ModSecurity: Exec: Execution failed while reading output error

[nano.fer777]

I have been running into this error over the past few days repeatedly on two sites with Cloudflare hosted DNS. One is Drupal and another is an older custom CMS both of which use ckfinder. I get the error uploading images via Drupal while disabling Cloudflare proxy fixed the problem on the older custom CMS.

I was able to fix the Drupal problem by restarting the website (apache) but this solution only works for awhile and requires another apache restart.

Heres the error and it was the same error for both websites:

2020-04-20 10:08:22 Error xx.xx.xx.xx [client xx.xx.xx.xx] ModSecurity: Exec: Execution failed while reading output: /opt/alt/python35/share/imunify360/scripts/modsec_scan.py (The timeout specified has expired) [hostname "http://www.abc.ca"] [uri "/media/add/image"] [unique_id "Xp3Ifa6sZEszyFFcVw6C8AAAARI"], referer: [https://www.abc.ca/media/add/image Apache error

2020-04-20 10:08:22 Error xx.xx.xx.xx [client xx.xx.xx.xx] ModSecurity: Rule processing failed. [hostname "http://www.abc.ca"] [uri "/media/add/image"] [unique_id "Xp3Ifa6sZEszyFFcVw6C8AAAARI"], referer: https://](https://www.abc.ca/media/a...edia/add/image

I get the feeling this is related to cloudflare somehow but cant say why.

Anyone run into this problem before of have any ideas to fix the problem?

Thx](https://www.abc.ca/media/add/image)

[skhristich]

Hello Glenn,
Thank you for reaching out! Please try adding this to the ModSecurity configuration file:

SecRequestBodyLimitAction ProcessPartial

SecResponseBodyLimitAction ProcessPartial

SecRequestBodyLimit 234217728

If this does not solve the problem could you please create a ticket here https://cloudlinux.zendesk.com/hc/en-us/requests/new and technical experts will help you asap. Thank you for contacting us.

[glenn]

Thanks Sergey for getting back to me so quickly.

I added it to apache directives like this:

<IfModule mod_fcgid.c>
FcgidMaxRequestLen 67108864
SecRequestBodyLimit 67108864
SecRequestBodyNoFilesLimit 67108864
SecRequestBodyLimitAction ProcessPartial
SecResponseBodyLimitAction ProcessPartial
SecRequestBodyLimit 234217728
</IfModule>

Is this correct? It didnt seem to work and I had to disable modsecurity on the site again. I use Plesk.

[skhristich]

Glenn,
Please add it and try again:

FcgidMaxRequestLen 67108864

SecRequestBodyLimit 234217728

SecRequestBodyNoFilesLimit 67108864

SecRequestBodyLimitAction ProcessPartial

SecResponseBodyLimitAction ProcessPartial

Hope to hear from you soon. Thank you.

[glenn]

Hi Sergey,

I added the directives as shown above and it doesnt seem to work. It works for a little while but then the same problem returns.

When making changes to these directives, apache restarts and I think its the apache restart which fixes the problem for a short time, not the directives.

This now happening with two old CMS sites and one fairly new drupal site though I am waiting to hear if the problem returns on the Drupal site.

Thanks
Glenn

[skhristich]

Hello Glenn,
Apparently, this problem cannot be solved without a ticket. Can you open a support ticket https://cloudlinux.zendesk.com/hc/en-us/requests/new so we can take a closer look at your system? You can post the ticket number here and well link this thread to it. Thank you.

[glenn]

Hi Sergey,

I submitted a ticket last night and the problem is a bug in IM360: DEF-11510

How long before a solution is released?

Thanks
Glenn

[skhristich]

Hello Glenn,
We are working on this issue. Unfortunately, we can’t clarify the terms yet.
Get back to you later with a response.
Thanks!