Configuration files can be edited using the Fusion Middleware Control in a WebLogic Server Domain or via a text editor in a standalone domain.

For instances that are part of a WebLogic Server Domain, Fusion Middleware Control and the management infrastructure manages the Oracle HTTP Server configuration. Direct editing of the configuration in the staging directory is subject to being overwritten after subsequent management operations, including modifying the configuration in Fusion Middleware Control. For such instances, direct editing should only be performed when the administration server is stopped. When the administration server is subsequently started (or restarted), the results of any manual edits will be replicated to the run-time directory on the node of the managed instance.

See Understanding Configuration Files.

The following sections provide more information on modifying configuration files.

• Editing a Configuration File for a Standalone Domain
  
• Editing a Configuration File for a WebLogic Server Domain
  

Server properties include items like the document root, administrator email, directory index, and operating system details. You can set Oracle HTTP Server properties by using Fusion Middleware Control only or by directly editing the configuration files. You cannot use WLST commands to specify the server properties.

This section includes the following topics:

• Specifying Server Properties by Using Fusion Middleware Control
  
• Specify Server Properties by Editing the httpd.conf File
  

Some of the common Oracle HTTP Server instance configuration procedures are related to secure sockets, MIME settings, Oracle WebLogic Server proxy plug-in (mod_wl_ohs), mod_proxy_fcgi, and more.

This section includes the following topics:

• Secure Sockets Layer Configuration
  
• Configuring Secure Sockets Layer in Standalone Mode
  
• Exporting the Keystore to an Oracle HTTP Server Instance Using WLST
  
• Configuring MIME Settings Using Fusion Middleware Control
  
• About Configuring mod_proxy_fcgi
  
• About Configuring the Oracle WebLogic Server Proxy Plug-In (mod_wl_ohs)
  
• Removing Access to Unneeded Content
  
• Using the apxs Command to Install Extension Modules
  
• Disabling the Options Method
  
• Updating Oracle HTTP Server Component Configurations on a Shared File System
  

LoadModule ossl_module "${PRODUCT_HOME}/modules/mod_ossl.so"                   
Listen 4443
ServerName www.testohs.com
SSLEngine on
# SSL Protocol Support:
# List the supported protocols.
SSLProtocol TLSv1.2 TLSv1.3
# SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate. 
SSLCipherSuite TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
SSLWallet "${ORACLE_INSTANCE}/config/fmwconfig/components/${COMPONENT_TYPE}/instances/${COMPONENT_NAME}/keystores/default" 

# require a client certificate which has to be directly
# signed by our CA certificate
SSLVerifyClient require
SSLWallet "${ORACLE_INSTANCE}/config/fmwconfig/components/${COMPONENT_TYPE}/instances/${COMPONENT_NAME}/keystores/default"

SSLVerifyClient none
SSLWallet "${ORACLE_INSTANCE}/config/fmwconfig/components/${COMPONENT_TYPE}/instances/${COMPONENT_NAME}/keystores/default"
<Location /secure/area>
   SSLVerifyClient require
</Location>

SSLVerifyClient      none
<Directory /access/required>
    SSLVerifyClient      require
    SSLOptions           +FakeBasicAuth
    SSLRequireSSL
    AuthName             "Oracle Auth"
    AuthType             Basic
    AuthBasicProvider    file
    AuthUserFile         httpd.passwd
    Require              valid-user
</Directory>
 

httpd.passwd
 
Subject:        OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Subject:        CN=GTE CyberTrust Global Root,OU=GTE CyberTrust Solutions\, Inc.,O=GTE Corporation,C=US
Subject:        CN=localhost,OU=FOR TESTING ONLY,O=FOR TESTING ONLY
Subject:        OU=Class 2 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Subject:        OU=Class 1 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
 

SSLVerifyClient      none
SSLWallet "${ORACLE_INSTANCE}/config/fmwconfig/components/${COMPONENT_TYPE}/instances/${COMPONENT_NAME}/keystores/default"
 
