ModSecurity IIS -- Error 1722 on Install

[semblano]

When installing ModSecurity 2.7.6 for IIS, the following error is displayed:

Product: ModSecurity IIS -- Error 1722. There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or package vendor. Action InstallModule, location: C:\Program Files (x86)\ModSecurity IIS, command: "C:\Windows\SysWOW64\inetsrv\appcmd.exe" install module /name:"ModSecurity IIS" /image:"C:\Windows\SysWOW64\inetsrv\ModSecurityIIS.dll"

Windows Server 2008 R2
IIS 7.5.7600.16385

Visual Studio 2013 vcredist Installed as well.

[zimmerle]

Hi @semblano, thanks for the bug report.

The bug is confirmed.

I've installed the same version of Windows and IIS and I am able to reproduce the bug. This also happens with the release 2.7.7. This is under investigation.

[ghost]

Hi,
The problem is that the installer puts the 64-bit files in c:\windows\syswow64\inetsrv !
64-bit files should be in c:\windows\system32\inetsrv
c:\windows\system32... is for 64-bit files (on 64-bit windows).
c:\Windows\syswow64... is for 32-bit files (on 64-bit windows).
Maybe confusing...?

Regards,
Susfu

[ghost]

As a quick temporary workaround you could distribute all files without any installer in a zip file. Maybe include a batch file for copying the files to the correct directories. It would be enough for experienced server administrators...

[ghost]

Also the needed VS12 files msvcr120.dll etc. is not included in the installer.

[zimmerle]

Hi @Susfu, thank you for the help. You are running the same Windows and IIS version as semblano?

The msvcr120.dll is part of Visual Studio redistribution files. As listed here: http://msdn.microsoft.com/en-us/library/8kche8ah.aspx and, in fact, needed by ModSecurity. It is not included on the installer as you have noticed. This dependency is described on our documentation but it can be part of the installer. I've opened a bug to track it at: #627

Regarding to the directories names, ModSecurity can be installed/copied to other directories. e.g., c:\modsecurity. IIS should not refuse to load the DLL because of a "wrong" directory. ModSecurity may not work properly due to permission issues and so on, but the DLL should be loaded. We have to handle better this directory structure, i've opened this bug #628, that describes others issue(s) that somehow are related to the directory structure.

That idea of distributing ModSecurity without an installer is really cool. Other software does that and i guess it will be handy to have it, as long as a debug version in the same format. I will left the bug #629 to track it.

Are you managed to get it working by those changes? I've made a build using the Win 2008 R2 with Visual Studio 2013 and it did not work out-of-box. Still need to debug it to figure out what is happening.

I've just created a IIS Troubleshooting on our wiki page that may be useful for problems like that.

[BugsFinder]

I have this problem with ModSecurity 2.7.7 on Windows Server 2012 + IIS 8.0

Product: ModSecurity IIS -- Error 1722. There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or package vendor. Action UninstallModule, location: C:\Program Files (x86)\ModSecurity IIS, command: "C:\Windows\SysWOW64\inetsrv\appcmd.exe" uninstall module /module.name:"ModSecurity IIS"

P.S. Installing ModSecurity 2.7.7, after uninstalling ModSecurity 2.7.5

Also when open default site, see next:

The Module DLL C:\Windows\SysWOW64\inetsrv\ModSecurityIIS.dll failed to load. The data is the error.

this library is exist C:\Windows\SysWOW64\inetsrv\ModSecurityIIS.dll

Why Product Name: ModSecurity IIS. Product Version: 2.7.6 on the end log:

