What is ModSecurity

ModSecurity is an open-source web application firewall (WAF) that helps protect web applications from a wide range of attacks, including SQL injection, cross-site scripting (XSS), and other common web vulnerabilities. It works by analyzing HTTP traffic, inspecting requests, and applying rules that detect and block malicious activity. ModSecurity can be integrated with popular web servers like Apache and Nginx, providing a crucial layer of security for your server.

Installing ModSecurity on an Ubuntu VPS

Here’s a step-by-step guide on installing and configuring ModSecurity on an Ubuntu VPS, with examples for both Apache and Nginx.

First, ensure that your system is up-to-date by running the following commands:

ModSecurity can be used with either Apache or Nginx. If you don’t have a web server installed yet, you can install one of them.

- For Apache:

- For Nginx:

ModSecurity is available in Ubuntu’s repositories and can be installed using the following command:

If you’re using Nginx, additional steps are required to compile and install ModSecurity with Nginx. You will also need to install the ModSecurity Nginx connector.

For Apache, the installation is simpler as it automatically integrates with the web server.

After installation, ModSecurity is disabled by default. You need to enable it manually.

- For Apache:

1. Enable the ModSecurity module:

2. Restart Apache to apply the changes:

- For Nginx:

1. Install dependencies:

2. Download and install the ModSecurity Nginx connector from the official GitHub repository. Follow the build instructions to integrate it with Nginx.

3. After compiling and installing the connector, modify the Nginx configuration to load ModSecurity. This requires editing your server block and adding the following directives:

Then restart Nginx:

ModSecurity uses rules to filter traffic and detect attacks. The default configuration file is located at:

To enable ModSecurity in detection mode (which logs potential attacks but doesn’t block them), find the following line and change it to On:

If you want ModSecurity to actively block detected attacks, keep the setting as On. Otherwise, you can set it to DetectionOnly for monitoring purposes.

You can also enable logging by configuring the following directive to specify where the logs should be saved:

Save and exit the file.

To protect your web server effectively, you can install the OWASP ModSecurity Core Rule Set (CRS). This is a set of pre-configured rules designed to detect and block common web application attacks.

1. Download the OWASP CRS:

2. Copy the default rules into your ModSecurity directory:

3. In the ModSecurity configuration file (modsecurity.conf), include the OWASP rule set by adding the following line:

Save and exit the file.

After configuring ModSecurity, restart your web server to apply the changes:

- For Apache:

- For Nginx:

You can verify that ModSecurity is working by checking the audit log file located at:

This log will show detailed information about the HTTP requests that were inspected and either allowed or blocked based on the rules.

Example of Using ModSecurity

Let’s say you want to block SQL injection attacks on your website. With ModSecurity and the OWASP CRS, you don’t need to write custom rules because the OWASP CRS already includes rules to detect and block SQL injections.

For example, if a malicious user tries to exploit a SQL injection vulnerability by entering:

ModSecurity will inspect this request and detect the suspicious pattern. The OWASP CRS contains a specific rule to detect SQL injection attempts, and ModSecurity will either log or block the request depending on the configured mode (detection or prevention).

If the attack is blocked, the HTTP response to the attacker will include a 403 Forbidden status, and the details of the request will be logged in the audit.log file.

If you want to create your own custom rules, ModSecurity allows you to do so. Here’s a simple example of a custom rule that blocks any request containing the string "test":

1. Edit the ModSecurity rules file:

2. Add the following rule to block the string "test":

3. Save the file and restart your web server:

Now, any request containing the string "test" in the query parameters will be blocked.

ModSecurity is a powerful and flexible web application firewall that adds an extra layer of security to your server. By installing and configuring ModSecurity on your Ubuntu VPS, you can protect your web applications from various types of attacks, including SQL injection, XSS, and more. With the OWASP Core Rule Set and custom rules, you can effectively monitor and block suspicious activity, ensuring your server remains secure against common web vulnerabilities.