APACHE PROTECTION WITH MODSECURITY
There are so many ways to protect Web-server. On this post, I’m going to guide how to use ModSecurity WAF to protect Apache webserver.
ModSecurity is an open source, cross-platform web application firewall (WAF) developed by Trustwave’s SpiderLabs. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging, and real-time analysis. With over 10,000 deployments world-wide, ModSecurity is the most widely deployed WAF in existence. ModSecurity – this firewall is designed as a module for the Apache, which allows it easily install and use. Protection using ModSecurity can prevent:
- SQL-injection;
- XSS;
- Trojans;
- bots;
- capture session;
- and many other attacks and break-ins.
Install ModSecurity
apt-get install libapache2-mod-security2
and turn it on:
a2enmod security2
By default filtering rules are not included, and the rules themselves have the extension .conf and loaded from the directory /etc/ModSecurity/ (rules specified location in the /etc/apache2/mods-available/security2.conf file) and is as follows:
IncludeOptional /etc/modsecurity/*.conf
The list can be several directories from which the rules are loaded.
Add a new directory, which will be based on our rules.
crs – for a basic set of rules;
custom – to its rules.
Add a directory for further expansion of the list of rules:
IncludeOptional /etc/modsecurity/rules/crs/*.conf
IncludeOptional /etc/modsecurity/rules/custom/*.conf
and create the required directories:
mkdir /etc/modsecurity/rules/crs
mkdir /etc/modsecurity/rules/custom
Thereafter including basic configuration. To do this, copy or rename the default configuration file (located in the directory /etc/ModSecurity/) modsecurity.conf-recommended file modsecurity.conf
cp /etc/modsecurity/modsecurity.conf{-recommended,}
little change it:
replace the first Directive SecRuleEngine DetectionOnly on
SecRuleEngine On
including blocking, available options: On, Off, DetectionOnly.
Allowed to scan the contents of the request body:
SecRequestBodyAccess On
Limit the size of POST query parameter SecRequestBodyLimit. If there is no file download mechanism on the server, you can severely limit the transmitted data. We are limited to 15MB. The number of bytes it will be 1024 * 1024 * 15 = 15728640
SecRequestBodyLimit 15728640
Restrict stored in memory POST request when sending the file (except the file size), the surplus will swap to disk, which slows things down a little but does not overwhelm the memory under any circumstances. This is done in parameter SecRequestBodyInMemoryLimit . Restrict 128Kb.
SecRequestBodyInMemoryLimit 131072
The basic rules are set, and an advanced set can be downloaded from the official page of OWASP ModSecurity Core Rule Set and put *.conf files in the previously specified directory /etc/ModSecurity/rules/crs , where our additional rules.
In Debian additional rules are already included in the package and is located at /usr /share/ModSecurity-crs/ .
Turn them into a folder by creating symlinks crs :
ln -s /usr/share/modsecurity-crs/modsecurity_crs_10_setup.conf /etc/modsecurity/rules/crs/modsecurity_crs_10_setup.conf
It is also required for some sets of rules *.data files. Therefore, they also need to make symlinks.
I’ve included a basic setting modsecurity_crs_10_setup.conf and some of the rules in the folder base_rules.
It is not necessary to include all the rules at once. With great probability, it will block the Web server.
It now remains only to exclude directories that ModSecurity well or need to interfere.
This is done by exclusion from the list of monitored hosts to configure Apache Web-server . To exclude the entire virtual host use the following code:
<ifmodule security2_module>
SecRuleEngine Off
</ifmodule>
this code can be used to exclude specific directories:
<directory “/var/www/noModSecurity”>
<ifmodule security2_module>
SecRuleEngine Off
</ifmodule>
</directory>
Now a few words about the proper implementation. Many of the rules can cause a denial of work Web applications. Due to the fact that ModSecurity deemed malicious requests. Therefore it is better to include only first detection mode ( SecRuleEngine DetectionOnly ) and see which rules apply and when.
See what rules can be practiced in the log file. By default it is at /var/log/apache2/modsec_audit.log . This file is written all information about the work of ModSecurity.
