mod_security chain works on pre 2.7 without rule ID but not on 2.7 with rule ID (cPanel)

Question

On My cPanel server, when using mod_security 2.7 built into cPanel (installed via EasyApache), this code:

SecRule REQUEST_URI "!(/do_command)" chain "id:1234123478"
SecRule REQUEST_URI "\.php\?.*=(https?|ftp)\:/.*(cmd|command)="

Generates this error:

Syntax error on line 177 of /usr/local/apache/conf/modsec_rules/modsec2.vectro.conf: SecRule takes two or three arguments, rule target, operator and optional action list

This code works on pre-2.7 without the rule ID, but then gives this error when used on 2.7.

Answer 1

Maybe you try it with valid mod_sec rules :)

SecRule REQUEST_URI "!(/do_command)" "chain,phase:1,id:'1001',t:none,pass,nolog"
    SecRule REQUEST_URI "\.php\?.*=(https?|ftp)\:/.*(cmd|command)=" "t:none,ctl:ruleRemoveById=960015"