HostingHacks.net | Tools to Build a Linux Webhosting Service

ModSecurity increases web application security, protecting web applications from known and unknown attacks.

PREREQUISITES: source packages

INSTALLS:

The installation commands can be run from a Putty window in a "cut-and-paste" style layout or copied to a script. Notes on Putty best practices can be found at http://hostinghacks.net/putty/.

last updated: June 2005

cd /usr/src
wget http://www.modsecurity.org/download/modsecurity-1.8.7.tar.gz
tar -zxf modsecurity-1.8.7.tar.gz
cd /usr/src/modsecurity-1.8.7/apache1 
/usr/sbin/apxs -cia mod_security.c

cd ..
cd tests
./modsec-test.pl

touch /var/log/apache/audit_log

#chown?

configure httpd.conf:


cat > /etc/apache/httpd.conf << "EOF"

ServerType standalone
ServerName serv1.fatpenguinhosting.com
ServerAdmin servadmin@localhost.usa
ServerRoot "/usr"
PidFile /var/run/httpd.pid
ScoreBoardFile /var/run/httpd.scoreboard
Timeout 300
KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 15
MinSpareServers 5
MaxSpareServers 10
StartServers 5
MaxClients 150
MaxRequestsPerChild 0
Port 80
User nobody
Group nobody
HostnameLookups Off
UseCanonicalName On

Listen 80
Listen 443

LoadModule vhost_alias_module libexec/apache/mod_vhost_alias.so
LoadModule env_module         libexec/apache/mod_env.so
LoadModule define_module      libexec/apache/mod_define.so
LoadModule config_log_module  libexec/apache/mod_log_config.so
LoadModule mime_magic_module  libexec/apache/mod_mime_magic.so
LoadModule mime_module        libexec/apache/mod_mime.so
LoadModule negotiation_module libexec/apache/mod_negotiation.so
LoadModule status_module      libexec/apache/mod_status.so
LoadModule info_module        libexec/apache/mod_info.so
LoadModule includes_module    libexec/apache/mod_include.so
LoadModule autoindex_module   libexec/apache/mod_autoindex.so
LoadModule dir_module         libexec/apache/mod_dir.so
LoadModule cgi_module         libexec/apache/mod_cgi.so
LoadModule asis_module        libexec/apache/mod_asis.so
LoadModule action_module      libexec/apache/mod_actions.so
LoadModule speling_module     libexec/apache/mod_speling.so
LoadModule userdir_module     libexec/apache/mod_userdir.so
LoadModule alias_module       libexec/apache/mod_alias.so
LoadModule rewrite_module     libexec/apache/mod_rewrite.so
LoadModule access_module      libexec/apache/mod_access.so
LoadModule auth_module        libexec/apache/mod_auth.so
LoadModule expires_module     libexec/apache/mod_expires.so
LoadModule headers_module     libexec/apache/mod_headers.so
LoadModule usertrack_module   libexec/apache/mod_usertrack.so
LoadModule log_forensic_module libexec/apache/mod_log_forensic.so
LoadModule setenvif_module    libexec/apache/mod_setenvif.so
LoadModule watch_module       libexec/apache/mod_watch.so
LoadModule php4_module        libexec/apache/libphp4.so
LoadModule ssl_module         libexec/apache/libssl.so
LoadModule security_module    libexec/apache/mod_security.so

ClearModuleList
AddModule mod_vhost_alias.c
AddModule mod_env.c
AddModule mod_define.c
AddModule mod_log_config.c
AddModule mod_mime_magic.c
AddModule mod_mime.c
AddModule mod_negotiation.c
AddModule mod_status.c
AddModule mod_info.c
AddModule mod_include.c
AddModule mod_autoindex.c
AddModule mod_dir.c
AddModule mod_cgi.c
AddModule mod_asis.c
AddModule mod_actions.c
AddModule mod_speling.c
AddModule mod_userdir.c
AddModule mod_alias.c
AddModule mod_rewrite.c
AddModule mod_access.c
AddModule mod_auth.c
AddModule mod_expires.c
AddModule mod_headers.c
AddModule mod_usertrack.c
AddModule mod_log_forensic.c
AddModule mod_so.c
AddModule mod_setenvif.c
AddModule mod_watch.c
AddModule mod_php4.c
AddModule mod_ssl.c
AddModule mod_security.c

