Mod security

From ICO wiki
Jump to navigationJump to search
sudo apt-get update
sudo apt-get install libxml2 libxml2-dev libxml2-utils
sudo apt-get install libapache2-modsecurity
ln -sf /usr/lib/x86_64-linux-gnu/ /usr/lib/
sudo mv /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf
cd /tmp

sudo wget -O modsecurity-crs_2.2.5.tar.gz

sudo tar zxf modsecurity-crs_2.2.5.tar.gz

sudo mv SpiderLabs-owasp-modsecurity-crs-5c28b52 modsecurity-crs_2.2.5

sudo cp -R modsecurity-crs_2.2.5/* /etc/modsecurity/

sudo rm modsecurity-crs_2.2.5.tar.gz

sudo rm modsecurity-crs_2.2.5 -r

sudo mv /etc/modsecurity/modsecurity_crs_10_setup.conf.example /etc/modsecurity/modsecurity_crs_10_setup.conf  

#To enable rulesets create /etc/apache2/conf.d/modsecurity.conf file with following content:
<ifmodule mod_security2.c>
SecRuleEngine On

sudo a2enmod mod-security
sudo service apache2 restart

Fail /etc/apache2/mods-enabled/mod-security.conf

<IfModule security2_module>
        # Default Debian dir for modsecurity's persistent data
        SecDataDir /var/cache/modsecurity

        # Include all the *.conf files in /etc/modsecurity.
        # Keeping your local configuration in that directory
        # will allow for an easy upgrade of THIS file and
        # make your life easier
        Include "/etc/modsecurity/*.conf"
        Include "/etc/modsecurity/activated_rules/*.conf"
#       Include "/etc/modsecurity/optional_rules/*.conf"
        Include "/etc/modsecurity/base_rules/*.conf"

Veateate muutmine

Mõne ründe avastamisel suunatakse vaikimisi ümber lehele, mis näitab veateadet "Forbidden".

Et seda muuta, tuleks Apache VirtualHosti confi lisada järgmine rida:

ErrorDocument 403 /sinu/custom/errori/leht.php

leht.php võiks olla näiteks lihtne php script, mis suunab tagasi lehele, kust tuldi (HTTP referer):

header('Location: ' . $_SERVER['HTTP_REFERER']);