How to setup mod_security with ServerPilot

Serverpilot is a hosted control panel for setting up and managing LAMP/LEMP stacks on Ubuntu servers. Just like any other control panel it can be installed with a single command. ServerPilot is simple to use and does not install unnecessary packages like other commercial control panels.

I had written an article for DigitalOcean on setting up mod_security on Apache. Since I found several DO users using ServerPilot to manage their Droplets I wanted to do a small piece on configuring mod_security on ServerPilot managed Ubuntu servers. ServerPilot supports custom .conf files for Apache making it easier load additional modules. This tutorial with be brief, for a detailed explanation please read the guide I wrote for DigitalOcean.

Update: As of 15th April installing mod_security from the Ubuntu repository no longer works (on Ubuntu 16.04 and 18.04) and outputs the following Apache error:

httpd: Syntax error on line 160 of /etc/apache-sp/httpd.conf: Syntax error on line 3  of /etc/apache-sp/conf.d/security2.conf: Cannot load /usr/lib/apache2/modules/mod_security2.so into server: /usr/lib/apache2//modules/mod_security2.so: undefined symbol: apr_crypto_block_cleanup

So on Ubuntu 16.04 and 18.04 mod_security has to be installed from source. Users of Ubuntu 14.04 can follow the previous method.

Installing mod_security on Ubuntu 16.04 and 18.04

Install dependencies

Update the apt repository and install packages necessary for compiling and building from source.

apt-get update
apt-get install build-essential libpcre3-dev libxml2-dev libexpat1-dev

Visit APR’s (Apache Portable Runtime) website, download the latest version of APR and APR-util, compile and install them.

cd /tmp
wget http://www-eu.apache.org/dist//apr/apr-1.6.3.tar.gz
tar -xzf apr-1.6.3.tar.gz
cd apr-1.6.3
./configure
make
sudo make install
cd /tmp
wget http://www-eu.apache.org/dist//apr/apr-util-1.6.1.tar.gz
tar -xzf apr-util-1.6.1.tar.gz
cd apr-util-1.6.1/
./configure --with-apr=/usr/local/apr
make
sudo make install

Install mod_security from source

Download, compile and install mod_security from source.

cd /tmp
wget https://www.modsecurity.org/tarball/2.9.2/modsecurity-2.9.2.tar.gz
tar -xzf modsecurity-2.9.2.tar.gz
cd modsecurity-2.9.2/
./configure --enable-htaccess-config --with-apxs=/opt/sp/apache/bin/apxs
make
sudo make install

Create mod_security config files

Since we install mod_security from source the configuration directories and files have to be created manually.

sudo mkdir /etc/modsecurity
sudo wget -O /etc/modsecurity/unicode.mapping https://github.com/SpiderLabs/ModSecurity/raw/v2/master/unicode.mapping
sudo wget -O /etc/modsecurity/modsecurity.conf https://github.com/SpiderLabs/ModSecurity/raw/v2/master/modsecurity.conf-recommended

Create a file at /etc/apache-sp/conf.d/security2.conf and place the following config:

LoadModule unique_id_module lib/sp-apache/mod_unique_id.so
LoadModule security2_module /usr/local/modsecurity/lib/mod_security2.so
<IfModule security2_module>
        IncludeOptional /etc/modsecurity/*.conf
        IncludeOptional "/usr/share/modsecurity-crs/*.conf"
        IncludeOptional "/usr/share/modsecurity-crs/activated_rules/*.conf"
</IfModule>

Next use sed to edit modsecurity.conf and configure mod_security to block attacks and disable buffering of HTTP response bodies:

sudo sed -i "s/SecRuleEngine DetectionOnly/SecRuleEngine On/" /etc/modsecurity/modsecurity.conf
sudo sed -i "s/SecResponseBodyAccess On/SecResponseBodyAccess Off/" /etc/modsecurity/modsecurity.conf

Setup mod_security Core Rule Set (CRS)

Download mod_security rule set, extract and copy them to their own directory.

cd /tmp
wget https://github.com/SpiderLabs/owasp-modsecurity-crs/archive/2.2.9.tar.gz
tar -xzf 2.2.9.tar.gz
sudo mkdir /usr/share/modsecurity-crs
sudo mv owasp-modsecurity-crs-2.2.9/ /usr/share/modsecurity-crs
sudo mv /usr/share/modsecurity-crs/modsecurity_crs_10_setup.conf{.example,}

Do a config test for Apache:

sudo /opt/sp/apache/bin/apachectl -t

This should return “Syntax OK”.

