How to Install the Mod Security Apache Module on Ubuntu & Debian

ModSecurity is a powerful, open-source web application firewall (WAF) that acts as a shield, protecting your web applications from a wide range of threats. By integrating ModSecurity with your Apache web server on Ubuntu or Debian, you gain an additional layer of security for your website, guarding against common exploits and malicious traffic. This tutorial will guide you through the process of installing the Mod Security Apache Module on an Ubuntu server running Apache.

Prerequisites

Before starting the installation, ensure you have the following:

• An Ubuntu or Debian server.
• Apache web server installed and running.
• Root or sudo privileges.
• A stable internet connection.

Step 1: Install Required Dependencies

To successfully install Mod Security Apache Module, you need to install some necessary dependencies. Execute the following command in your terminal to fetch and install these dependencies:

$ sudo apt-get install -y libapache2-mod-security2

This command utilizes the apt-get package manager to install libapache2-mod-security2, which contains the ModSecurity module and its associated libraries. The -y flag automatically confirms the installation, preventing prompts during the process.

Step 2: Enable the Mod Security Apache Module

Once the dependencies are installed, you need to enable the ModSecurity module within Apache. Run the following command:

$ sudo a2enmod security2

The a2enmod command is an Apache tool that enables specified modules. In this case, it activates security2, which is the identifier for the ModSecurity module.

Step 3: Configure Apache to Use the ModSecurity Apache Module

After enabling the module, you need to configure Apache to utilize it effectively. This involves editing the Apache configuration file for ModSecurity, typically located at /etc/apache2/mods-enabled/security2.conf.

Open this file using your preferred text editor (e.g., nano, vim):

$ sudo nano /etc/apache2/mods-enabled/security2.conf

Within this file, you can customize various ModSecurity settings, such as enabling or disabling specific rules, adjusting the paranoia level, and configuring logging. The default configuration usually provides a good starting point. Remember to thoroughly review the available options and tailor them to your specific security needs.

Step 4: Restart Apache

Finally, after making changes to the configuration, you must restart Apache for the changes to take effect. Use the following command:

$ sudo systemctl restart apache2

This command instructs the system to restart the Apache web server, applying the new ModSecurity configuration.

Now, the Mod Security Apache Module should be successfully installed and configured on your Ubuntu server. You can verify the installation by examining the Apache error log (usually located at /var/log/apache2/error.log) for ModSecurity-related messages or by running the apache2ctl -M command to list all loaded Apache modules. Furthermore, you can explore the default rules provided with the module in the /usr/share/modsecurity-crs/ directory and customize them to suit your specific requirements.

Alternative Solutions

While the above method is a standard approach to installing Mod Security Apache Module, here are two alternative solutions, each with its own advantages and considerations:

1. Using the OWASP Core Rule Set (CRS) with a Custom Configuration

This method involves installing ModSecurity as described above, but instead of relying solely on the default configuration, it leverages the OWASP (Open Web Application Security Project) Core Rule Set (CRS). The CRS is a widely recognized and regularly updated set of rules designed to protect against common web application vulnerabilities.

Explanation:

The OWASP CRS provides a more comprehensive and proactive security posture compared to the default ModSecurity configuration. It includes rules that address various attack vectors, such as SQL injection, cross-site scripting (XSS), and remote file inclusion (RFI).

Steps:

1. Install ModSecurity: Follow steps 1 and 2 from the original instructions.

2. Install the OWASP CRS:

   $ sudo apt-get install modsecurity-crs

3. Configure ModSecurity to use the CRS: Modify the /etc/apache2/mods-enabled/security2.conf file to include the CRS configuration. You’ll likely need to comment out the default rules and include the CRS rules. This generally involves adding the following lines (or similar, depending on the CRS version):

   IncludeOptional /usr/share/modsecurity-crs/crs-setup.conf
   IncludeOptional /usr/share/modsecurity-crs/rules/*.conf

4. Customize the CRS (Optional): The CRS offers various configuration options to fine-tune its behavior. You can adjust the paranoia level, enable or disable specific rules, and configure logging. The crs-setup.conf file contains many of these options.

5. Restart Apache: sudo systemctl restart apache2

Advantages:

• Enhanced security posture due to the comprehensive ruleset.
• Regularly updated rules to address emerging threats.
• Customizable configuration to suit specific needs.

Disadvantages:

• More complex configuration compared to the default setup.
• Potential for false positives (legitimate requests being blocked). Requires careful tuning.

2. Using a Docker Container with ModSecurity Pre-configured

This method involves using a Docker container that already has Apache and ModSecurity pre-installed and configured.

Explanation:

Docker containers provide a lightweight and portable way to deploy applications. Using a pre-configured container simplifies the installation process and ensures consistency across different environments.

Steps:

1. Install Docker: If you don’t have Docker installed, follow the official Docker installation instructions for your Ubuntu or Debian system.

2. Pull a Docker Image with ModSecurity: Search for a suitable Docker image on Docker Hub. Look for images that are well-maintained and specifically designed for Apache with ModSecurity. For example, you might find an image like owasp/modsecurity-crs:apache.

   $ docker pull owasp/modsecurity-crs:apache

3. Run the Docker Container:

   $ docker run -d -p 80:80 -p 443:443 -v /path/to/your/website:/var/www/html owasp/modsecurity-crs:apache

   • -d: Runs the container in detached mode (in the background).
   • -p 80:80 -p 443:443: Maps ports 80 and 443 on the host machine to the corresponding ports in the container.
   • -v /path/to/your/website:/var/www/html: Mounts a volume, mapping the directory containing your website files on the host machine to the Apache document root inside the container. Replace /path/to/your/website with the actual path to your website files.

4. Access your Website: Your website should now be accessible through your server’s IP address or domain name. ModSecurity is running within the container and protecting your application.

Advantages:

• Simplified installation and configuration.
• Consistent environment across different deployments.
• Isolation of the web server and ModSecurity from the host system.

Disadvantages:

• Requires familiarity with Docker.
• May require more resources compared to a native installation.
• Updates to ModSecurity and Apache require rebuilding the Docker image or pulling a newer version.

These alternative solutions offer different approaches to securing your web application with Mod Security Apache Module. The choice depends on your specific requirements, technical expertise, and preferred deployment method. Remember to thoroughly test your configuration after implementing any changes to ensure it functions as expected and doesn’t introduce any unintended issues.