[SOLVED] Mod_security installed, no config files

yzT! · 04-07-2014, 07:08 AM

Just installed mod_security in a RedHat 5.5. As this system doesn't have internet connection, I had to download mod_security and install it by configure, make and make install.

At first attempt, the configure failed due to the version of libxml2 (it needs 2.6.29 but RedHat 5 has 2.6.26). Due to this, I had to download an older version of mod_security, 2.6.x (2.7.x requires libxml2 2.6.29), and successfully ran the configure, make and make install.

However, I don't see any of the config files listed here http://www.cyberciti.biz/faq/rhel-fe...configuration/

pingu · 04-07-2014, 12:16 PM

You have to download the config files separately. I think this changed some year(s) ago, I do believe when I started with modsec everything came in one package - but not really sure though.
Anyway, you need to download the ruleset, here's a link: https://github.com/SpiderLabs/owasp-modsecurity-crs
Pick the rules you want, base-rules at least.

yzT! · 04-08-2014, 06:03 AM

what do you mean by separately? From where do I get them? Because at modsecurity's site there is anything related to it.

Habitual · 04-08-2014, 08:02 AM

Here's what I did on CentOS 5.10
This is a general guide and not a recipe

Code:

wget https://codeload.github.com/SpiderLabs/owasp-modsecurity-crs/legacy.tar.gz/master
move master modsecurity-crs_2.2.5.tar.gz
mv master modsecurity-crs_2.2.5.tar.gz
tar ztf modsecurity
tar ztf modsecurity-crs_2.2.5.tar.gz 
tar zxf modsecurity-crs_2.2.5.tar.gz 
mv SpiderLabs-owasp-modsecurity-crs-4ed6347/ modsecurity-crs
rm modsecurity-crs_2.2.5.tar.gz 
cd modsecurity-crs
cp modsecurity_crs_10_setup.conf.example modsecurity_crs_10_config.conf
...
for f in `ls base_rules/` ; do sudo ln -s /etc/httpd/modsecurity-crs/base_rules/$f /etc/httpd/modsecurity.d/acttivated_rules/$f ; done
for f in `ls base_rules/` ; do sudo ln -s /etc/httpd/modsecurity-crs/base_rules/$f /etc/httpd/modsecurity.d/activated_rules/$f ; done
for f in `ls /etc/httpd/modsecurity-crs/base_rules/base_rules/` ; do echo $f; dohe
for f in `ls /etc/httpd/modsecurity-crs/base_rules/base_rules/` ; do echo $f; done
for f in `ls /etc/httpd/modsecurity-crs/base_rules/` ; do echo $f; done

References:
https://www.linuxquestions.org/quest.../#post2122954/

Thanks to unSpawn for his tireless efforts.

yzT! · 04-09-2014, 07:08 AM

I ended up following this tutorial http://www.servermom.org/how-to-inst...he-server/844/

I'm facing a problem right now. After installation, when I try to run Apache I'm getting the following error

Code:

Starting httpd: Syntax error on line 52 of /etc/httpd/modsecurity-crs/base_rules/modsecurity_crs_20_protocol_violations.conf:
Error parsing actions: Unknown action: ver

The line 52 of that file is

Code:

setvar:'tx.%{rule.id}-OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ-%{matched_var_name}=%{matched_var}'"

Any idea?

edit: never mind, it turned out to be that the recent version of the OWASP rules needs at least version 2.7 of ModSecurity. Got the version 2.2.5 of the rules and the problem is gone.

Habitual · 04-09-2014, 12:27 PM

Glad it worked out!

pingu · 04-09-2014, 12:38 PM

Quote:

Originally Posted by yzT!

what do you mean by separately? From where do I get them? Because at modsecurity's site there is anything related to it.

Well, try the link I posted...

Linux_Kidd · 04-09-2014, 10:17 PM

glad to see its working for you.
about ~2yrs ago i did some build docs for a customer, part of it was the modesec2 install & config for apache
attached is pic of that, just as a reference for others, etc.

yzT! · 04-11-2014, 04:28 AM

never mind