[HOWTO] Mod_Security

[Bushrat]

Source: eth0.us

This guide is going to show you how to install and configure mod_security which will help protect your server from exploits that are passed though apache. Mod_security does this by inspecting the information sent in apache and filtering out all of the "bad" requests as determined by the set of rules specified in the httpd.conf. The ruleset that I use in this guide will block out most of the common exploits, including the nosanity phpbb worms. It should also block out most of the other common methods of hacking a server passed though php.

First we will download and unzip mod_security.

-----command-----

wget http://www.modsecurity.org/download/mod_se...ty-1.8.6.tar.gz

tar zxf mod_security-1.8.6.tar.gz

-----command-----

If you are using Apache 1.3.x you need to go into the apache1 directory as shown below. Cpanel and ensim both use apache 1.3.x

-----command-----

cd mod_security-1.8.6/apache1

-----command-----

If you are using Apache 2.x you need to go into the apache 2 directory as shown below. Plesk uses apache 2.x and may require the httpd-devel rpm to be installed to get mod_security working.

-----command-----

cd mod_security-1.8.6/apache2

-----command-----

Next compile mod_security at a module. One of the lines below should work to compile it.

-----command-----

/etc/httpd/bin/apxs -cia mod_security.c

-----command-----

If you get a file not found install httpd-devel using up2date then try to compile it again. This will work fine on Plesk and the newer versions of Ensim that do not use "ensimized" httpd rpms. If you are running below Ensim 4.0 you should not continue unless you are certain of what you are doing.

-----command-----

up2date -i httpd-devel

/usr/sbin/apxs -cia mod_security.c

-----command-----

Make a backup of your httpd.conf before touching anything so you have something to go back to if it does not work.

-----command-----

cp /etc/httpd/conf/httpd.conf /etc/httpd/conf/httpd.conf-mod_sec

-----command-----

Now edit the httpd.conf , even though Ensim has multiple httpd.conf files you can put it in the primary config.

-----command-----

pico -w /etc/httpd/conf/httpd.conf

-----command-----

If you are running Apache 1.3.x - cPanel and Pre 4.0 Ensim

Scroll down below the following line:

AddModule mod_security.c

If you do not have the addmodule line find where the rest of them are located and put it right below the others.

If you are running Apache 2.x (Plesk and Ensim 4.0+)

Scroll down below the following line at which point you can continue on and paste the ruleset.

LoadModule security_module modules/mod_security.so

Now you are going to paste in this ruleset. Please feel free to modify it as you see fit. I think that it is a very non-agreesive ruleset that will work fine on just about any server. Please post any problems you have with it below!

----Ruleset----

<IfModule mod_security.c>

# Turn the filtering engine On or Off

SecFilterEngine On

# Change Server: string

SecServerSignature "Apache"

# This setting should be set to On only if the Web site is

# using the Unicode encoding. Otherwise it may interfere with

# the normal Web site operation.

SecFilterCheckUnicodeEncoding Off

# The audit engine works independently and

# can be turned On of Off on the per-server or

# on the per-directory basis. "On" will log everything,

# "DynamicOrRelevant" will log dynamic requests or violations,

# and "RelevantOnly" will only log policy violations

SecAuditEngine RelevantOnly

# The name of the audit log file

SecAuditLog logs/audit_log

# Should mod_security inspect POST payloads

SecFilterScanPOST On

# Action to take by default

SecFilterDefaultAction "deny,log,status:403"

## ## ## ## ## ## ## ## ## ##

## ## ## ## ## ## ## ## ## ##

# Require HTTP_USER_AGENT and HTTP_HOST in all requests

# SecFilterSelective "HTTP_USER_AGENT|HTTP_HOST" "^$"

# Require Content-Length to be provided with

# every POST request

SecFilterSelective REQUEST_METHOD "^POST$" chain

SecFilterSelective HTTP_Content-Length "^$"

# Don't accept transfer encodings we know we don't handle

# (and you don't need it anyway)

SecFilterSelective HTTP_Transfer-Encoding "!^$"

# Protecting from XSS attacks through the PHP session cookie

SecFilterSelective ARG_PHPSESSID "!^[0-9a-z]*$"

SecFilterSelective COOKIE_PHPSESSID "!^[0-9a-z]*$"

SecFilter "viewtopic\.php\?" chain

SecFilter "chr\(([0-9]{1,3})\)" "deny,log"

# Block various methods of downloading files to a server

SecFilterSelective THE_REQUEST "wget "

SecFilterSelective THE_REQUEST "lynx "

SecFilterSelective THE_REQUEST "scp "

SecFilterSelective THE_REQUEST "ftp "

SecFilterSelective THE_REQUEST "cvs "

SecFilterSelective THE_REQUEST "rcp "

SecFilterSelective THE_REQUEST "telnet "

SecFilterSelective THE_REQUEST "ssh "

SecFilterSelective THE_REQUEST "echo "

SecFilterSelective THE_REQUEST "links -dump "

SecFilterSelective THE_REQUEST "links -dump-charset "

SecFilterSelective THE_REQUEST "links -dump-width "

SecFilterSelective THE_REQUEST "links http:// "

SecFilterSelective THE_REQUEST "links ftp:// "

SecFilterSelective THE_REQUEST "links -source "

SecFilterSelective THE_REQUEST "mkdir "

SecFilterSelective THE_REQUEST "cd /tmp "

SecFilterSelective THE_REQUEST "cd /var/tmp "

SecFilterSelective THE_REQUEST "cd /etc/httpd/proxy "

</IfModule>

---/Ruleset---

Now simply restart apache to enable mod_security.

-----command-----

service httpd restart

-----command-----

If sites start to have problems look at error log.

/etc/httpd/logs/audit_log

If you need or want to remove mod_security at any time simply comment out (put a # in front of) the AddModule mod_security.c line and restart apache. This will disable all of the rules and not allow it to load into apache.

Ok mod_security is all setup. I would tail the audit log occasionally to see if it is causing any trouble with legit traffic. The ruleset above should not cause many problems though. Thanks to all that have helped with the rules for this especially ryan at rfxnetworks and err0r.