Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5193

ModSecurity Debian 8

Show all headers | View raw

Hi,
I have spent about 2 days trying to understand how to setup mod-security 
on my web server.

  I choose to rely on packages in the official repo, so if possible I 
will not compile packages.

Is correct to say that I can't have mod-security in nginx?
Is mod-security only available in apache2?

Then I'm looking for some instruction about installing. There are a lot 
of outdated material and is difficult to learn the right stuff.


Here is what I have typed:


apt-get install libcurl3-gnutls liblua5.1-0 libxml2
apt-get install libapache2-mod-security2
apt-get install modsecuriy-crs
sudo mv /etc/modsecurity/modsecurity.conf-recommended 
/etc/modsecurity/modsecurity.conf
sudo nano /etc/modsecurity/modsecurity.conf


I have turned on the option SecRuleEngine

git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git


Now... my questions are:

1) Where I have to put the rules
2) Which other config files I have to edit
3) How I enable modsecurity on my website
4) Do you have sample config file to share?


Thanks a lot for your help.

Anders. LA.

Back to linux.debian.security | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

ModSecurity Debian 8 "lannoun@runbox.com" <lannoun@runbox.com> - 2017-03-20 20:00 +0100
  Re: ModSecurity Debian 8 Krzysztof Kokot <kokot300@gmail.com> - 2017-03-20 23:10 +0100
    Re: ModSecurity Debian 8 Richard Waterbeek <richardwbb@versatel.nl> - 2017-03-22 00:00 +0100
  Re: ModSecurity Debian 8 Alberto Gonzalez Iniesta <agi@inittab.org> - 2017-03-21 07:50 +0100
  Re: ModSecurity Debian 8 Casper Madsen <maveas@gmail.com> - 2017-03-21 08:20 +0100

csiph-web