<Directory /access/required>
  SSLVerifyClient      require
  SSLOptions           +FakeBasicAuth
  SSLRequireSSL
  SSLRequire       %{SSL_CLIENT_S_DN_O}  eq "VeriSign\, Inc." \    
and %{SSL_CLIENT_S_DN_OU} in {"Class", "Public", "Primary"}
</Directory>

SSLWallet "$ORACLE_INSTANCE/config/fmwconfig/components/$COMPONENT_TYPE/instances/$COMPONENT_NAME/keystores/default"
<Directory  /access/required>
    #   Outside the subarea only Intranet access is granted
    Require              ip 192.168.1.0/24
</Directory>
 
<Directory  /access/required>
    #   Inside the subarea any Intranet access is allowed
    #   but from the Internet only HTTPS + Strong-Cipher + Password
    #   or the alternative HTTPS + Strong-Cipher + Client-Certificate
 
    #   If HTTPS is used, make sure a strong cipher is used.
    #   Additionally allow client certs as alternative to basic auth.
    SSLVerifyClient      optional
    SSLOptions           +FakeBasicAuth +StrictRequire
    SSLRequire           %{SSL_CIPHER_USEKEYSIZE}>= 128
    #   Force clients from the Internet to use HTTPS
    RewriteEngine        on
    RewriteCond          %{REMOTE_ADDR} !^192\.168\.1\.[0-9]+$
    RewriteCond          %{HTTPS} !=on
    RewriteRule          . - [F]   
    #   Allow Network Access and/or Basic Auth
    Satisfy              any
 
    #   Network Access Control
    Require              ip 192.168.1.0/24
    #   HTTP Basic Authentication
    AuthType             basic
    AuthName             "Protected Intranet Area"
    AuthBasicProvider    file
    AuthUserFile         htpasswd
    Require              valid-user
</Directory>

Listen 4443
<VirtualHost>
 ServerName ns1.example.com
 SSLWallet "server"
</VirtualHost>

<VirtualHost>
 ServerName ns2.example.com
 SSLWallet "server"
</VirtualHost>

[error] No hostname was provided via SNI for a name based virtual host

Server Configuration :
 
# Ensure that Oracle HTTP Server listens on port 443
Listen 443
 
# Listen for virtual host requests on all IP addresses
NameVirtualHost *:443
 
# Go ahead and accept connections for these vhosts
# from non-SNI clients
SSLStrictSNIVHostCheck off
 
<VirtualHost *:443>
  # Because this virtual host is defined first, it will
  # be used as the default if the hostname is not received
  # in the SSL handshake, e.g. if the browser doesn't support
  # SNI.
  DocumentRoot /www/example1
  ServerName www.example.com
 
  # Other directives here
 
</VirtualHost>
 
<VirtualHost *:443>
  DocumentRoot /www/example2
  ServerName www.example2.org
 
  # Other directives here
 
</VirtualHost>

...
# 
# "${ORACLE_INSTANCE}/config/fmwconfig/components/${COMPONENT_TYPE}/instances/${COMPONENT_NAME}/cgi-bin" should be changed to whatever your ScriptAliased
# CGI directory exists, if you have that configured.
#
<Directory "${ORACLE_INSTANCE}/config/fmwconfig/components/${COMPONENT_TYPE}/instances/${COMPONENT_NAME}/cgi-bin">
    AllowOverride None
    Options None
    Require all granted
</Directory>
... 

