How To Install ModSecurity Apache on Ubuntu 20.04 LTS

Install ModSecurity Apache on Ubuntu 20.04

In this tutorial, we will show you how to install ModSecurity Apache on Ubuntu 20.04 LTS. For those of you who didn’t know, ModSecurity is an Apache module that helps to protect your website from various attacks such as cross-site scripting, SQL injection attacks, path traversal attacks, etc. ModSecurity can also monitor web traffic in real-time and help you detect and respond to intrusions.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you through the step by step installation of ModSecurity Apache on an Ubuntu 20.04 Focal Fossa.

Install ModSecurity Apache on Ubuntu 20.04 LTS Focal Fossa

Step 1. First, make sure that all your system packages are up-to-date by running these following apt commands in the terminal.

sudo apt update
sudo apt upgrade

Step 2. Installing ModSecurity Apache on Ubuntu 20.04.

Now we install the mod security package on the Ubuntu system using the following command:

sudo apt install libapache2-mod-security2

Restart apache service to take mod-security module into account:

sudo systemctl restart apache2

Step 3. Configuration of ModSecurity.

We’ve to start the configure of mod security. you can find the location at /etc/modsecurity:

sudo mv /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf

Next, download the OWASP ModSecurity CRS from Github:

cd ~
git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git

Then, move and rename crs-setup.conf.example to crs-setup.conf. Also, move rules/ directory as well:

cd ~/owasp-modsecurity-crs
sudo mv crs-setup.conf.example /etc/modsecurity/crs-setup.conf
sudo mv rules/ /etc/modsecurity/

To get these rules working on Apache, you should edit the /etc/apache2/mods-available/security2.conf file:

sudo nano /etc/apache2/mods-available/security2.conf

Add another Include directive pointing to the ruleset:

<IfModule security2_module>
   # Default Debian dir for modsecurity's persistent data
   SecDataDir /var/cache/modsecurity

   # Include all the *.conf files in /etc/modsecurity.
   # Keeping your local configuration in that directory
   # will allow for an easy upgrade of THIS file and
   # make your life easier
   IncludeOptional /etc/modsecurity/*.conf
   Include /etc/modsecurity/rules/*.conf
</IfModule>

Restart Apache to take changes into effect:

sudo systemctl restart apache2

Step 4. Test ModSecurity Apache.

Now we edit the default Apache configuration file and add two additional directives, using the default configuration as an example:

sudo nano /etc/apache2/sites-available/000-default.conf

Add the following file:

<VirtualHost *:80>
    ServerAdmin [email protected]
    DocumentRoot /var/www/html

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    SecRuleEngine On
    SecRule ARGS:modsecparam "@contains test" "id:4321,deny,status:403,msg:'ModSecurity test rule has triggered'"
</VirtualHost>

Restart Apache to take changes into effect:

sudo systemctl restart apache2

Then, enter the following command:

curl localhost/index.html?modsecparam=test

The response code should be 403. There should be a message in the logs that shows the defined ModSecurity rule worked.

Congratulations! You have successfully installed ModSecurity. Thanks for using this tutorial for installing the ModSecurity Apache on your Ubuntu 20.04 LTS Focal Fossa system. For additional help or useful information, we recommend you to check the official ModSecurity website.

VPS Manage Service Offer
If you don’t have time to do all of this stuff, or if this is not your area of expertise, we offer a service to do “VPS Manage Service Offer”, starting from $10 (Paypal payment). Please contact us to get the best deal!