What is ModSecurity? Why Should We Use ModSecurity

ModSecurity is an open-source web application firewall. It is available as a module for the Apache Server, and also Microsoft IIS and Nginx web server. It provides a rule configuration language (SecRules) for real-time monitoring, logging, and filtering of HTTP communications. ModSecurity is probably most commonly used to add protection against general vulnerabilities using the rule set from OWASP (CRS).

Why Should We Use ModSecurity

There are a few things we must perform on a server to increase security. First among them is disabling root login and Enabling PEM Certificate Based SSH Login. Second is closing the unused open ports and enabling iptables (or UFW), third is installing fail2ban, forth is adding some security headers, fifth is adding SSL/TLS certificate, sixth is installing ModSecurity. Of course, there are more such as installing ClamAV, performing security audits, hardening Apache and MariaDB, hardening PHP, installing VSFTD, taking nightly backups and so on. But usually, the mentioned first 6-7 points are almost mandatory to prevent getting hacked.

ModSecurity allows us to do many of the things we want to do to enhance security for our server. Almost all of the dedicated & cloud server web hosts have guides on installing Modsecurity and all of them have pointed out the importance of not ignoring ModSecurity. It enables:

1. Security monitoring
2. Access control
3. Security assessment
4. Fine tuned logging
5. Overall security of the web applications running on the server

Most importantly, it is free and supported by developers and sysadmins throughout the globe. Even on a test server running Apache, we suggest installing at least Fail2Ban and ModSecurity.

How to Install ModSecurity

This is not a specific how-to-guide, yet we are describing the basic steps:

Open /etc/apache2/mods-enabled/security2.conf file:

Uncomment:

Next, move/rename this file:

Open the ModeSecurity configuration file:

Add these:

Restart Apache:

Actually for Ubuntu server, the above configuration is enough since the ModSecurity Core Rule Set already included by the repo version. I am not a security expert, but I guess that is enough for the ordinary users. This will not create odd conflicts or disturb Apache2 from restarting after a reboot. The rules can be found here:

The advanced users may perform the extra steps. The above setup is enough for hosting a WordPress blog.

Naturally, if you want to replace the repo provided ModSecurity Core Rule Set to manually downloaded ModSecurity Core Rule Set from GitHub, you have to remove all the content from /usr/share/modsecurity-crs. Else, you’ll face error like this one announcing ModSecurity: Found another rule with the same id:

If you are an advanced user, then delete the content of /usr/share/modsecurity-crs and proceed. Download the latest ruleset from here:

Something like this:

Add these lines:

Restart Apache:

Please remember that when the package will get updated by Ubuntu repo, unless you manually check the configuration and files, Apache2 may fail to restart after a reboot. Because the ModSecurity Core Rule Set from repo will get downloaded automatically.

Go to /etc/logrotate.d/:

Add this if the file does not exist:

You can update the rules with this command: