ModSecurity is an open-source web application firewall that monitors incoming web requests to a web server in real time. It protects your web application against attacks such as session hijacking, SQL injection, cross-site scripting, etc., on web applications using the added rulesets. It is supported by the web browsers such as Apache, Nginx, and IIS.
Please refer to the following steps to install mod security on CentOS 7.x –
1. First, run the below command to update the software repository –
sudo yum update -y
2. Install ModSecurity using the command given below –
sudo yum install mod_security -y
3. You can check the mod security version with this command –
sudo yum info mod_security
Configure ModSecurity
After the installation, configure ModSecurity to detect and log any suspicious activity.
1. We will copy the default ModSecurity config file to a new file.
sudo cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf
2. Open the ModSecurity.conf file in your preferred editor.
vi /etc/modsecurity/modsecurity.conf
3. At the top of the file, locate SecRuleEngine DetectionOnly. Change the DetectionOnly to On.
DetectionOnly On
4. Save your changes to the ModSecurity.conf file.
5. Restart the Apache service on your server.
systemctl restart apache2
How to Download OWASP Core Rule Set
We can download the latest ModSecurity core ruleset (CRS) from the Open Web Application Security Project (OWASP) at CoreRuleSet.org to ensure that we have the latest ModSecurity rules.
1. Run the below command to install Git –
sudo yum install git
2. Download the CRS copy from git using this command –
git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git
3. Open it with the cd command.
cd owasp-modsecurity-crs
4. Move the CRS file and the rules to mod security.
sudo mv crs-setup.conf.example /etc/modsecurity/crs-setup.conf
sudo mv rules/ /etc/modsecurity
5. Open the security2.conf file and verify that it is set to load mod_security rules.
sudo nano /etc/apache2/mods-enabled/security2.conf
6. The two lines given below should remain uncommented –
IncludeOptional /etc/modsecurity/*.conf
Include /etc/modsecurity/rules/*.conf
7. Restart the Apache service with this command –
sudo systemctl restart httpd.service
