In today\u2019s article we will guide you through the process of installing mod_security with the OWASP (Open Web Application Security Project) core rule set on a CentOS 7 from source.<\/p>\n
ModSecurity is a web application firewall engine that provides very little protection on its own. In order to become useful, ModSecurity must be configured with rules. In order to enable users to take full advantage of ModSecurity out of the box, Trustwave\u2019s SpiderLabs created the OWASP ModSecurity Core Rule Set (CRS) Project. Unlike intrusion detection and prevention systems, which rely on signatures specific to known vulnerabilities, the CRS provides generic protection from unknown vulnerabilities often found in web applications, which are in most cases custom coded.<\/p>\n
Prerequisites<\/p>\n
Log in to your your server as user \u201croot\u201d user credentials and make sure that all packages are up to date. You can make use of below command to update your CentOS 7 server.<\/p>\n
# yum -y update
\nAfter system update install the following dependencies as ModSecurity 2.x works only with Apache 2.0.x or higher. Let\u2019s run below command to install apache and its other dependencies as shown below.<\/p>\n
# yum install gcc make httpd-devel libxml2 pcre-devel libxml2-devel curl-devel git
\nsystem prereq<\/p>\n
Installing mod_security<\/p>\n
Get the \u2018mod_security\u2019 source package to install on your server from their official website link .mod_security can be installed in most web servers like Nginx, Apache and even Microsoft IIS. But in this tutorial will cover only on a server running Apache.<\/p>\n
#cd \/opt\/
\n#wget https:\/\/www.modsecurity.org\/tarball\/2.9.1\/modsecurity-2.9.1.tar.gz
\nmod security<\/p>\n
Extract the downloaded archive and change the current working directory to the newly extracted directory using below commands.<\/p>\n
#tar xzfv modsecurity-2.9.1.tar.gz
\n#cd modsecurity-2.9.1
\nNow, using below commands configure, compile and install mod_security from the source code as shown shown.<\/p>\n
#.\/configure
\n# make install
\ninstalling mod_security<\/p>\n
Configure mod_security<\/p>\n
After installation setup of mod_security, copy recommended configuration files.<\/p>\n
# cp modsecurity.conf-recommended \/etc\/httpd\/conf.d\/modsecurity.conf
\n# cp unicode.mapping \/etc\/httpd\/conf.d\/
\nNow we need to configure the Apache web server . Open the web server configuration file and add the following lines in it.<\/p>\n
# vim \/etc\/httpd\/conf\/httpd.conf
\nLoadModule security2_module modules\/mod_security2.so
\nLoadModule unique_id_module modules\/mod_unique_id.so
\nSave the changes using \u2018:wq!\u2019 and restart Apache services.<\/p>\n
# systemctl restart httpd.service
\n# systemctl status httpd.service
\n# systemctl enable httpd.service
\nmod_security configurations<\/p>\n
Installing OWASP<\/p>\n
Now we will install OWSAP CRS to be integrated with Apache\u2019s ModSecurity. Use below commands to download and configure OWASP (Open Web Application Security Project) core rule set for a base configuration.<\/p>\n
# cd \/etc\/httpd
\n# git clone https:\/\/github.com\/SpiderLabs\/owasp-modsecurity-crs.git
\n#mv owasp-modsecurity-crs modsecurity-crs
\n#cd modsecurity-crs
\n#cp modsecurity_crs_10_setup.conf.example modsecurity_crs_10_config.conf
\nNow once again open the Apache configuration file to add the following lines at the end.<\/p>\n
#vim \/etc\/httpd\/conf\/httpd.conf
\nLoadModule security2_module modules\/mod_security2.so
\nLoadModule unique_id_module modules\/mod_unique_id.so
\nSo now you\u2019ve installed Mod_Security and OWASP-CRS, it\u2019s time to restart Apache service so the module can be loaded along with its rules.<\/p>\n
# systemctl restart httpd.service
\nOWASP setup<\/p>\n
Enjoy some basic necessary protection on your Linux CentOS 7 Apache server. It gives you couple of other advantages like below.<\/p>\n
Real-time Blacklist Lookups: utilizes 3rd Party IP Reputation
\nWeb-based Malware Detection: identifies malicious web content by check against the Google Safe Browsing API.
\nIdentification of Application Defects: alerts on application misconfigurations.
\nHTTP Denial of Service Protections: defense against HTTP Flooding and Slow HTTP DoS Attacks.
\nTracking Sensitive Data: Tracks Credit Card usage and blocks leakages.
\nTrojan Protection: Detecting access to Trojans horses.
\nIntegration with AV Scanning for File Uploads \u2013 detects malicious files uploaded through the web application.
\nError Detection and Hiding: Disguising error messages sent by the server.
\nCommon Web Attacks Protection: detecting common web application security attack.
\nAutomation Detection: Detecting bots, crawlers, scanners and other surface malicious activity.
\nHTTP Protection: detecting violations of the HTTP protocol and a locally defined usage policy.<\/p>\n
Conclusion<\/p>\n
mod_security is basically used to protect and monitor real time HTTP traffic and web applications from brute fore attacks and it also acts as intrusion detection and prevention system for web applications. In order to become useful, ModSecurity must be configured with rules which we can then use OWASP (Open Web Application Security Project) which is a Core Rules Set (CRS) for mod_security base configuration. Thank you for reading this and I hope you find this article useful.<\/p>\n","protected":false},"excerpt":{"rendered":"
In today\u2019s article we will guide you through the process of installing mod_security with the OWASP (Open Web Application Security Project) core rule set on a CentOS 7 from source.<\/p>\n
ModSecurity is a web application firewall engine that provides very little protection on its own. In order to become useful, ModSecurity must be configured with […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12,73],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/7003"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7003"}],"version-history":[{"count":1,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/7003\/revisions"}],"predecessor-version":[{"id":7004,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/7003\/revisions\/7004"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7003"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7003"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7003"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}