How To Install ModSecurity Apache on Ubuntu 20.04 LTS

In this tutorial, we will show you how to install ModSecurity Apache on Ubuntu 20.04 LTS. For those of you who didn’t know, ModSecurity is an Apache module that helps to protect your website from various attacks such as cross-site scripting, SQL injection attacks, path traversal attacks, etc. ModSecurity can also monitor web traffic in real-time and help you detect and respond to intrusions.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of ModSecurity Apache on an Ubuntu 20.04 Focal Fossa.

Prerequisites

• A server running one of the following operating systems: Ubuntu 20.04, 18.04, and any other Debian-based distribution like Linux Mint or elementary OS.
• It’s recommended that you use a fresh OS install to prevent any potential issues.
• SSH access to the server (or just open Terminal if you’re on a desktop).
• A non-root sudo user or access to the root user. We recommend acting as a non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.

Install ModSecurity Apache on Ubuntu 20.04 LTS Focal Fossa

Step 1. First, make sure that all your system packages are up-to-date by running the following apt commands in the terminal.

sudo apt update
sudo apt upgrade

Step 2. Installing ModSecurity Apache on Ubuntu 20.04.

Now we install the mod security package on the Ubuntu system using the following command:

sudo apt install libapache2-mod-security2

Restart apache service to take mod-security module into account:

sudo systemctl restart apache2

Step 3. Configuration of ModSecurity.

We’ve to start the configuration of mod security. you can find the location at /etc/modsecurity:

sudo mv /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf

Next, download the OWASP ModSecurity CRS from Github:

cd ~
git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git

Then, move and rename crs-setup.conf.example to crs-setup.conf. Also, move rules/ directory as well:

cd ~/owasp-modsecurity-crs
sudo mv crs-setup.conf.example /etc/modsecurity/crs-setup.conf
sudo mv rules/ /etc/modsecurity/

To get these rules working on Apache, you should edit the /etc/apache2/mods-available/security2.conf file:

sudo nano /etc/apache2/mods-available/security2.conf

Add another Include directive pointing to the ruleset:

<IfModule security2_module>
   # Default Debian dir for modsecurity's persistent data
   SecDataDir /var/cache/modsecurity

   # Include all the *.conf files in /etc/modsecurity.
   # Keeping your local configuration in that directory
   # will allow for an easy upgrade of THIS file and
   # make your life easier
   IncludeOptional /etc/modsecurity/*.conf
   Include /etc/modsecurity/rules/*.conf
</IfModule>

Restart Apache to take changes into effect:

sudo systemctl restart apache2

Step 4. Test ModSecurity Apache.

Now we edit the default Apache configuration file and add two additional directives, using the default configuration as an example:

sudo nano /etc/apache2/sites-available/000-default.conf

Add the following file:

<VirtualHost *:80>
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/html

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    SecRuleEngine On
    SecRule ARGS:modsecparam "@contains test" "id:4321,deny,status:403,msg:'ModSecurity test rule has triggered'"
</VirtualHost>

Restart Apache to take changes into effect:

sudo systemctl restart apache2

Then, enter the following command:

curl localhost/index.html?modsecparam=test

The response code should be 403. There should be a message in the logs that shows the defined ModSecurity rule worked.

Congratulations! You have successfully installed ModSecurity. Thanks for using this tutorial for installing the ModSecurity Apache on your Ubuntu 20.04 LTS Focal Fossa system. For additional help or useful information, we recommend you check the official ModSecurity website.