UPDATE: there were several bugs in my original version – by Debian standards, ModSecurity is damn hard to configure correctly, mainly because the Debian packager has left out so much that’s essential! This version is fully tested and working…<\/p>\n
Mod Security<\/a> is an awesome, open-source product for Apache that will protect your webserver against attackers, using a custom rules-language that lets you easily filter for any kind of website attack. Even better, it comes with a pre-built (and regularly updated) set of “official” default rules for cutting out the majority of common internet attacks.<\/p>\n But, pretty shocking … I tried 10 different tutorials \/ HOWTO’s for this, and each one was wrong. Out of the 10, 6 of them lead to fundamentally insecure \/ misconfigured systems.<\/p>\n Mostly it’s the vendor’s fault for providing huge long-winded webpages in place of basic install instructions. Partly, it’s the Debian packager’s fault for both mis-packaging, and also “forgetting” to document what they’d done (e.g most of the README’s are empty. Grr!). Whatever. Here’s my HOWTO for doing it correctly, and picking up the excellent default security rules, that *should* work with most installs of Debian. Debian packager screwed up, didn’t document this: the main package has no config files. If you install libapache-mod-security, it also installs mod-security-common (note: no apache mentioned), which contains most of the config for this thing (but still not all). Yeah. It’s a bit odd, but that’s how security-based packages sometimes work, so not that unusual.<\/p>\n Still, the main package SHOULD contain the root config file. It doesn’t – tragically, you have to write that yourself<\/p>\n All you need is “libapache-mod-security”. This will also pull-down the other packages needed. So far as I can tell, this is *correctly* packaged by the maintainer – I got no errors for missing packages.<\/p>\n The main config file is missing.<\/p>\n Where do you want to put this? (debian packager: please note + fix this!)<\/p>\n …Personally, I’d go for the debian standard location: \/etc\/apache2\/conf.d\/<\/p>\n What do you call it? (debian packager: please note + fix this!)<\/p>\n …if you compile the vendor-suppled source-code, it’ll call the file “mod-security2.conf”, so let’s use that.<\/p>\n Contents?<\/p>\n \n\t<IfModule mod_security2.c> \t# NB: these are DEBIAN-SPECIFIC – only recommended if you used the official Debian package: <\/IfModule>\n<\/p><\/blockquote>\n Also, create empty versions of those log files (again, the Debian maintainer is supposed to do this!)<\/p>\n After creating the main config file, don’t forget to do an apache:<\/p>\n \n\/etc\/init.d\/apache2 restart\n<\/p><\/blockquote>\n to pick up the new config<\/p>\n Again, this is something that should have been done by the Debian packager – it appears to be necessary as part of the main config if you are following the “official” guidelines (which are optional).<\/p>\n
\n
\n(Also, for future reference, the vendor install docs are empty on their own website. But, if you click random links, you *eventually* find some of the missing pieces<\/a>)<\/p>\nBefore you start<\/h4>\n
Partial install: debian packages<\/h4>\n
Remained of install: config files<\/h4>\n
\n\t# NB: this is the minimal-possible example; see bottom of this post for a more complete example<\/p>\n
\n Include \/usr\/share\/doc\/mod-security-common\/examples\/rules\/*.conf
\n Include \/usr\/share\/doc\/mod-security-common\/examples\/rules\/base_rules\/*.conf
\n\tSecDebugLog \/var\/log\/modsec_debug.log
\n\tSecAuditLog \/var\/log\/modsec_audit.log<\/p>\n\n
Add the user-modified config files<\/h4>\n