I never activated before the mod_security
or edit Virtual Hosts, so it's a new challenge for me, I tried to follow this tutorial but seems that most of the tutorials around the web are not reflecting my situation.
I have an EC2 instance running Apache 2 on Ubuntu 14.04, I don't have a file called httpd, however inside my /etc/apache2/sites-available
folder I have the file called 000-default.conf
:
<VirtualHost *:80>
ServerAdmin webmaster@localhost
DocumentRoot /var/www/html
<IfModule security2_module>
SecRuleEngine Off
</IfModule>
<Directory /var/www >
AllowOverride All
</Directory>
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
and this is my security2.conf
located into /etc/apache2/mods-available
<IfModule security2_module>
SecDataDir /var/cache/modsecurity
Include "/usr/share/modsecurity-crs/*.conf"
Include "/usr/share/modsecurity-crs/activated_rules/*.conf"
IncludeOptional /etc/modsecurity/*.conf
</IfModule>
I wish to enable the mod_security
but right now I cannot because inside ../html
folder (the folder of my wesite) I have Wordpress and phpMyAdmin (so if I remove SecRuleEngine Off, it gives me error permission denied on all the website).
From the tutorial mentioned above I know that I need to use this code for exclude a specific directory:
<Directory "/var/www/wp-admin">
<IfModule security2_module>
SecRuleEngine Off
</IfModule>
</Directory>
What I don't understand is: do I need to create a new .conf file inside /sites-available
? For example, how it should looks like the .conf file to exclude phpMyAdmin directory located into /usr/share/phpmyadmin
?