Ubuntu 12.04 Precise LTS: Install ModSecurity for Apache 2 web server

  1. Install ModSecurity: 
     sudo apt-get install libxml2 libxml2-dev libxml2-utils libaprutil1 libaprutil1-dev libapache-mod-security
    If your Ubuntu is 64bit, you need to fix a bug: 
    sudo ln -s /usr/lib/x86_64-linux-gnu/libxml2.so.2 /usr/lib/libxml2.so.2
  2. Configure ModSecurity: 
    sudo mv /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf; sudo vi /etc/modsecurity/modsecurity.conf
    Enable the rule engine: 
    SecRuleEngine On
    Increase the request body size limit to 10Mb(Optional, only if your site accepts uploads): 
    SecRequestBodyLimit 10000000
SecRequestBodyInMemoryLimit 10000000
  3. Check the ModSecurity version: 
    dpkg -s libapache-mod-security | grep Version
    The installed ModSecurity version is: 
    Version: 2.6.3-1ubuntu0.2
  4. Install OWASP ModSecurity Core Rule Set:
    1. Download the rule set(version 2.2.5 because the latest version requires ModSecurity 2.7.0+): 
      wget https://github.com/SpiderLabs/owasp-modsecurity-crs/tarball/v2.2.5 -O /tmp/owasp.tar.gz
    2. Extract the package: 
      cd /tmp; tar -zxvf owasp.tar.gz; rm owasp.tar.gz
    3. Copy the directory to /etc/modsecurity, and set the permissions: 
      sudo mv SpiderLabs-owasp-modsecurity-crs-5c28b52/ /etc/modsecurity/owasp-crs
sudo chmod -R 644 /etc/modsecurity/owasp-crs
    4. Link the rules to /etc/modsecruity/owasp-crs/activated_rules directory: 
      sudo mv /etc/modsecurity/owasp-crs/modsecurity_crs_10_setup.conf.example /etc/modsecurity/owasp-crs/modsecurity_crs_10_setup.conf
cd /etc/modsecurity/owasp-crs/activated_rules/
sudo ln -s ../modsecurity_crs_10_setup.conf
for f in $(ls ../base_rules/); do sudo ln -s ../base_rules/$f; done
for f in $(ls ../optional_rules/); do sudo ln -s ../optional_rules/$f; done
    5. Modify /etc/apache2/mods-available/mod-security.conf to include the rules: 
      sudo vi /etc/apache2/mods-available/mod-security.conf
      Add the following line: 
      Include "/etc/modsecurity/owasp-crs/activated_rules/*.conf"
    6. Enable headers module: 
      sudo a2enmod headers
      This to fix the following error:
      Syntax error on line 29 of /etc/apache2/conf.d/modsecurity/optional_rules/modsecurity_crs_49_header_tagging.conf:
Invalid command 'RequestHeader', perhaps misspelled or defined by a module not included in the server configuration
Action 'configtest' failed.
The Apache error log may have more information.
   ...fail!
      when restarting apache2.
  5. Enable ModSecurity module and restart apache2: 
    sudo a2enmod mod-security; sudo /etc/init.d/apache2 restart

See also

8 comments:

  1. SofianJuly 3, 2013 at 8:04 PM

    Very Neat! Thanks Dude!

    ReplyDelete
  2. UnknownJuly 16, 2013 at 10:27 AM

    Thank you very much. This is a great tutorial. You listed just the things that I needed to get this up and running. I think there is one issue with the first command in 4C. In order to move the contents of the folder instead of the folder itself, the command needs a trailing asterisk as here:

    sudo mv SpiderLabs-owasp-modsecurity-crs-5c28b52/* /etc/modsecurity/owasp-crs

    ReplyDelete
  3. UnknownOctober 17, 2013 at 2:14 PM

    thank you very much for your tutorial..

    ReplyDelete
  4. UnknownNovember 5, 2013 at 5:42 PM

    Great tutorial, many thanks for taking the time to put it together. After installing and configuring exactly as recommended, Apache won't serve up any pages without kicking out a "403 Forbidden" error for every single request. I realize the ruleset is likely restrictive, but that's a bit much! :)

    Any quick suggestions to get Apache serving files properly again?

    ReplyDelete
    Replies
    1. HamzaDecember 4, 2013 at 3:30 AM

      Hello Kevin,

      for bypassing your error "404" you must modify /etc/modsecurity/modsecurity.conf --> SecRuleEngine on to DetectionOnly

      good luck

      HM

      Delete
  5. ribafsDecember 7, 2013 at 2:12 PM

    Very good. Tank you.

    ReplyDelete
  6. richelliotJanuary 7, 2014 at 3:08 AM

    Hi,

    I followed your tutorial step by step but get the following error:

    Syntax error on line 53 of /etc/modsecurity/base_rules/modsecurity_crs_20_protocol_violations.conf:
    Error parsing actions: Unknown action: ver
    Action 'configtest' failed.
    The Apache error log may have more information.
    ...fail!

    Any ideas on how to fix it?

    Thanks in advance!

    ReplyDelete
  7. UnknownFebruary 5, 2014 at 10:06 PM

    follow the above tutor will fix the error dude!

    ReplyDelete