2

I have installed httpd 2.2.15 on CentOS 6.5 (minimal installation with no cPanel) with modsecurity 2.8. When I am starting httpd I am getting this error:

Starting httpd: Syntax error on line 23  of /etc/httpd/conf.d/modsecurity.conf:  ModSecurity: Found another rule with the same id

The line 23 is:

"id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
3
  • 1
    File a bug report against mod-security in Centos and you can try editing that line and give the rule a unique number. You can probably continue to use mod-security without giving the rule a unique name, it may make reading the logs a bit more difficult as any violation of 200000 may not have the correct information.
    – Panther
    Jun 12, 2014 at 19:25
  • I tried changing rule number and still that errror.
    – Ashish
    Jun 13, 2014 at 2:07
  • You have to use a unique number, try another one. Alternately download a new rule set from mod security or comment out the rule in question.
    – Panther
    Jun 13, 2014 at 13:12

6 Answers 6

3

I ran into a similar problem while following a tutorial - http://www.tecmint.com/protect-apache-using-mod_security-and-mod_evasive-on-rhel-centos-fedora/

My httpd.conf file already had an include for *.conf and the tutorial had me explicitly include the modsecurity.conf file. As a result, all my rules were duplicates because the conf file was included twice.

2

It's hard to say exactly where the duplication is occurring based on the information you've provided. Essentially, a rule is being included twice which is usually defined within the modsecurity.conf file. You may be including this file twice, or you have copied its content into another apache conf file. To find the problem, you'll need to search for the duplicate rule. Here's a command that'll do that:

find /etc/httpd -name '*.conf' -exec grep -H "'200000'" {} \;

Once you discover which other file contains the rule (or perhaps its inside modsecurity.conf twice), you'll need to think of a way to organize your rules in a way so that the rules are not included twice. These instructions provide a good basis for using the OWASP ModSecurity Core Rule Set.

1

Had a similar issue following https://www.tecmint.com/install-modsecurity-with-apache-on-debian-ubuntu/ using Debian 11 myself.

At the point in the guide where you have to edit /etc/apache2/mods-enabled/security2.conf make sure that it contains the following lines:

IncludeOptional /etc/modsecurity/*.conf
Include /etc/modsecurity/rules/*.conf

Make sure you also comment the last line like this, or else it will load rules twice:

#IncludeOptional /usr/share/modsecurity-crs/*.load
0

I was using a similar tutorial, http://idroot.net/tutorials/how-to-install-mod_security-apache-on-centos-6/, and had the same problem.

The issue with my installation is on CentOS the config files in /etc/httpd/conf/httpd.conf are loaded around line 220 with the line:

Include conf.d/*.conf

Then the tutorial had me install the following at the end of the httpd.conf:

<IfModule security2_module>
    Include conf.d/modsecurity.conf
</IfModule>

Which was loading the modsecurity.conf a second time.

I just removed the IfModule Include code at the bottom and it worked fine.

0

I got the same troubles than you and I find that I had included the same file both.

I added my own file for configuring the rules. And I have added the Include directive. But I didn't know that this inclusion was automatically done. After I removed my Include directive everything is working fine.

0

To know if you are loading the same file twice, change the rule id to something that is for sure not there (say add 10,000,000 to the id) and restart apache. If you still get the error complaining about the same line you are loading the file twice.

To know if you have another file with the same rule run sudo grep -r <id> /etc/httpd/conf

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .