Tag: ModSecurity – ServerOK

Enable ModSecurity in Cpanel Server

Posted on October 1, 2020 by ServerOk

Login to WHM. Go to ModSecurity™ Vendors. By default cpanel come with “OWASP ModSecurity Core Rule Set V3.0” rule. To enable it click on “+ install” link right side. To add a third party rule set, click on “Add Vendor” button. To install comodo WAF rules, enter

https://waf.comodo.com/doc/meta_comodo_apache.yaml

1	https://waf.comodo.com/doc/meta_comodo_apache.yaml

Click “Load”, you will see some info […]

Disable ModSecurity for a specific URL

Posted on April 20, 2020 (April 20, 2020) by ServerOk

On a web site that is protected with ModSecurity, when admin edit HTML pages in admin area, ModSecurity falsely detect it as XSS attack. What we can do is disable specific rules that create this false positive. But in this case, it is bceause HTML is submitted. This application normally done need HTML submitted on […]

Install ModSecurity on Debian

Posted on April 17, 2020 by ServerOk

To install ModSecurity on Debian/Ubuntu Apache web server, run

apt-get install libapache2-mod-security2

1	apt-get install libapache2-mod-security2

Restart Apache web server

service apache2 restart

1	service apache2 restart

Verify mod_security installed with

apachectl -M | grep security

1	apachectl -M \| grep security

To activate ModSecurity rules, run

cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf

1	cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf

Edit

vi /etc/modsecurity/modsecurity.conf

1	vi /etc/modsecurity/modsecurity.conf

set

SecRuleEngine = on

1	SecRuleEngine = on

Get latest rules

mv /usr/share/modsecurity-crs /usr/share/modsecurity-crs.bk
git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git /usr/share/modsecurity-crs

1 2	mv /usr/share/modsecurity-crs /usr/share/modsecurity-crs.bk git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git /usr/share/modsecurity-crs

Emable the config file

cp /usr/share/modsecurity-crs/crs-setup.conf.example /usr/share/modsecurity-crs/crs-setup.conf

1	cp /usr/share/modsecurity-crs/crs-setup.conf.example /usr/share/modsecurity-crs/crs-setup.conf

Edit file

vi  /etc/apache2/mods-enabled/security2.conf

1	vi /etc/apache2/mods-enabled/security2.conf

Add

IncludeOptional /usr/share/modsecurity-crs/*.conf
IncludeOptional "/usr/share/modsecurity-crs/rules/*.conf

1 2	IncludeOptional /usr/share/modsecurity-crs/.conf IncludeOptional "/usr/share/modsecurity-crs/rules/.conf

Restart Apache

service apache2 restart

1	service apache2 restart

[…]

ModSecurity

Posted on February 19, 2018 (April 20, 2020) by ServerOk

Install ModSecurity on Debian Disable ModSecurity for a specific URL ModSecurity is a Web Application Firewall. Protect sites from SQL injection and Application level hacking. To install ModSecurity on Ubuntu/Debian with Apache, run

apt install libapache2-mod-security2 -y

1	apt install libapache2-mod-security2 -y

verify Apache module is installed with

apachectl -M | grep security

1	apachectl -M \| grep security

Enable config file

mv /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf

1	mv /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf

Update config

sed -i "s/SecRuleEngine DetectionOnly/SecRuleEngine On/" /etc/modsecurity/modsecurity.conf
sed -i "s/SecResponseBodyAccess On/SecResponseBodyAccess Off/" /etc/modsecurity/modsecurity.conf

1 2	sed -i "s/SecRuleEngine DetectionOnly/SecRuleEngine On/" /etc/modsecurity/modsecurity.conf sed -i "s/SecResponseBodyAccess On/SecResponseBodyAccess Off/" /etc/modsecurity/modsecurity.conf

Restart Apache

systemctl restart apache2

1	systemctl restart apache2

[…]