DirectoryIndex index.html index.htm index.php index.shtml default.htm
AddType application/x-httpd-php .php
AddType application/x-httpd-php-source .phps

AccessFileName .htaccess

<Files ~ "^\.ht">
    Order allow,deny
    Deny from all
    Satisfy All
</Files>

<Directory />
    Options FollowSymLinks Includes
    AllowOverride All
</Directory>

DocumentRoot "/var/www/htdocs"

<Directory "/var/www/htdocs">
    Options Indexes FollowSymLinks MultiViews
    AllowOverride None
    Order allow,deny
    Allow from all
</Directory>

<IfModule mod_watch.c>
  <Location /watch-info>
  SetHandler watch-info
  </Location>
</IfModule>

<IfModule mod_security.c>
# Turn the filtering engine On or Off
SecFilterEngine On

# Change Server: string
SecServerSignature "Apache"

# This setting should be set to On only if the Web site is
# using the Unicode encoding. Otherwise it may interfere with
# the normal Web site operation.
SecFilterCheckUnicodeEncoding Off

# The audit engine works independently and
# can be turned On of Off on the per-server or
# on the per-directory basis. "On" will log everything,
# "DynamicOrRelevant" will log dynamic requests or violations,
# and "RelevantOnly" will only log policy violations
SecAuditEngine RelevantOnly

# The name of the audit log file
SecAuditLog /var/log/apache/audit_log

# Should mod_security inspect POST payloads
SecFilterScanPOST On

SecFilterDebugLog /var/log/apache/modsec_debug_log
SecFilterDebugLevel 0

# Action to take by default
SecFilterDefaultAction "deny,log,status:403"

# Require HTTP_USER_AGENT and HTTP_HOST in all requests
# SecFilterSelective "HTTP_USER_AGENT|HTTP_HOST" "^$"

# Require Content-Length to be provided with
# every POST request
SecFilterSelective REQUEST_METHOD "^POST$" chain
SecFilterSelective HTTP_Content-Length "^$"

# Don't accept transfer encodings we know we don't handle
# (and you don't need it anyway)
SecFilterSelective HTTP_Transfer-Encoding "!^$"

# Protecting from XSS attacks through the PHP session cookie
SecFilterSelective ARG_PHPSESSID "!^[0-9a-z]*$"
SecFilterSelective COOKIE_PHPSESSID "!^[0-9a-z]*$"

SecFilter "viewtopic\.php\?" chain
SecFilter "chr\(([0-9]{1,3})\)" "deny,log"

# Block various methods of downloading files to a server
#SecFilterSelective THE_REQUEST "wget "
SecFilterSelective THE_REQUEST "lynx "
SecFilterSelective THE_REQUEST "scp "
SecFilterSelective THE_REQUEST "ftp "
SecFilterSelective THE_REQUEST "cvs "
SecFilterSelective THE_REQUEST "rcp "
SecFilterSelective THE_REQUEST "curl "
SecFilterSelective THE_REQUEST "telnet "
SecFilterSelective THE_REQUEST "ssh "
SecFilterSelective THE_REQUEST "echo "
SecFilterSelective THE_REQUEST "links -dump "
SecFilterSelective THE_REQUEST "links -dump-charset "
SecFilterSelective THE_REQUEST "links -dump-width "
SecFilterSelective THE_REQUEST "links http:// "
SecFilterSelective THE_REQUEST "links ftp:// "
SecFilterSelective THE_REQUEST "links -source "
SecFilterSelective THE_REQUEST "mkdir "
SecFilterSelective THE_REQUEST "cd /tmp "
SecFilterSelective THE_REQUEST "cd /var/tmp "
SecFilterSelective THE_REQUEST "cd /etc/httpd/proxy "