...
# Uncomment the following line to enable the fancy indexing configuration
# below.
# Define ENABLE_FANCYINDEXING
<IfDefine ENABLE_FANCYINDEXING>

# IndexOptions: Controls the appearance of server-generated directory
# listings.
#
IndexOptions FancyIndexing HTMLTable VersionSort
 
# We include the /icons/ alias for FancyIndexed directory listings.  If
# you do not use FancyIndexing, you may comment this out.
#
Alias /icons/ "${PRODUCT_HOME}/icons/"
 
<Directory "${PRODUCT_HOME}/icons">
    Options Indexes MultiViews
    AllowOverride None
    Require all granted
</Directory>
 
#
# AddIcon* directives tell the server which icon to show for different
# files or filename extensions.  These are only displayed for
# FancyIndexed directories.
#
AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip
 
AddIconByType (TXT,/icons/text.gif) text/*
AddIconByType (IMG,/icons/image2.gif) image/*
AddIconByType (SND,/icons/sound2.gif) audio/*
AddIconByType (VID,/icons/movie.gif) video/*
 
AddIcon /icons/binary.gif .bin .exe
AddIcon /icons/binhex.gif .hqx
AddIcon /icons/tar.gif .tar
AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv
AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip
AddIcon /icons/a.gif .ps .ai .eps
AddIcon /icons/layout.gif .html .shtml .htm .pdf
AddIcon /icons/text.gif .txt
AddIcon /icons/c.gif .c
AddIcon /icons/p.gif .pl .py
AddIcon /icons/f.gif .for
AddIcon /icons/dvi.gif .dvi
AddIcon /icons/uuencoded.gif .uu
AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
AddIcon /icons/tex.gif .tex
AddIcon /icons/bomb.gif core
 
 
AddIcon /icons/back.gif ..
AddIcon /icons/hand.right.gif README
AddIcon /icons/folder.gif ^^DIRECTORY^^
AddIcon /icons/blank.gif ^^BLANKICON^^
 
#
# DefaultIcon is which icon to show for files which do not have an icon
# explicitly set.
#
DefaultIcon /icons/unknown.gif
 
#
# AddDescription allows you to place a short description after a file in
# server-generated indexes.  These are only displayed for FancyIndexed
# directories.
# Format: AddDescription "description" filename
#
#AddDescription "GZIP compressed document" .gz
#AddDescription "tar archive" .tar
#AddDescription "GZIP compressed tar archive" .tgz
... 
 
#
# ReadmeName is the name of the README file the server will look for by
# default, and append to directory listings.
#
# HeaderName is the name of a file which should be prepended to
# directory indexes.
ReadmeName README.html
HeaderName HEADER.html
 
#
# IndexIgnore is a set of filenames which directory indexing should ignore
# and not include in the listing.  Shell-style wildcarding is permitted.
#
IndexIgnore .??* *~ *# HEADER* README* RCS CVS *,v *,t
</IfDefine>

... 
#
# Uncomment the following line to enable the manual configuration below.
# Define ENABLE_MANUAL
<IfDefine ENABLE_MANUAL>
AliasMatch ^/manual(?:/(?:de|en|es|fr|ja|ko|pt-br|ru|tr))?(/.*)?$ "${PRODUCT_HOME}/manual$1"
 
<Directory "${PRODUCT_HOME}/manual">
    Options Indexes
    AllowOverride None
    Require all granted
 
    <Files *.html>
        SetHandler type-map
    </Files>
    # .tr is text/troff in mime.types!
    <Files *.html.tr.utf8>
        ForceType text/html
    </Files>
 
    SetEnvIf Request_URI ^/manual/(de|en|es|fr|ja|ko|pt-br|ru|tr)/ prefer-language=$1
    RedirectMatch 301 ^/manual(?:/(de|en|es|fr|ja|ko|pt-br|ru|tr)){2,}(/.*)?$ /manual/$1$2
 
    LanguagePriority en de es fr ja ko pt-br ru tr
    ForceLanguagePriority Prefer Fallback
</Directory>
</IfDefine>

$ORACLE_HOME/ohs/bin/apxs -c mod_example.c

$ORACLE_HOME/ohs/bin/apxs -ci mod_example.c

LoadModule example_module "${ORACLE_HOME}/ohs/modules/mod_example.so"

CONFIG_FILE_PATH=$ORACLE_HOME/user_projects/domains/base_domain/config/fmwconfig/components/OHS/ohs1
export CONFIG_FILE_PATH
$ORACLE_HOME/ohs/bin/apxs -cia mod_example.c

