Requirements

• AWS Account. Create your own AWS Account
• Amazon EC2 Ubuntu 18.04. Learn how to deploy Ubuntu 18.04 on AWS
• A user with sudo privilege command.

To get started, This guide shows you step process on how to install ModSecurity for Apache2 on Ubuntu 18.04 within Amazon EC2 instance.

Step 1. Install Apache2 Web Server

SSH remote into your Ubuntu server using your favorite terminal console. Below, you need to install an Apache2 web server for you to enable the Modsecurity module and configuring the security rules set.

sudo add-apt-repository ppa:ondrej/apache2
sudo apt update
sudo apt-get install apache2 -yCopy

See: Learn how to install Apache2 Web Server on EC2 Ubuntu 18.04

We assume that you have already installed Apache2 Web Server in your Ubuntu server.

Step 2. Install Modsecurity

To install modsecurity on EC2 Ubuntu instance, run the command:

sudo apt-get install libapache2-mod-security2Copy

After installation completes, restart the Apache2 service.

sudo service apache2 restartCopy

Now verify the modsecurity module if properly installed on your environment, run the command:

sudo apachectl -M | grep securityCopy

The output should be the same as below:

security2_module (shared)Copy

Step 3. Configure Modsecurity

After installing Modsecurity, there is a default configuration file that you need to enable and configure. Run the command:

sudo cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.confCopy

Modify the file that you have copied using the vim editor.

sudo vim /etc/modsecurity/modsecurity.confCopy

Find for SecRuleEngine DetectionOnly and replace with SecRuleEngine On.

# SecRuleEngine DetectionOnly
SecRuleEngine OnCopy

Save and close the file.

Restart the Apache2 service to effect the changes.

sudo service apache2 restartCopy

Step 4. Setup Rules for Modsecurity

ModSecurity has default rules set located at /usr/share/modsecurity-crs directory. Well, do not recognize these rules as we need to download the recommended latest version from Coreruleset.org

Create a new folder under the Apache directory, use the command:

sudo mkdir /etc/apache2/modsecurity.dCopy

Now, download the Modsecurity core rule set from Github using:

sudo git clone https://github.com/coreruleset/coreruleset.git /etc/apache2/modsecurity.d/owasp-modsecurity-crsCopy

After downloads completed, open the modsecurity folder under apache2 directory.

cd /etc/apache2/modsecurity.d/owasp-modsecurity-crsCopy

Next, copy the sample configuration file from the downloaded rules set, type command:

sudo cp crs-setup.conf.example crs-setup.confCopy

Edit the Apache2 configuration file using:

sudo vim /etc/apache2/apache2.confCopy

Add the lines below:

Save and close the file.

Next, open the file at /etc/apache2/mods-available/security2.conf and comment the line:

# IncludeOptional /usr/share/modsecurity-crs/owasp-crs.loadCopy

Save and close the file.

Next, verify your Apache2 configuration using:

sudo apache2ctl configtestCopy

If all goes well, begin to restart your Apache2 service.

sudo service apache2 restartCopy

Make sure to check your website to see if it’s still running properly.

Step 5. Testing Modsecurity

You can now try to execute a malicious URL in a browser or terminal console and see if the ModSecurity rules are triggered.

Browser

https://linuxbeast.com/index.html?exec=/bin/bashCopy

After running the URL on the browser, you should get a Forbidden error message like this:

Terminal Console

curl -I https://linuxbeast.com/index.html?exec=/bin/bashCopy

After running command in the terminal console, this would be the forbidden error message looks like:

To learn more about Modsecurity:

See: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)

Extra Tips

If you want to excludes directories or removing rules set from match URI, use the guides below:

Execution error – PCRE limits exceeded (Error)

Solutions: Increase the limits

SecPcreMatchLimit 500000
SecPcreMatchLimitRecursion 500000Copy

Modify this file:

sudo vim /etc/modsecurity/modsecurity.confCopy

See: https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/656#issuecomment-262780221

MULTIPART_UNMATCHED_BOUNDARY (Error)

Solution: Modify SecRule

From:

SecRule MULTIPART_UNMATCHED_BOUNDARY "!@eq 0" \
"id:'200004',phase:2,t:none,log,deny,msg:'Multipart parser detected a possible unmatched boundary.'"Copy

To:

SecRule MULTIPART_UNMATCHED_BOUNDARY "!@eq 0" \
"id:'200004',phase:2,t:none,nolog,allow,msg:'Multipart parser detected a possible unmatched boundary.'"Copy

Disable/Enable ModSecurity Per Directory

<Directory /usr/share/phpmyadmin>
     SecRuleEngine Off
</Directory>Copy

<Directory /var/www/wordpress>
     SecRuleEngine On
</Directory>Copy

Removing Rules Set from WordPress match URI

Posted on: July 12, 2023, by : Julian's | 87 views