From f850932f83d47a68137ab207e6db0f217152c707 Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Thu, 22 Feb 2024 14:03:04 +0100 Subject: [PATCH 1/2] fix: Change 'SecEngineStatus' to Off by default --- modsecurity.conf-recommended | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modsecurity.conf-recommended b/modsecurity.conf-recommended index 395d82cedc..a51bc2048d 100644 --- a/modsecurity.conf-recommended +++ b/modsecurity.conf-recommended @@ -281,5 +281,5 @@ SecUnicodeMapFile unicode.mapping 20127 # The following information will be shared: ModSecurity version, # Web Server version, APR version, PCRE version, Lua version, Libxml2 # version, Anonymous unique id for host. -SecStatusEngine On +SecStatusEngine Off From d7ef620e8b099cb8b2557f68d7a3c8e5869a3bce Mon Sep 17 00:00:00 2001 From: Ervin Hegedus Date: Thu, 22 Feb 2024 14:04:49 +0100 Subject: [PATCH 2/2] docs: Add info about modification --- modsecurity.conf-recommended | 2 ++ 1 file changed, 2 insertions(+) diff --git a/modsecurity.conf-recommended b/modsecurity.conf-recommended index a51bc2048d..4f5034fbbc 100644 --- a/modsecurity.conf-recommended +++ b/modsecurity.conf-recommended @@ -281,5 +281,7 @@ SecUnicodeMapFile unicode.mapping 20127 # The following information will be shared: ModSecurity version, # Web Server version, APR version, PCRE version, Lua version, Libxml2 # version, Anonymous unique id for host. +# NB: As of April 2022, there is no longer any advantage to turning this +# setting On, as there is no active receiver for the information. SecStatusEngine Off