notice

Comments

it-cru’s picture

it-cru
Primary language English
Location Munich
commented

Hello promes,

I think you could reduce this warnings with value __utmz in html and/or json excluded field in phpids settings in your d6 installation.

Greetz Gos77

promes’s picture

promes
Primary language Dutch
commented

I will try first with both, and later with one of each.

Thanks for your help.

promes’s picture

promes
Primary language Dutch
commented

I think I misunderstood you. When I put the value __utmz in the html field I get as error:

Type php
Date Friday, 3 September, 2010 - 21:04
User Gast
Location http://www.timmerdorpakersloot.nl/fotos-timmerdorp-2010
Referrer http://www.timmerdorpakersloot.nl/foto-overzicht
Message preg_replace() [function.preg-replace]: Compilation failed: support for \P, \p, and \X has not been compiled at offset 1 in /var/www/html/sites/all/libraries/phpids-0.6.4/lib/IDS/Monitor.php on line 453.
Severity error

When I put the value in the json field I get:
Fatal error: Call to undefined function json_decode() in /var/www/html/sites/all/libraries/phpids-0.6.4/lib/IDS/Monitor.php on line 554

I think you mean:
put the value __utmz in the exclude field.
I am sorry I don't have much knowledge of this subject.

promes’s picture

promes
Primary language Dutch
commented
Status: Active » Closed (fixed)

I found out it is working.
Thanks for your help.

it-cru’s picture

it-cru
Primary language English
Location Munich
commented
Status: Closed (fixed) » Postponed (maintainer needs more info)

Hello promes,

could you please when you have time post your solution of your problem.

I and above all the rest of the Drupal community would surely rejoice.

thx Gos77

promes’s picture

promes
Primary language Dutch
commented

Hello Gos77,

I am happy to share my results. After some more warnings I included this line in the excluded fields:
__utmz,form_build_id,body

I also have in the excluded fileds these fields (based on issue http://drupal.org/node/713966): user/*,system/files/*
I don't know I still need them.

I still get a bunch of warnings on images:
Total impact: 7
All tags: xss, csrf, id, rfe, lfi
Variable: q | Value: system/files/pictures/picture-24k.jpg
Impact: 7 | Tags: xss, csrf, id, rfe, lfi

* Rule: (?:\({2,}\+{2,}:{2,})|(?:\({2,}\+{2,}:+)|(?:\({3,}\++:{2,})|(?:\$\[!!!\])
Description: Detects unknown attack vectors based on PHPIDS Centrifuge detection
Tags: xss, csrf, id, rfe, lfi

The happy finding is: a lot of unwanted traffic is detected.

I decided to set the mail impact and the warning impact settings both to 80. Reason: I check the logging file of the most attacked websites (one site with up to 50 relevant warnings a day) every day and other sites at least once a month and often block the offending IP-address access to all my websites.

Thanks for your help. I hope others will benefit as much as I do.

promes’s picture

promes
Primary language Dutch
commented
Status: Postponed (maintainer needs more info) » Closed (works as designed)

Status to closed.