Property(C): IIS = #8
Property(C): WWWROOT = C:\inetpub\wwwroot
Property(C): LicenseAccepted = 1
Property(C): OWASP_CRS = C:\Program Files (x86)\ModSecurity IIS\owasp_crs
Property(C): ACTIVATED_RULES = C:\Program Files (x86)\ModSecurity IIS\owasp_crs\activated_rules
Property(C): BASE_RULES = C:\Program Files (x86)\ModSecurity IIS\owasp_crs\base_rules
Property(C): EXPERIMENTAL_RULES = C:\Program Files (x86)\ModSecurity IIS\owasp_crs\experimental_rules
Property(C): LUA = C:\Program Files (x86)\ModSecurity IIS\owasp_crs\lua
Property(C): OPTIONAL_RULES = C:\Program Files (x86)\ModSecurity IIS\owasp_crs\optional_rules
Property(C): SLR_RULES = C:\Program Files (x86)\ModSecurity IIS\owasp_crs\slr_rules
Property(C): UTIL = C:\Program Files (x86)\ModSecurity IIS\owasp_crs\util
Property(C): AV_SCANNING = C:\Program Files (x86)\ModSecurity IIS\owasp_crs\util\av-scanning
Property(C): RUNAV = C:\Program Files (x86)\ModSecurity IIS\owasp_crs\util\av-scanning\runAV
Property(C): BROWSER_TOOLS = C:\Program Files (x86)\ModSecurity IIS\owasp_crs\util\browser-tools
Property(C): HONEYPOT_SENSOR = C:\Program Files (x86)\ModSecurity IIS\owasp_crs\util\honeypot-sensor
Property(C): REGRESSION_TESTS = C:\Program Files (x86)\ModSecurity IIS\owasp_crs\util\regression-tests
Property(C): TESTS = C:\Program Files (x86)\ModSecurity IIS\owasp_crs\util\regression-tests\tests
Property(C): RULE_MANAGEMENT = C:\Program Files (x86)\ModSecurity IIS\owasp_crs\util\rule-management
Property(C): VIRTUAL_PATCHING = C:\Program Files (x86)\ModSecurity IIS\owasp_crs\util\virtual-patching
Property(C): ProgramMenuDir = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ModSecurity IIS
Property(C): INSTALLFOLDER = C:\Program Files (x86)\ModSecurity IIS
Property(C): inetsrv = C:\Windows\SysWOW64\inetsrv
Property(C): WixUIRMOption = UseRM
Property(C): ALLUSERS = 1
Property(C): SystemFolder = C:\Windows\SysWOW64
Property(C): TARGETDIR = C:
Property(C): ProgramFilesFolder = C:\Program Files (x86)
Property(C): ProgramMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs
Property(C): SourceDir = C:\Temp
Property(C): MSIUSEREALADMINDETECTION = 1
Property(C): Manufacturer = ModSecurity
Property(C): ProductCode = {22B04FDB-9BAB-46B0-87B8-A39544ECECD3}
Property(C): ProductLanguage = 1033
Property(C): ProductName = ModSecurity IIS
Property(C): ProductVersion = 2.7.6
Property(C): UpgradeCode = {82F09489-1678-4C38-ADCB-08C3757653DB}
Property(C): DefaultUIFont = WixUI_Font_Normal
Property(C): WixUI_Mode = Mondo
Property(C): ErrorDialog = ErrorDlg
Property(C): SecureCustomProperties = FILEEXISTS
Property(C): MsiLogFileLocation = C:\Temp\log.txt
Property(C): PackageCode = {763C4EC3-D138-4BA5-AF38-304CE90E76C1}
Property(C): ProductState = -1
Property(C): PackagecodeChanging = 1
Property(C): CURRENTDIRECTORY = C:\Temp
Property(C): CLIENTUILEVEL = 0
Property(C): CLIENTPROCESSID = 5196
Property(C): VersionDatabase = 200
Property(C): MsiSystemRebootPending = 1
Property(C): VersionMsi = 5.00
Property(C): VersionNT = 602
Property(C): VersionNT64 = 602
Property(C): WindowsBuild = 9200
Property(C): ServicePackLevel = 0
Property(C): ServicePackLevelMinor = 0
Property(C): MsiNTProductType = 3
Property(C): WindowsFolder = C:\Windows
Property(C): WindowsVolume = C:
Property(C): System64Folder = C:\Windows\system32
Property(C): RemoteAdminTS = 1
Property(C): TempFolder = C:\Users\ADMINI~1\AppData\Local\Temp\2
Property(C): CommonFilesFolder = C:\Program Files (x86)\Common Files
Property(C): ProgramFiles64Folder = C:\Program Files
