Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

mod_security seems to be no longer on Debian repositories. The installation seems quite complicated. The only one I could find is Zorp, which seems even more complicated.

Hence I'd like to ask for up to date mod_security howto's or alternative solutions.

Many thanks!

share|improve this question
I had a hard time finding alternatives, many related projects died possibly in favour of mod_security or firewalls off the web app layer? You could look at basic options like mod_qos which is still alive – KCD Jul 26 '11 at 22:39
up vote 1 down vote accepted

Which version of debian are you using. libapache-mod-security is available in lenny-backports.

share|improve this answer
I'm running on Debian 5.0.6 which is up to date as far as I'm aware. – MrG Oct 7 '10 at 18:47

I have CentOS, and I compiled it a month or two ago, so you may have to tweak this. mod_security2.5 is the new version

You need liblua readline-dev and ncurses dev as well as libxml2.

aptget install readline-dev ncurses-dev libxml2 libxml2-dev

I had to make Lua from source because CentOS doesn't have it in the default repos:

tar -xvf lua-5.1.tar.gz
cd lua-5.1
make linux  && make install                                 
gcc -shared -o /usr/local/lib/ /usr/local/lib/liblua.a # Compile liblua library into a Shared Object for Apache to use


tar -xvf modsecurity-apache_2.5.12
cd modsecurity-apache_2.5.12
cd apache2
make && make install 
cd ../
mkdir /etc/httpd/modsecurity.d
cp modsecurity.conf-minimal /etc/httpd/modsecurity.d/mod_security_minimal.conf  # Copy the minimal rule set to our configuration

You will need to modify your Apache config to load liblua and libxml2. Notice this is LoadFile not Load Module. /etc/httpd/conf/httpd.conf

LoadFile /usr/lib/
LoadFile /usr/local/lib/

And you probably want to keep your rules organized:

Include modsecurity.d/*.conf

For further configuration add your own ruleset in the modsecurity.d directory, and you can also copy any default rulesets you want from the mod_security folder extracted above under the rules folder.

Restarting httpd will be required.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.