$ORACLE_HOME/perl/bin/perl $ORACLE_HOME/ohs/bin/apxs -c mod_example.c

---- Request -------
OPTIONS / HTTP/1.0
Content-Length: 0
Accept: */*
Accept-Language: en-US
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)
Host: host123:80

---- Response --------
HTTP/1.1 200 OK
Date: Wed, 23 Apr 2008 20:20:49 GMT
Server: Oracle-Application-Server-11g/11.1.1.0.0 Oracle-HTTP-Server
Allow: GET,HEAD,POST,OPTIONS
Content-Length: 0
Connection: close
Content-Type: text/html

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_METHOD} ^OPTIONS
RewriteRule .* – [F]
</IfModule> 

You can use the open-source mod_security module to detect and prevent intrusion attacks against Oracle HTTP Server. For example, specifying a mod_security rule to screen all incoming requests, and deny requests that match the conditions specified in the rule.

The mod_security module and its prerequisites are included in the Oracle HTTP Server installation as a shared object named mod_security2.so in the ORACLE_HOME/ohs/modules directory. The shared object mod_security2.so has a dependency on cURL and OpenSSL libraries. These libraries are also included in the Oracle HTTP Server installation. The mod_security module provided as part of the Oracle HTTP Server installation supports the SecRemoteRules directive. This directive allows an user to load rules from a target server. The communication from Oracle HTTP server to the target server that hosts the mod_security rules happens over TLS and is implemented using cURL and OpenSSL.

The TLS communication between Oracle HTTP Server and the target server succeeds only if Oracle HTTP Server trusts the remote server with which it communicates. To establish trust, update the trust store used by Oracle HTTP Server with the CA certificate of the remote server.

To add the CA certificate chain of the remote server to the trust store:

1. Obtain the CA certificate chain for the remote server.
2. Append the contents of certificate chain to the default trust store path.

The trust store path used by libcurl on Linux is /etc/pki/tls/certs/ca-bundle.crt.

On Linux:

1. Obtain the CA certificate chain for the remote server.

2. Connect to remote server using the following OpenSSL command to get the certificate chain in PEM format.

   
   $ openssl s_client  -showcerts -connect host:sslport         
       
   PEM  Format will look like this :
   ===========================       
   
   -----BEGIN CERTIFICATE----- 
   ……………
   ------END CERTIFICATE-----
   ==============================

   
   Example :  openssl s_client  -showcerts -connect oracle.com:443
   Sample output for oracle.com:443 which  contains three certificates in cert chain.  
   =========================Sample output==============================
   CONNECTED(00000005)
   ….. 
   Certificate chain
    0 s:/C=US/ST=California/L=Redwood City/O=Oracle Corporation/CN=oracle.com
      i:/C=US/O=DigiCert Inc/CN=DigiCert TLS RSA SHA256 2020 CA1
   -----BEGIN CERTIFICATE-----
   F8XNzDlYAiEAq/wO4SuGY12xwbrqXsYf7+eGP8hjUyqwx0QQZ8n1WcoAdgDm0jFj
   …….
   tgr6NGY=
   -----END CERTIFICATE-----
    1 s:/C=US/O=DigiCert Inc/CN=DigiCert TLS RSA SHA256 2020 CA1
      i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root CA
   -----BEGIN CERTIFICATE-----
   MI--------------
   --------------------
   A7sKPPcw7+uvTPyLNhBzPvOk
   -----END CERTIFICATE-----
    2 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root CA
      i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root CA
   -----BEGIN CERTIFICATE-----
   Mi-….
   ------------------
   CAUw7C29C79Fv1C5qfPrmAE
   -----END CERTIFICATE-----
   ---
   Server certificate
   subject=/C=US/ST=California/L=Redwood City/O=Oracle Corporation/CN=oracle.com
   issuer=/C=US/O=DigiCert Inc/CN=DigiCert TLS RSA SHA256 2020 CA1

3. Open the /etc/pki/tls/certs/ca-bundle.crt file and add the text present in the PEM text file.

   Note:

   Ensure you do not add a new line at the end of the file.