Property(C): CommonFiles64Folder = C:\Program Files\Common Files
Property(C): AppDataFolder = C:\Users\Administrator\AppData\Roaming
Property(C): FavoritesFolder = C:\Users\Administrator\Favorites
Property(C): NetHoodFolder = C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Network Shortcuts
Property(C): PersonalFolder = C:\Users\Administrator\Documents
Property(C): PrintHoodFolder = C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
Property(C): RecentFolder = C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent
Property(C): SendToFolder = C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\SendTo
Property(C): TemplateFolder = C:\ProgramData\Microsoft\Windows\Templates
Property(C): CommonAppDataFolder = C:\ProgramData
Property(C): LocalAppDataFolder = C:\Users\Administrator\AppData\Local
Property(C): MyPicturesFolder = C:\Users\Administrator\Pictures
Property(C): AdminToolsFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
Property(C): StartupFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Property(C): StartMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu
Property(C): DesktopFolder = C:\Users\Public\Desktop
Property(C): FontsFolder = C:\Windows\Fonts
Property(C): GPTSupport = 1
Property(C): OLEAdvtSupport = 1
Property(C): ShellAdvtSupport = 1
Property(C): MsiAMD64 = 6
Property(C): Msix64 = 6
Property(C): Intel = 6
Property(C): PhysicalMemory = 49120
Property(C): VirtualMemory = 52035
Property(C): AdminUser = 1
Property(C): MsiTrueAdminUser = 1
Property(C): LogonUser = Administrator
Property(C): UserSID = S-1-5-21-358628788-1870468043-2955360127-500
Property(C): UserLanguageID = 1033
Property(C): ComputerName = WPL-CRASH
Property(C): SystemLanguageID = 1049
Property(C): ScreenX = 1440
Property(C): ScreenY = 900
Property(C): CaptionHeight = 23
Property(C): BorderTop = 1
Property(C): BorderSide = 1
Property(C): TextHeight = 16
Property(C): TextInternalLeading = 3
Property(C): ColorBits = 32
Property(C): TTCSupport = 1
Property(C): Time = 17:33:01
Property(C): Date = 12/23/2013
Property(C): MsiNetAssemblySupport = 4.0.30319.17929
Property(C): MsiWin32AssemblySupport = 6.2.9200.16384
Property(C): RedirectedDllSupport = 2
Property(C): MsiRunningElevated = 1
Property(C): Privileged = 1
Property(C): USERNAME = Reg.ru
Property(C): COMPANYNAME = Reg.ru
Property(C): DATABASE = C:\Temp\ModSecurityIIS_2.7.7-64b.msi
Property(C): OriginalDatabase = C:\Temp\ModSecurityIIS_2.7.7-64b.msi
Property(C): SOURCEDIR = C:\Temp
Property(C): VersionHandler = 5.00
Property(C): UILevel = 5
Property(C): ACTION = INSTALL
Property(C): EXECUTEACTION = INSTALL
Property(C): ROOTDRIVE = C:
Property(C): CostingComplete = 1
Property(C): OutOfDiskSpace = 0
Property(C): OutOfNoRbDiskSpace = 0
Property(C): PrimaryVolumeSpaceAvailable = 0
Property(C): PrimaryVolumeSpaceRequired = 0
Property(C): PrimaryVolumeSpaceRemaining = 0
Property(C): INSTALLLEVEL = 3
Property(C): WixUI_InstallMode = InstallTypical
=== Logging stopped: 12/23/2013 17:33:01 ===
MSI (c) (4C:44) [17:33:01:033]: Note: 1: 1707
MSI (c) (4C:44) [17:33:01:033]: Note: 1: 2205 2: 3: Error
MSI (c) (4C:44) [17:33:01:033]: Note: 1: 2228 2: 3: Error 4: SELECT Message FROM Error WHERE Error = 1707
MSI (c) (4C:44) [17:33:01:033]: Note: 1: 2205 2: 3: Error
MSI (c) (4C:44) [17:33:01:033]: Note: 1: 2228 2: 3: Error 4: SELECT Message FROM Error WHERE Error = 1709
MSI (c) (4C:44) [17:33:01:033]: Product: ModSecurity IIS -- Installation completed successfully.

