1

I'm trying to make the mod_security work, I searched a lot on the web, and followed this tutorial to configure mod_security (all my configuration files are the same as the tutorial), and when I run httpd -M | grep -Ei '(evasive|security)' it outputs

 security2_module (shared)
 evasive20_module (shared)

So the extensions are being loaded, but it doesn't block anything at all, neither write anything on the logs file, I even set the SecDebugLogLevel to 9 and the debug log is still blank.

I tried to load the modules before the others, after the others, in the middle, restarted apache several times, and got nothing.

I am using Amazon Linux (it's like CentOS), with Apache 2.4 Prefork.

masegaloeh
  • 17,978
  • 9
  • 56
  • 104
Rogerio Chaves
  • 107
  • 1
  • 8

1 Answers1

2

Need more information to be able to help (all the relevant apache config from httpd.conf and modsecurity.conf).

However here's some pointers which might help you solve your issue yourself:

Are you using the correct IfModule command? I use mod_security2.c but not sure if that matters:

<IfModule mod_security2.c>
    Include conf/modsecurity.conf
</IfModule>

Have you tried stopping and starting Apache completely (not a graceful restart)?

Is there anything in the error logs after a full stop and restart. It should have some [:notice] entries like this:

ModSecurity for Apache/2.9.0 (http://www.modsecurity.org/) configured.
ModSecurity: APR compiled version="1.5.0"; loaded version="1.5.0"
...etc.

That shows ModSecurity has loaded.

Are there any PCRE errors in the error log file (which can happen if ModSecurity was compiled with a different version of PRCE than Apache)? Run an ldd command against httpd and the mod_security.so to make sure they match. As an FYI I do NOT get any security modules showing when I run that "httpd -M" command on my working version - I think because it's not loaded unless an Include is run.

Is the debug log being created but empty? If it's created then that's a good sign that ModSecurity itself is being loaded.

Are your Apache settings all in /etc/httpd/conf directory like that guide you used is suggesting? Not unknown to have several version's of Apache installed and the one you're editting the config for is not the one being used :-)

I recommend Ivan Ristic's ModSecurity handbook, a taster of which is available free: https://www.feistyduck.com/library/modsecurity-handbook-free/ and this covers installation. Ivan originally wrote ModSecurity so I'd recommend buying the whole book. It's a couple of versions behind but still mostly relevant. Main change not covered by book is that a rule id is now mandatory.

Barry Pollard
  • 4,461
  • 14
  • 26
  • Thanks, your suggestions made me find the problem, on apache error log I could see that mod_unique_id was not enabled, therefore mod_security was not working, I just had to uncomment a line :) – Rogerio Chaves Mar 01 '15 at 22:28