</IfModule>


<IfModule mod_dir.c>
    DirectoryIndex index.html
</IfModule>

<IfModule mod_mime.c>
    TypesConfig /etc/apache/mime.types
</IfModule>

DefaultType text/plain

<IfModule mod_mime_magic.c>
    MIMEMagicFile /etc/apache/magic
</IfModule>

ErrorLog /var/log/apache/error_log
LogLevel warn
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
CustomLog /var/log/apache/access_log common
ServerSignature On

<IfModule mod_alias.c>

    Alias /icons/ "/var/www/icons/"

    <Directory "/var/www/icons">
        Options Indexes MultiViews
        AllowOverride None
        Order allow,deny
        Allow from all
    </Directory>

</IfModule>

<IfModule mod_autoindex.c>
    IndexOptions FancyIndexing
    AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip
    AddIconByType (TXT,/icons/text.gif) text/*
    AddIconByType (IMG,/icons/image2.gif) image/*
    AddIconByType (SND,/icons/sound2.gif) audio/*
    AddIconByType (VID,/icons/movie.gif) video/*
    AddIcon /icons/binary.gif .bin .exe
    AddIcon /icons/binhex.gif .hqx
    AddIcon /icons/tar.gif .tar
    AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv
    AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip
    AddIcon /icons/a.gif .ps .ai .eps
    AddIcon /icons/layout.gif .html .shtml .htm .pdf
    AddIcon /icons/text.gif .txt
    AddIcon /icons/c.gif .c
    AddIcon /icons/p.gif .pl .py
    AddIcon /icons/f.gif .for
    AddIcon /icons/dvi.gif .dvi
    AddIcon /icons/uuencoded.gif .uu
    AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
    AddIcon /icons/tex.gif .tex
    AddIcon /icons/bomb.gif core
    AddIcon /icons/back.gif ..
    AddIcon /icons/hand.right.gif README
    AddIcon /icons/folder.gif ^^DIRECTORY^^
    AddIcon /icons/blank.gif ^^BLANKICON^^
    DefaultIcon /icons/unknown.gif
    ReadmeName README
    HeaderName HEADER

    IndexIgnore .??* *~ *# HEADER* README* RCS CVS *,v *,t

</IfModule>

<IfModule mod_mime.c>
    AddCharset ISO-8859-8 .iso8859-8
    AddCharset ISO-8859-2 .iso-pl
    AddCharset Big5         .Big5    .big5
    AddCharset WINDOWS-1251 .cp-1251
    AddCharset CP866        .cp866
    AddCharset UTF-8        .utf8
    AddType application/x-tar .tgz
    AddEncoding x-compress .Z
    AddEncoding x-gzip .gz .tgz
</IfModule>

<IfModule mod_setenvif.c>
    BrowserMatch "Mozilla/2" nokeepalive
    BrowserMatch "MSIE 4\.0b2;" nokeepalive downgrade-1.0 force-response-1.0
    BrowserMatch "RealPlayer 4\.0" force-response-1.0
    BrowserMatch "Java/1\.0" force-response-1.0
    BrowserMatch "JDK/1\.0" force-response-1.0
</IfModule>

<IfModule mod_ssl.c>
SSLPassPhraseDialog  builtin
SSLSessionCache         dbm:/var/log/apache/ssl_cache
SSLSessionCacheTimeout  300
SSLMutex  file:/var/log/apache/ssl_mutex
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
SSLLog      /var/log/apache/ssl_engine_log
SSLLogLevel info
</IfModule>

<IfDefine SSL>
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl    .crl
</IfDefine>

## VIRTUAL HOSTS CONFIGURED BY WEB CONTROL PANEL
Include /home/webcp/httpd/include/include.httpd

EOF

mkdir -p /home/webcp/httpd/include
touch /home/webcp/httpd/include/include.httpd

mkdir -p /home/fatpenguinhosting.com/www/web
mkdir -p /home/fatpenguinhosting.com/www/logs

then make edits to whatever httpd.conf you install mod_security to.