Apache Cookbook, 2nd Edition

2.9. Installing mod_security

Problem

You want to install the mod_security module to take advantage of its simple and powerful filtering mechanisms.

Solution

1. Download mod_security and the core rules from http://modsecurity.org/download.

   Tip

   After downloading, you should verify the PGP signature to make sure the file hasn’t been altered. See the mod_security Web site for details.

2. Unpack the kit (not the rules) into a working directory:

   % cd /usr/local/build
   %tar xzf /usr/local/kits/modsecurity-apache_2.1.1

3. Move into the unpacked directory, and build the package using the supplied Makefile. Specify the value of your ServerRoot on the make command line:

   % cd /usr/local/build/modsecurity-apache_2.1.1/apache2
   % make top_dir=/usr/local/apache2
   #make top_dir=/usr/local/apache2 install

   Tip

   Unlike many other third-party modules, mod_security needs to be built using its own mechanism rather than a simple invocation of Apache’s apxs tool.

4. Unpack the core rules into a subdirectory under your ServerRoot:

   # cd /usr/local/apache2/conf
   # mkdir mod_security
   # cd mod_security
   #tar xzf /tmp/modsecurity-core-rules_2.1-1.4.tar.gz

5. Edit your httpd.conf file to add the following lines in the appropriate places:

   LoadModule security_module modules/mod_security2.so

   Include conf/mod_security/*.conf

6. Restart your server.

Discussion

The Makefile included with the mod_security package will do the building of the module and put it in the right place, but activating it in your server is your responsibility. Recent versions of the package ...