   If there is more than one certificate present in the certificate chain, then copy the individual certificate in PEM format to the ca-bundle.crt file.

On Windows:

1. Download cacert.pem from the following link:

   https://curl.se/docs/caextract.html

2. Rename the cacert.pem file to curl-ca-bundle.crt.

3. Place curl-ca-bundle.crt in any of the following directories:

   1. Windows System directory. For example, C:\windows\system32.

   2. Windows Directory. For example, C:\windows.

   3. Any directory present in %PATH%. For example, %PRODUCT_HOME%\bin.

4. Add CA certificates to curl-ca-bundle.crt.

   1. Connect to remote server using the following OpenSSL command to get the certificate chain in PEM format.

      
      $ openssl s_client  -showcerts -connect host:sslport         
          
      PEM  Format will look like this :
      ===========================       
      
      -----BEGIN CERTIFICATE----- 
      ……………
      ------END CERTIFICATE-----
      ==============================

      
      Example :  openssl s_client  -showcerts -connect oracle.com:443 
      Sample output for oracle.com:443 which  contains three certificates in cert chain.  
      =========================Sample output==============================
      CONNECTED(00000005)
      ….. 
      Certificate chain
       0 s:/C=US/ST=California/L=Redwood City/O=Oracle Corporation/CN=oracle.com
         i:/C=US/O=DigiCert Inc/CN=DigiCert TLS RSA SHA256 2020 CA1
      -----BEGIN CERTIFICATE-----
      F8XNzDlYAiEAq/wO4SuGY12xwbrqXsYf7+eGP8hjUyqwx0QQZ8n1WcoAdgDm0jFj
      …….
      tgr6NGY=
      -----END CERTIFICATE-----
       1 s:/C=US/O=DigiCert Inc/CN=DigiCert TLS RSA SHA256 2020 CA1
         i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root CA
      -----BEGIN CERTIFICATE-----
      MI--------------
      --------------------
      A7sKPPcw7+uvTPyLNhBzPvOk
      -----END CERTIFICATE-----
       2 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root CA
         i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root CA
      -----BEGIN CERTIFICATE-----
      Mi-….
      ------------------
      CAUw7C29C79Fv1C5qfPrmAE
      -----END CERTIFICATE-----
      ---
      Server certificate
      subject=/C=US/ST=California/L=Redwood City/O=Oracle Corporation/CN=oracle.com
      issuer=/C=US/O=DigiCert Inc/CN=DigiCert TLS RSA SHA256 2020 CA1

   2. Open the curl-ca-bundle.crt file and add the text present in the PEM text file.

      Note:

      Ensure you do not add a new line at the end of the file.

      If there is more than one certificate present in the certificate chain, then copy the individual certificate in PEM format to the curl-ca-bundle.crt file.

Oracle HTTP Server supports mod_security version 2.9.0 directives, variables, action, phases, and functions. See https://modsecurity.org/.

Sample mod_security.conf File provides a usable example of the mod_security.conf file, including the LoadModule statement.

The mod_security configuration can be added to the httpd.conf configuration file, or it can appear in a separate mod_security.conf configuration file.

This section contains the following information:

• Configuring mod_security in the httpd.conf File
  
• Configuring mod_security in a mod_security.conf File
  
• Configuring SecRemoteRules in the mod_security.conf File
  
• Configuring mod_security for Audit Logging
  
• Sample mod_security.conf File
  

...
#Load module
LoadModule security2_module "${PRODUCT_HOME}/modules/mod_security2.so"
...

