Apache2 : Configure mod_security2021/09/08

	Enable [mod_security] module to configure Web Application Firewall (WAF).
[1]	Install [mod_security].

root@www:~#

apt -y install libapache2-mod-security2

[2]	Enable [mod_security].

root@www:~#

cp -p /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf

root@www:~#

vi /etc/modsecurity/modsecurity.conf

    # line 7 : [SecRuleEngine DetectionOnly] is set as default, it does not block actions
    # if yoy'd like to block actions, change to [SecRuleEngine On]
    SecRuleEngine DetectionOnly
    SecRequestBodyAccess On
    SecRule REQUEST_HEADERS:Content-Type "text/xml" \
         "id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
    SecRequestBodyLimit 13107200
    SecRequestBodyNoFilesLimit 131072
    SecRequestBodyInMemoryLimit 131072
    SecRequestBodyLimitAction Reject
    SecRule REQBODY_ERROR "!@eq 0" \
.....
.....

[3]	It's possible to write a rule like follows. ⇒ SecRule VARIABLES OPERATOR [ACTIONS] Each parameter has many kind of values, refer to official documents below. https://github.com/SpiderLabs/ModSecurity/wiki
[4]	For Exmaple, set some rules and verify it works normally.

root@www:~#

vi /etc/modsecurity/localrules.conf

# default action when matching rules

SecDefaultAction "phase:2,deny,log,status:406"

# [etc/passwd] is included in request URI

SecRule REQUEST_URI "etc/passwd" "id:'500001'"

# [../] is included in request URI

SecRule REQUEST_URI "\.\./" "id:'500002'"

# [<SCRIPT] is included in arguments

SecRule ARGS "<[Ss][Cc][Rr][Ii][Pp][Tt]" "id:'500003'"

# [SELECT FROM] is included in arguments

SecRule ARGS "[Ss][Ee][Ll][Ee][Cc][Tt][[:space:]]+[Ff][Rr][Oo][Mm]" "id:'500004'"

root@www:~#

systemctl restart apache2

[5]	Access to the URI which includes words you set and verify it works normally.

[6]	The logs for [mod_security] is placed in the directory like follows.

root@www:~#

cat /var/log/apache2/modsec_audit.log

--7c41665f-H--
Message: Access denied with code 406 (phase 2). Pattern match "<[Ss][Cc][Rr][Ii][Pp][Tt]" at ARGS:q. [file "/etc/modsecurity/localrules.conf"] [line "7"] [id "500003"]
Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 10.0.0.5] ModSecurity: Access denied with code 406 (phase 2). Pattern match "<[Ss][Cc][Rr][Ii][Pp][Tt]" at ARGS:q. [file "/etc/modsecurity/localrules.conf"] [line "7"] [id "500003"] [hostname "www.srv.world"] [uri "/"] [unique_id "YTgW71AlgGzIASC6x4ztgwAAAEU"]
Action: Intercepted (phase 2)
Stopwatch: 1631065839397361 1169 (- - -)
Stopwatch2: 1631065839397361 1169; combined=572, p1=454, p2=12, p3=0, p4=0, p5=106, sr=50, sw=0, l=0, gc=0
Response-Body-Transformed: Dechunked
Producer: ModSecurity for Apache/2.9.3 (http://www.modsecurity.org/); OWASP_CRS/3.3.0.
Server: Apache
Engine-Mode: "ENABLED"

--7c41665f-Z--

.....
.....

Matched Content