On this page

OSSEC / HIDS Rule 30105

OSSEC / HIDS rule catalog

  • Rule family: OSSEC / HIDS
  • Rule ID: 30105
  • Definition status: Present in current source
  • Alert message / subject: Apache: Attempt to access forbidden file or directory.
  • Rule level: 5
  • Definition checked: 2026-10-21

Interpretation and response

This event is recorded as “Apache: Attempt to access forbidden file or directory.” Review the originating log and the affected host or service to determine whether the activity was expected.

An OSSEC/HIDS event records or correlates activity. Blocking depends on the originating application and any separately configured Active Response policy; an alert alone does not prove that an attack was blocked.

Documentation

The following guidance was migrated from the historical wiki and reviewed against the rule definition. Legacy ASL product names and interface instructions refer to the versions documented then. Use the current metadata above and your installed configuration when interpreting thresholds, notification settings and response behavior.

Description

This rule is triggered when ASL has detected that your web server has forbidden access to a file or directory.

This event is not triggered, caused, configured or managed by ASL.

Details

This rule is designed to detect when your web server has prevented access to a file or directory. This can occur if the web server is configured to prevent access to this file or directory, or if the permissions on the directory or file do not allow access by the web server.

ASL does not control or cause this behavior, it merely reports when this occurs. Therefore, if your web server is denying you access to a file or directory, please contact your web server vendor for assistance with this issue.

ASL will not shun, by default, on these events however if you wish to have ASL block on these events please see the Tuning Advice section below.

Disabling this rule will not prevent your web server from preventing access to this file or directory. It will simply “silence” the alert in ASL, however your web server will continue to deny access to the file or directory. We do not recommend you disable this rule.

Troubleshooting

False Positives

This rule is not caused by ASL (historical reference). ASL merely reports when your web server blocks access to a file or directory

Tuning Guidance

If you wish to shun on these alerts, just set Active Response in the ASL (historical reference) rule manager for rule 30105 to “yes”.

Disabling this rule will not prevent your web server from denying access to the file or directory. It will simply “silence” the alert in ASL. Your web server will continue to alert and/or block this activity. We do not recommend you disable this rule.

If you do not wish to see this alert, just set it to a lower level that the default in the ASL gui.

If you do not wish to be emailed on this alert, just set the rule to not email.

Additional Information

Example log messages

[error] [client 192.0.2.10] client denied by server configuration: /home/user/public_html/favicon.ico

Source and revision

Migrated from HIDS_30105, wiki page 411, revision 2809 (20121014). Documentation review: 2026-10-21. An archived wiki status of Active is not a current deployment status.

For assistance, provide the rule ID, installed product and rule version, and a sanitized event to Atomicorp support .