SecRemoteRules some-key https://www.yourserver.com/plain-text-rules.txt

SecAuditEngine RelevantOnly
SecAuditLog logs/audit/audit.log
SecAuditLogParts ABCFHZ
SecAuditLogType concurrent
SecAuditLogStorageDir logs/audit
SecAuditLogRelevantStatus ^(?:5|4(?!04))

#Load module 
LoadModule security2_module "${PRODUCT_HOME}/modules/mod_security2.so"
# -- Rule engine initialization ----------------------------------------------

# Enable ModSecurity, attaching it to every transaction. Use detection
# only to start with, because that minimizes the chances of post-installation
# disruption.
#
SecRuleEngine DetectionOnly


# -- Request body handling ---------------------------------------------------

# Allow ModSecurity to access request bodies. If you don't, ModSecurity
# won't be able to see any POST parameters, which opens a large security
# hole for attackers to exploit.
#
SecRequestBodyAccess On

# Enable XML request body parser.
# Initiate XML Processor in case of xml content-type
#
SecRule REQUEST_HEADERS:Content-Type "text/xml" "id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"


# Maximum request body size we will accept for buffering. If you support
# file uploads then the value given on the first line has to be as large
# as the largest file you are willing to accept. The second value refers
# to the size of data, with files excluded. You want to keep that value as
# low as practical.
#
SecRequestBodyLimit 13107200
SecRequestBodyNoFilesLimit 131072

# Store up to 128 KB of request body data in memory. When the multipart
# parser reachers this limit, it will start using your hard disk for
# storage. That is slow, but unavoidable.
#
SecRequestBodyInMemoryLimit 131072

# What do do if the request body size is above our configured limit.
# Keep in mind that this setting will automatically be set to ProcessPartial
# when SecRuleEngine is set to DetectionOnly mode in order to minimize
# disruptions when initially deploying ModSecurity.
#
SecRequestBodyLimitAction Reject

# Verify that we've correctly processed the request body.
# As a rule of thumb, when failing to process a request body
# you should reject the request (when deployed in blocking mode)
# or log a high-severity alert (when deployed in detection-only mode).
#
SecRule REQBODY_ERROR "!@eq 0" \
"id:'200001', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request \ 
body.',logdata:'%{reqbody_error_msg}',severity:2"

# By default be strict with what we accept in the multipart/form-data
# request body. If the rule below proves to be too strict for your
# environment consider changing it to detection-only. You are encouraged
# _not_ to remove it altogether.
#
SecRule MULTIPART_STRICT_ERROR "!@eq 0" \
"id:'200002',phase:2,t:none,log,deny,status:44, \
msg:'Multipart request body failed strict validation: \
PE %{REQBODY_PROCESSOR_ERROR}, \
BQ %{MULTIPART_BOUNDARY_QUOTED}, \
BW %{MULTIPART_BOUNDARY_WHITESPACE}, \
DB %{MULTIPART_DATA_BEFORE}, \
DA %{MULTIPART_DATA_AFTER}, \
HF %{MULTIPART_HEADER_FOLDING}, \
LF %{MULTIPART_LF_LINE}, \
SM %{MULTIPART_MISSING_SEMICOLON}, \
IQ %{MULTIPART_INVALID_QUOTING}, \
IP %{MULTIPART_INVALID_PART}, \
IH %{MULTIPART_INVALID_HEADER_FOLDING}, \
FL %{MULTIPART_FILE_LIMIT_EXCEEDED}'"

# Did we see anything that might be a boundary?
#
SecRule MULTIPART_UNMATCHED_BOUNDARY "!@eq 0" \
"id:'200003',phase:2,t:none,log,deny,status:44,msg:'Multipart parser detected a possible unmatched boundary.'"

