{"id":141,"date":"2021-05-01T14:43:34","date_gmt":"2021-05-01T05:43:34","guid":{"rendered":"http:\/\/192.168.20.1\/?p=141"},"modified":"2021-05-02T11:19:02","modified_gmt":"2021-05-02T02:19:02","slug":"modsecurity-install","status":"publish","type":"post","link":"https:\/\/rlab.cavtime.net\/?p=141","title":{"rendered":"Install ModSecurity with Apache2 on Ubuntu 20.04"},"content":{"rendered":"<h2>Overview<\/h2>\n<p>ModSecurty \u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3068\u52d5\u4f5c\u306e\u78ba\u8a8d\u3092\u3059\u308b\u3002<\/p>\n<h2>Reference<\/h2>\n<ul>\n<li><a href=\"https:\/\/github.com\/SpiderLabs\/ModSecurity\" target=\"_blank\" rel=\"noopener\">ModSecurity<\/a> ( GitHub )<\/li>\n<\/ul>\n<h2>Environment<\/h2>\n<h3>OS<\/h3>\n<pre>$ cat \/etc\/os-release\r\nNAME=\"Ubuntu\"\r\nVERSION=\"20.04.2 LTS (Focal Fossa)\"\r\nID=ubuntu\r\nID_LIKE=debian\r\nPRETTY_NAME=\"Ubuntu 20.04.2 LTS\"\r\nVERSION_ID=\"20.04\"\r\nHOME_URL=\"https:\/\/www.ubuntu.com\/\"\r\nSUPPORT_URL=\"https:\/\/help.ubuntu.com\/\"\r\nBUG_REPORT_URL=\"https:\/\/bugs.launchpad.net\/ubuntu\/\"\r\nPRIVACY_POLICY_URL=\"https:\/\/www.ubuntu.com\/legal\/terms-and-policies\/privacy-policy\"\r\nVERSION_CODENAME=focal\r\nUBUNTU_CODENAME=focal\r\n$ uname -a\r\nLinux svr-web10 5.4.0-72-generic #80-Ubuntu SMP Mon Apr 12 17:35:00 UTC 2021 x86_64 x86_64 x86_64 GNU\/Linux\r\n$ \r\n<\/pre>\n<h3>Apache<\/h3>\n<pre>$ apache2 -v\r\nServer version: Apache\/2.4.46 (Ubuntu)\r\nServer built:   2020-08-10T12:32:13\r\n$ \r\n<\/pre>\n<h2>Prerequisites<\/h2>\n<p>hosts \u306e 127.0.1.1 \u306b\u66f8\u304b\u308c\u3044\u308b Hostname \u306f FQDN ( hostname.domain )\u306e\u5f62\u5f0f\u3067\u8a18\u8f09\u3055\u308c\u3044\u3066\u3044\u308b\u3002<\/p>\n<pre>$ cat \/etc\/hosts\r\n127.0.1.1 svr-web10.travelersmedia.jp\r\n$ \r\n<\/pre>\n<p>000-default.conf \u306e ServerName \u306b\u306f hosts \u30d5\u30a1\u30a4\u30eb\u306e 127.0.1.1 \u3068\u540c\u3058FQDN \u304c\u66f8\u304b\u308c\u3066\u3044\u308b\u3002<\/p>\n<pre>$ cat \/etc\/apache2\/sites-available\/000-default.conf\r\nServerName svr-web10.travelersmedia.jp\r\n$ \r\n<\/pre>\n<p>\u4e0a\u8a18\u306e\u30df\u30b9\u30de\u30c3\u30c1\u304c\u5b58\u5728\u3059\u308b\u3068\u4e0b\u8a18\u306e\u30a8\u30e9\u30fc\u3092\u51fa\u529b\u3059\u308b\u3002<\/p>\n<pre>$ sudo apachectl -M | grep security\r\nAH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message\r\n security2_module (shared)\r\n$\r\n<\/pre>\n<h2>Installation<\/h2>\n<pre>$ sudo apt-get install libapache2-mod-security2\r\n$ sudo systemctl restart apache2\r\n<\/pre>\n<h2>Check module<\/h2>\n<pre>hyamazak@svr-web10:~$ sudo apachectl -M | grep security\r\n security2_module (shared)\r\nhyamazak@svr-web10:~$ \r\n<\/pre>\n<h2>Configuration<\/h2>\n<pre>$ sudo cp \/etc\/modsecurity\/modsecurity.conf-recommended \/etc\/modsecurity\/modsecurity.conf\r\n$ sudo vim \/etc\/modsecurity\/modsecurity.conf\r\nSecRuleEngine = on\r\n$ sudo systemctl restart apache2\r\n<\/pre>\n<h2>Download and Modify csr<\/h2>\n<pre>$ sudo mv \/usr\/share\/modsecurity-crs \/usr\/share\/modsecurity-crs.bk\r\n$ sudo git clone https:\/\/github.com\/SpiderLabs\/owasp-modsecurity-crs.git \/usr\/share\/modsecurity-crs\r\n$ sudo cp \/usr\/share\/modsecurity-crs\/crs-setup.conf.example \/usr\/share\/modsecurity-crs\/crs-setup.conf\r\n$ sudo vim \/etc\/apache2\/mods-enabled\/security2.conf\r\nIncludeOptional \/usr\/share\/modsecurity-crs\/*.conf &lt;---- Add\r\nIncludeOptional \"\/usr\/share\/modsecurity-crs\/rules\/*.conf &lt;---- Add\r\n$\r\n<\/pre>\n<h2>Check ModSecurity<\/h2>\n<h3>Browse to Sites<\/h3>\n<p>Browse https:\/\/rlab.cavtime.net\/index.html?exec=\/bin\/bash<\/p>\n<h3>Check Log File<\/h3>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Overview ModSecurty \u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3068\u52d5\u4f5c\u306e\u78ba\u8a8d\u3092\u3059\u308b\u3002 Reference ModSecurity ( GitHub ) Environment OS $ cat \/etc\/os-release NA [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[134,33],"tags":[],"class_list":["post-141","post","type-post","status-publish","format-standard","hentry","category-waf","category-web"],"_links":{"self":[{"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=\/wp\/v2\/posts\/141","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=141"}],"version-history":[{"count":7,"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=\/wp\/v2\/posts\/141\/revisions"}],"predecessor-version":[{"id":148,"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=\/wp\/v2\/posts\/141\/revisions\/148"}],"wp:attachment":[{"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=141"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=141"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rlab.cavtime.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=141"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}