View source for Install Modsecurity di Apache

==Installing ModSecurity==

* ModSecurity can be installed by running the following command in your terminal:
<syntaxhighlight lang="bash">
sudo apt install libapache2-mod-security2 -y
</syntaxhighlight>

* Alternatively, you can also build ModSecurity manually by cloning the official ModSecurity Github repository.
* After installing ModSecurity, enable the Apache 2 headers module by running the following command:
<syntaxhighlight lang="bash">
sudo a2enmod headers
</syntaxhighlight>

* After installing ModSecurity and enabling the header module, you need to restart the apache2 service, this can be done by running the following command:
<syntaxhighlight lang="bash">
sudo systemctl restart apache2
</syntaxhighlight>

* You should now have ModSecurity installed. The next steps involves enabling and configuring ModSecurity and the OWASP-CRS.

==Configuring ModSecurity==

* ModSecurity is a firewall and therefore requires rules to function. This section shows you how to implement the OWASP Core Rule Set. First, you must prepare the ModSecurity configuration file.
* Remove the <code>.recommended</code> extension from the ModSecurity configuration file name with the following command:

<syntaxhighlight lang="bash">
sudo cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf
</syntaxhighlight>

* With a text editor such as vim, open /etc/modsecurity/modsecurity.conf and change the value for SecRuleEngine to On:



<syntaxhighlight lang="bash">
vim /etc/modsecurity/modsecurity.conf
</syntaxhighlight>

<syntaxhighlight lang="bash">
# -- Rule engine initialization ----------------------------------------------

# Enable ModSecurity, attaching it to every transaction. Use detection
# only to start with, because that minimises the chances of post-installation
# disruption.
#
SecRuleEngine On
...
</syntaxhighlight>

* Restart Apache to apply the changes:
<syntaxhighlight lang="bash">
sudo systemctl restart apache2
</syntaxhighlight>

* ModSecurity should now be configured to run. The next step in the process is to set up a rule set to actively prevent your web server from attacks.

==Setting Up the OWASP ModSecurity Core Rule Set==
The OWASP ModSecurity Core Rule Set (CRS) is a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls. The CRS aims to protect web applications from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts. The CRS provides protection against many common attack categories, including SQL Injection, Cross Site Scripting, and Local File Inclusion.

To set up the OWASP-CRS, follow the procedures outlined below.

* First, delete the current rule set that comes prepackaged with ModSecurity by running the following command:
<syntaxhighlight lang="bash">
sudo rm -rf /usr/share/modsecurity-crs
</syntaxhighlight>

* Ensure that git is installed:
<syntaxhighlight lang="bash">
sudo apt install git
</syntaxhighlight>

* Clone the OWASP-CRS GitHub repository into the <code>/usr/share/modsecurity-crs</code> directory:

<syntaxhighlight lang="bash">
sudo git clone https://github.com/coreruleset/coreruleset /usr/share/modsecurity-crs
</syntaxhighlight>

Rename the <code>crs-setup.conf.example</code> to <code>crs-setup.conf</code>:

<syntaxhighlight lang="bash">
sudo mv /usr/share/modsecurity-crs/crs-setup.conf.example /usr/share/modsecurity-crs/crs-setup.conf
</syntaxhighlight>

* Rename the default request exclusion rule file:
<syntaxhighlight lang="bash">
sudo mv /usr/share/modsecurity-crs/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example /usr/share/modsecurity-crs/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
</syntaxhighlight>

* You should now have the OWASP-CRS setup and ready to be used in your Apache configuration.

==Enabling ModSecurity in Apache 2==
To begin using ModSecurity, enable it in the Apache configuration file by following the steps outlined below:

* Using a text editor such as vim, edit the /etc/apache2/mods-available/security2.conf file to include the OWASP-CRS files you have downloaded:
<syntaxhighlight lang="bash">
vim /etc/apache2/mods-available/security2.conf
</syntaxhighlight>

<syntaxhighlight lang="apacheconf">
<IfModule security2_module>
        SecDataDir /var/cache/modsecurity
        Include /usr/share/modsecurity-crs/crs-setup.conf
        Include /usr/share/modsecurity-crs/rules/*.conf
</IfModule>
</syntaxhighlight>

* In <code>/etc/apache2/sites-enabled/000-default.conf</code> file VirtualHost block, include the SecRuleEngine directive set to On.


<syntaxhighlight lang="bash">
vim /etc/apache2/sites-enabled/000-default.conf
</syntaxhighlight>

<syntaxhighlight lang="apacheconf">
<VirtualHost *:80>
        ServerAdmin webmaster@localhost
        DocumentRoot /var/www/html

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        SecRuleEngine On
</VirtualHost>
</syntaxhighlight>

* If you are running a website that uses SSL, add SecRuleEngine directive to that website’s configuration file as well. See our guide on SSL Certificates with Apache on Debian & Ubuntu for more information.
* Restart the apache2 service to apply the configuration:
<syntaxhighlight lang="bash">
sudo systemctl restart apache2
</syntaxhighlight>

* ModSecurity should now be configured and running to protect your web server from attacks. You can now perform a quick test to verify that ModSecurity is running.

==Source==
*[https://www.linode.com/docs/guides/configure-modsecurity-on-apache/ linode.com]
[[Category:Security]]
[[Category:Server]]
[[Category:Website]]
[[Category:Web Server]]
[[Category:ModSecurity]]