Step 1. First, make sure that all your system packages are up-to-date by running these following apt commands in the terminal.
sudo apt update sudo apt upgrade
Step 2. Installing ModSecurity Apache on Ubuntu 20.04.
Now we install the mod security package on the Ubuntu system using the following command:
sudo apt install libapache2-mod-security2
Restart apache service to take mod-security module into account:
sudo systemctl restart apache2
Step 3. Configuration of ModSecurity.
We’ve to start the configure of mod security. you can find the location at /etc/modsecurity:
sudo mv /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf
Next, download the OWASP ModSecurity CRS from Github:
cd ~ git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git
Then, move and rename crs-setup.conf.example to crs-setup.conf. Also, move rules/ directory as well:
cd ~/owasp-modsecurity-crs sudo mv crs-setup.conf.example /etc/modsecurity/crs-setup.conf sudo mv rules/ /etc/modsecurity/
To get these rules working on Apache, you should edit the /etc/apache2/mods-available/security2.conf file:
sudo nano /etc/apache2/mods-available/security2.conf
Add another Include directive pointing to the ruleset:
<IfModule security2_module> # Default Debian dir for modsecurity's persistent data SecDataDir /var/cache/modsecurity # Include all the <strong>.conf files in /etc/modsecurity. # Keeping your local configuration in that directory # will allow for an easy upgrade of THIS file and # make your life easier IncludeOptional /etc/modsecurity/</strong>.conf Include /etc/modsecurity/rules/*.conf </IfModule>
Restart Apache to take changes into effect:
sudo systemctl restart apache2
Step 4. Test ModSecurity Apache.
Now we edit the default Apache configuration file and add two additional directives, using the default configuration as an example:
sudo nano /etc/apache2/sites-available/000-default.conf
Add the following file:
<VirtualHost *:80>
ServerAdmin webmaster@localhost
DocumentRoot /var/www/html
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
SecRuleEngine On
SecRule ARGS:modsecparam "@contains test" "id:4321,deny,status:403,msg:'ModSecurity test rule has triggered'"
</VirtualHost>
Restart Apache to take changes into effect:
sudo systemctl restart apache2
Then, enter the following command:
curl localhost/index.html?modsecparam=test
Src::https://idroot.us/install-modsecurity-apache-ubuntu-20-04/
