ModSecurity Installation on Linux

ModSecurity is an open source web application layer firewall which primarily
supported Apache and now extends its security features to IIS and Nginx. Modsecurity
acts as a filter for every request supplied to the webserver which accepts/rejects
the request according to the rule sets.

Here I will explain how to install Modsecurity for Apache and configure OWASP core
rule sets on it.

Apache webserver installation can be followed from the link below,

Apache-Installation

Now download the latest Apache Modsecurity package,

wget https://www.modsecurity.org/tarball/2.7.7/modsecurity-apache_2.7.7.tar.gz

Install the missing dependencies if any,

apt-get install libxml2 libxml2-dev libxml2-utils pcre curl

tar -zxvf modsecurity-apache_2.7.7.tar.gz
cd modsecurity-apache_2.7.7

./configure --with-apxs=/usr/local/bin/apxs --with-apu=/usr/local/bin/
--with-apr=/usr/local/bin/

make
make install

cp modsecurity.conf-recommended /etc/httpd/conf/extra/modsecurity.conf


Configure Apache,

vim /etc/httpd/conf/httpd.conf

LoadModule security2_module modules/mod_security2.so
Include /etc/httpd/conf/extra/modsecurity.conf

Restart Apache,

apachectl restart

Check wheather the new module is loaded,

httpd -M

security2_module (shared)

Now Apply Open Web Application Security Project (OWASP) ModSecurity Core Rule set,

Download the latest rule set from the project's site, https://www.owasp.org

Untar the package,

tar -zxvf SpiderLabs-owasp-modsecurity-crs.tar.gz
cd SpiderLabs-owasp-modsecurity-crs-f4d33c4

mkdir /etc/httpd/conf/extra/modsecurity
cp modsecurity_crs_10_setup.conf.example /etc/httpd/conf/extra/modsecurity/modsecurity_crs_10_setup.conf
cp -vf base_rules/* /etc/httpd/conf/extra/modsecurity/

Add these rule to Apache,

vim /etc/httpd/conf/httpd.conf

Include /etc/httpd/conf/extra/modsecurity/*.conf


Restart Apache,

apachectl restart


You have now secured your web application with Modsecurity. To start with
Modsecurity you should keep it in DetectionOnly mode,

vim /etc/httpd/conf/extra/modsecurity.conf

SecRuleEngine DetectionOnly


Now, Test your web application completely in a normal working environment and go
through the audit and debug logs whether they are showing warnings.

These warnings should be taken care before going LIVE (SecRuleEngine On). Either you
can reprogram the application or remove those rule IDs from checking. ie,

eg:-

<VirtualHost *>

SecRuleRemoveById 981172 981175

</VirtualHost>

Now Enable Modsecurity,

vim /etc/httpd/conf/extra/modsecurity.conf

SecRuleEngine On

Restart Apache,

apachectl restart


Thanks for reading,

Cheers /-