Restart Apache:

service apache-sp restart

Confirm if the module was loaded:

sudo /opt/sp/apache/bin/apachectl -M | grep security2

You should see a module named security2_module (shared) which indicates that the module was loaded.

That’s it, now scroll down to the SQL injection test section and test the rules.

Installing mod_security on Ubuntu 14.04

Install mod_security

Update the apt repository and install the mod_security package:

apt-get update
apt-get install libapache2-mod-security2 modsecurity-crs

Enable mod_unique_id

Modsecurity depends on a module named mod_unique_id. This module will prevent Apache from starting if the server’s hostname doesn’t resolve. So ensure the hostname resolves.

ping -c 4 `hostname`
ping -c 4 `hostname -f`

Both of these should resolve to your loopback IP address, if not edit the /etc/hosts file and add your server’s hostname.

Execute the following command to add unique_id to the list of load modules to be loaded:

bash -c "echo 'LoadModule unique_id_module lib/sp-apache/mod_unique_id.so' > /etc/apache-sp/conf.d/unique_id.conf"

Create mod_security config files

Create a .conf file to load the mod_security module file.

bash -c "cat /etc/apache2/mods-available/security2.{load,conf} > /etc/apache-sp/conf.d/security2.conf"

Edit the newly created file and add the following before the </ifModule> line:

IncludeOptional "/usr/share/modsecurity-crs/*.conf"
IncludeOptional "/usr/share/modsecurity-crs/activated_rules/*.conf"

Once added the file should look like this:

# Depends: unique_id
LoadModule security2_module /usr/lib/apache2/modules/mod_security2.so
<IfModule security2_module>
        # Default Debian dir for modsecurity's persistent data
        SecDataDir /var/cache/modsecurity

        # Include all the *.conf files in /etc/modsecurity.
        # Keeping your local configuration in that directory
        # will allow for an easy upgrade of THIS file and
        # make your life easier
        IncludeOptional /etc/modsecurity/*.conf
        IncludeOptional "/usr/share/modsecurity-crs/*.conf"
        IncludeOptional "/usr/share/modsecurity-crs/activated_rules/*.conf"
</IfModule>

Rename the modsecurity.conf-recommended file:

mv /etc/modsecurity/modsecurity.conf{-recommended,}

Edit the renamed file and configure mod_security to block attacks:

sed -i "s/SecRuleEngine DetectionOnly/SecRuleEngine On/" /etc/modsecurity/modsecurity.conf

Disable buffering of HTTP response bodies:

sed -i "s/SecResponseBodyAccess On/SecResponseBodyAccess Off/" /etc/modsecurity/modsecurity.conf

Important: This is SecResponseBodyAccess and NOT SecRequestBodyAccess.

The directives SecRequestBodyLimit, SecRequestBodyNoFilesLimit and SecRequestBodyInMemoryLimit have been discussed in the DigitalOcean article.

Create a directory named “apache2” inside “/var/log”, this is where mod_security will store its audit log file.

mkdir /var/log/apache2

Do a config test for Apache:

/opt/sp/apache/bin/apachectl -t

This should return “Syntax OK”

Restart Apache:

service apache-sp restart

Confirm if the module was loaded:

/opt/sp/apache/bin/apachectl -M | grep security2

You should see a module named security2_module (shared) which indicates that the module was loaded.

SQL injection test

Enable the SQL injection rule:

cd /usr/share/modsecurity-crs/activated_rules
ln -s ../base_rules/modsecurity_crs_41_sql_injection_attacks.conf .

Restart Apache for the rules to take effect:

service apache-sp restart

Test SQL injection using the following cURL request:

curl -o /dev/null -s -v -d "' or true -- " http://example.com

This should return a 403 Forbidden error as follows:

* Hostname was found in DNS cache
*   Trying 1.1.1.1...
* Connected to example.com (1.1.1.1) port 80 (#0)
> POST / HTTP/1.1
> User-Agent: curl/7.35.0
> Host: example.com
> Accept: */*
> Content-Length: 13
> Content-Type: application/x-www-form-urlencoded
>
} [data not shown]
* upload completely sent off: 13 out of 13 bytes
< HTTP/1.1 403 Forbidden
* Server nginx is not blacklisted
< Server: nginx
< Date: Mon, 04 May 2015 19:42:12 GMT
< Content-Type: text/html; charset=iso-8859-1
< Content-Length: 209
< Connection: keep-alive
< Vary: Accept-Encoding
<
{ [data not shown]
* Connection #0 to host example.com left intact

That’s it, we now have mod_security running on a server managed by ServerPilot. If you use the ServerPilot links in this article to signup, you’ll get a $10 account credit. 😉