# PCRE Tuning
# We want to avoid a potential RegEx DoS condition
#
SecPcreMatchLimit 1000
SecPcreMatchLimitRecursion 1000

# Some internal errors will set flags in TX and we will need to look for these.
# All of these are prefixed with "MSC_".  The following flags currently exist:
#
# MSC_PCRE_LIMITS_EXCEEDED: PCRE match limits were exceeded.
#
SecRule TX:/^MSC_/ "!@streq 0" \
        "id:'200004',phase:2,t:none,deny,msg:'ModSecurity internal error flagged: %{MATCHED_VAR_NAME}'"

# -- Response body handling --------------------------------------------------

# Allow ModSecurity to access response bodies. 
# You should have this directive enabled in order to identify errors
# and data leakage issues.
# 
# Do keep in mind that enabling this directive does increases both
# memory consumption and response latency.
#
SecResponseBodyAccess On

# Which response MIME types do you want to inspect? You should adjust the
# configuration below to catch documents but avoid static files
# (e.g., images and archives).
#
SecResponseBodyMimeType text/plain text/html text/xml

# Buffer response bodies of up to 512 KB in length.
SecResponseBodyLimit 524288

# What happens when we encounter a response body larger than the configured
# limit? By default, we process what we have and let the rest through.
# That's somewhat less secure, but does not break any legitimate pages.
#
SecResponseBodyLimitAction ProcessPartial

# -- Filesystem configuration ------------------------------------------------

# The location where ModSecurity stores temporary files (for example, when
# it needs to handle a file upload that is larger than the configured limit).
# 
# This default setting is chosen due to all systems have /tmp available however, 
# this is less than ideal. It is recommended that you specify a location that's private.
#
SecTmpDir /tmp/

# The location where ModSecurity will keep its persistent data.  This default setting 
# is chosen due to all systems have /tmp available however, it
# too should be updated to a place that other users can't access.
#
SecDataDir /tmp/

# -- File uploads handling configuration -------------------------------------

# The location where ModSecurity stores intercepted uploaded files. This
# location must be private to ModSecurity. You don't want other users on
# the server to access the files, do you?
#
#SecUploadDir /opt/modsecurity/var/upload/

# By default, only keep the files that were determined to be unusual
# in some way (by an external inspection script). For this to work you
# will also need at least one file inspection rule.
#
#SecUploadKeepFiles RelevantOnly

# Uploaded files are by default created with permissions that do not allow
# any other user to access them. You may need to relax that if you want to
# interface ModSecurity to an external program (e.g., an anti-virus).
#
#SecUploadFileMode 0600


# -- Debug log configuration -------------------------------------------------

# The default debug log configuration is to duplicate the error, warning
# and notice messages from the error log.
#
#SecDebugLog /opt/modsecurity/var/log/debug.log
#SecDebugLogLevel 3


# -- Audit log configuration -------------------------------------------------

# Log the transactions that are marked by a rule, as well as those that
# trigger a server error (determined by a 5xx or 4xx, excluding 404,  
# level response status codes).
#
SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4(?!04))"

# Log everything we know about a transaction.
SecAuditLogParts ABIJDEFHZ

# Use a single file for logging. This is much easier to look at, but
# assumes that you will use the audit log only ocassionally.
#
SecAuditLogType Serial
SecAuditLog "${ORACLE_INSTANCE}/servers/${COMPONENT_NAME}/logs/modsec_audit.log"

# Specify the path for concurrent audit logging.
SecAuditLogStorageDir "${ORACLE_INSTANCE}/servers/${COMPONENT_NAME}/logs"
#Simple test 
SecRule ARGS "\.\./" "t:normalisePathWin,id:99999,severity:4,msg:'Drive Access'" 

# -- Miscellaneous -----------------------------------------------------------

# Use the most commonly used application/x-www-form-urlencoded parameter
# separator. There's probably only one application somewhere that uses
# something else so don't expect to change this value.
#
SecArgumentSeparator &

# Settle on version 0 (zero) cookies, as that is what most applications
# use. Using an incorrect cookie version may open your installation to
# evasion attacks (against the rules that examine named cookies).
#
SecCookieFormat 0

# Specify your Unicode Code Point.
# This mapping is used by the t:urlDecodeUni transformation function
# to properly map encoded data to your language. Properly setting
# these directives helps to reduce false positives and negatives.
#
#SecUnicodeCodePage 20127
#SecUnicodeMapFile unicode.mapping