Q. mod_security supplies an array of request filtering and other security features to the Apache HTTP Server. How do I install mod_security under FreeBSD operating systems?
A. ModSecurity is an open source web application firewall that runs as an Apache module, and version 2.0 offers many new features and improvements.
It provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring and real-time analysis with no changes to existing infrastructure. Some of the features include:
=> Parallel text matching
=> Geo IP resolution
=> Credit card number detection
=> Support for content injection
=> Automated rule updates
=> scripting as well as many others.
FreeBSD install mod_security
Type the following command to update ports tree:
# portsnap fetch update
Under FreeBSD 7, mod_security can be installed by typing the following commands:
# cd /usr/ports/www/mod_security
# make install clean
Configure mod_security
The modsecurity 2 Core Rules have been installed in
/usr/local/etc/apache22/Includes/mod_security2/
By default it run in “DetectionOnly” mode as not to disturb operatings of working websites and Apache. First change directory to /usr/local/etc/apache22/Includes/mod_security2/:
# cd /usr/local/etc/apache22/Includes/mod_security2/
Now, open the ModSecuirty core rule set file – modsecurity_crs_10_config.conf, enter:
# vi modsecurity_crs_10_config.conf
The file is well documented so just customize it according to your requirements. Open httpd.conf file located at /usr/local/etc/apache22 and make sure following line exists:
LoadFile /usr/local/lib/libxml2.so
LoadModule security2_module libexec/apache22/mod_security2.so
Finally, restart the apache:
# /usr/local/etc/rc.d/apache22 restart
Monitoring mod_security log files
By default logs are written to following two files:
- /var/log/httpd-modsec2_audit.log
- /var/log/httpd-modsec2_debug.log
- /var/log/httpd-error.log or virtual domain error.log file
You can detect attacks by viewing these two files using grep or tail:
tail -f /var/log/httpd-modsec2_audit.log
grep cmd.exe /var/log/httpd-modsec2_audit.log
tail -f /home/httpd/example.com/logs/error.log
Once everything started to working perfectly open modsecurity_crs_10_config.conf file and set SecRuleEngine to On:
SecRuleEngine On
Restart apache:
# /usr/local/etc/rc.d/apache22 restart
Further readings:
- Apache Security Book – The real strength of Apache Security lies in its wealth of interesting and practical advice, with many real-life examples and solutions in this book will save your life.
- Modsecurity project
🐧 4 comments so far... add one ↓
| Category | List of Unix and Linux commands |
|---|---|
| Disk space analyzers | df • ncdu • pydf |
| File Management | cat • cp • mkdir • tree |
| Firewall | Alpine Awall • CentOS 8 • OpenSUSE • RHEL 8 • Ubuntu 16.04 • Ubuntu 18.04 • Ubuntu 20.04 |
| Network Utilities | NetHogs • dig • host • ip • nmap |
| OpenVPN | CentOS 7 • CentOS 8 • Debian 10 • Debian 8/9 • Ubuntu 18.04 • Ubuntu 20.04 |
| Package Manager | apk • apt |
| Processes Management | bg • chroot • cron • disown • fg • jobs • killall • kill • pidof • pstree • pwdx • time |
| Searching | grep • whereis • which |
| User Information | groups • id • lastcomm • last • lid/libuser-lid • logname • members • users • whoami • who • w |
| WireGuard VPN | Alpine • CentOS 8 • Debian 10 • Firewall • Ubuntu 20.04 |
When upgrading (with portmanger or the like) any changes you make to the default rules get overwritten. Whats the best way to avoid this?
Also what’s the difference between the mod_security and mod_security21 ports? Which is better?
Create your own custom rule set file and call it from main modsecurity_crs_10_config.conf file. mod_security21 is older version and it is recommended that you use latest stable version supplied by mod_security
by default only *.conf file ( modsecurity_crs_10_config.conf) inside mod_security2
folder is included. you have to include rules inside /usr/local/etc/apache22/Includes/mod_security2/base_rules or just the modsecurity_crs_10_config.conf will work?
Include etc/apache22/Includes/mod_security2/*.conf
I´ve installed mod_security from ports. But there is nothing installed in /usr/local/etc/apache22/Includes.
Am I missing something?