MSI (c) (4C:44) [17:33:01:033]: Windows Installer installed the product. Product Name: ModSecurity IIS. Product Version: 2.7.6. Product Language: 1033. Manufacturer: ModSecurity. Installation success or error status: 0.

MSI (c) (4C:44) [17:33:01:033]: Grabbed execution mutex.
MSI (c) (4C:44) [17:33:01:033]: Cleaning up uninstalled install packages, if any exist
MSI (c) (4C:44) [17:33:01:033]: MainEngineThread is returning 0
=== Verbose logging stopped: 12/23/2013 17:33:01 ===

[corradolab]

Please notice the installer should not use the 32 bit version of AppCmd.exe (C:\Windows\SysWOW64\inetsrv\appcmd.exe) on a 64 bit machine. Use the 64 bit version (C:\Windows\inetsrv\appcmd.exe) instead.

http://technet.microsoft.com/en-us/library/cc730918(v=ws.10).aspx

(Also 64 bit binaries should go in "C:\Program Files" instead of "C:\Program Files (x86)")

[zimmerle]

Hi @corradolab, thanks for the notice. There is a bug to handle that directory selection at: #628. As explained at #628, a 64bits machine can have the application pools configured to 32bits and so demands the 32bits binaries, in the bug description you can see that we already figured out an way to keep both installed/configured on the IIS. So that, the user will be able to change that configuration after the installation without problems. Apparently, we have to check the machine architecture (32/64b) to call the correct AppCmd, although, it not seems to be a problem on Win 8, 8.1 or 7.

I am afraid that we may end up in another bug if we pick the 64bits version of the AppCmd based on the machine architecture only. I mean, the 32 bits is part of the IIS (64b) as well, it could be used in certain conditions, not sure, however, what conditions are those. I am opening the bug #632 so that we can have a discussion on that.

[ghost]

Hi, the installation using AppCmd or something else or by manual editing should add the following lines to the file applicationHost.config section <globalModules> to be compatible with both 32bit and 64bit application pools at the same time:

<add name="ModSecurityIIS-32" image="%SystemRoot%\syswow64\inetsrv\ModSecurityIIS.dll" preCondition="bitness32" />
<add name="ModSecurityIIS-64" image="%SystemRoot%\system32\inetsrv\ModSecurityIIS.dll" preCondition="bitness64" />            

It should look something like this if using Appcmd:

appcmd install module /name:ModSecurityIIS-32 /image:%SystemRoot%\syswow64\inetsrv\ModSecurityIIS.dll /preCondition:bitness32   

appcmd install module /name:ModSecurityIIS-64 /image:%SystemRoot%\system32\inetsrv\ModSecurityIIS.dll /preCondition:bitness64   

[skoto]

Having a similar same issue. How did people get the program installed?

Windows 2008 R2 64 bit
ModSecurityIIS 2.2.7
visualc++ runtime libraries for 2010 and 2013.
Typical install

“There is a problem with the Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or package vendor.”

been reading the IIS troubleshooting info at https://github.com/SpiderLabs/ModSecurity/wiki/IIS-Troubleshooting

Below is a link to my logfile when I ran msiexec.

https://dl.dropboxusercontent.com/u/15505138/log.txt

Appreciate any tips/troubleshooting/assistance/etc you can provide.

Thanks.
Jason

[zimmerle]

All the dependencies of this bug were updated and they are under test right now. The code is available at branch: https://github.com/SpiderLabs/ModSecurity/tree/iis_installer

Daily releases can be tracked at: http://www.modsecurity.org/developers/buildbot/builders/Windows%20daily%20release

Link to download the installers will be available as soon as we got the daily release stable.

[zimmerle]

Fixed by: 831e598

[GireeshaRS]

Hi
I have attempted to install and configure Mod security, but the application log says "The description for Event ID 1 from source ModSecurity cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer."

I have installed the pre requisites and also configured the paths. But immediately after the installation is complete the above warning and information message is logged.

The environment is
Windows server 2012 R2 64 bit
IIS 8.5
VS libraries with versions 2008, 2010 and 2012 are all installed.

Please can anyone help as there is no documentation around compatibility of Mod security on this platform.

[BugsFinder]

Hi GireeshaRS,

Try to install Visual C++ 2010 sp1 and Visual C++ 2013.

[GireeshaRS]

Hi

Thanks for the response. I have tried installing all versions of VC++ namely 2008, 2010 and 2013. I might have to try SP1 for VC++ 2010. Will give it a go and come back.

Many thanks

[GireeshaRS]

Hi

I installed SP1 as per your recommendations. Not sure where the problem is but cannot get it to work.

This is what I have done so far

1. Installed VC++ 2008, 2010 SP1, 2012 and 2013 64 bit.
2. Downloaded ModSecurityIIS_2.9.0-64b.msi for 64 bit Windows
3. In the installation of the software choose 64 bit option from the feature list after agreeing to licence terms.
4. Completed installation successfully and restarted IIS
5. The files were downloaded to 'Drive:\Program Files\ModSecurity IIS'
6. Located 'modsecurity_iis.conf' under '\Program Files\ModSecurity IIS' path and used this to do the necessary web config entry for the web site as shown in readme.txt
7. Switched on the SecRuleEngine by setting it as 'On' in modsecurity.conf located at the same path as 'modsecurity_iis.conf' file.
8. Performed IIS reset.
9. Included a test rule SecRule ARGS "../" "t:normalisePathWin,id:99999,severity:4,msg:'Drive Access'" in the modsecurity.conf file.
10. Attempted to browse the URL of the web site by passing invalid query string as mentioned in point 9.
11. Web site does not throw access denied page
12. Event logs under application logs 'The description for Event ID 1 from source ModSecurity cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.'

Is there something I am missing or have not done correctly for it to work. I can see that in the temp folder under IIS for application pool, the module being loaded and every time I try to use the web site an entry being made in windows log file. I am sure the module is not the issue, is it the supporting reference files or my configurations that is the problem? Please advice.

Thanks
Gireesha

[GireeshaRS]

Just to add to my comments, I have used the dependency tracker from 'http://www.dependencywalker.com/' by clicking on 'Download Version 2.2.6000 for x64 [468k]' to verify the executable 'ModSecurityIIS_2.9.0-64b.msi' from mod security web site.

When I do that and open the file to view dependencies I get a red warning message with ' No DOS or PE signature found. The file is not valid 32-bit or 64-bit Windows module' in the tool.

Not sure if this helps diagnose the issue.

[tnacnud1]

Hello GireeshaRS . I am also having the exact same issue on the same platform. Were you able to resolve this issue?

[cedricfortin]

I was able to resolve the issue running the following commands:
%windir%\system32\inetsrv\appcmd.exe uninstall module "ModSecurity IIS (32bits)"
%windir%\system32\inetsrv\appcmd.exe uninstall module "ModSecurity IIS (64bits)"

The problem was that ModSecurity module was registered in IIS but was not installed.
Once the modules were removed from IIS I was able to run the installer without any problem.

To check if you have ModSecurity modules installed in IIS, go to IIS Manager, at server level search for Modules and check if the modules are installed in IIS.