A quick run through of what I've done:

  1. apt-get install libapache-mod-security
  2. a2enmod mod-security
  3. create /etc/apache2/mod_security_rules/ with base_rules and optional_rules from the latest core rules set
  4. create /etc/apache2/conf.d/mod_security as below
  5. create /var/www/test.php as below

The conf file looks like

<IfModule security2_module>
Include /etc/apache2/mod_security_rules/*.conf
Include /etc/apache2/mod_security_rules/base_rules/*.conf
Include /etc/apache2/mod_security_rules/optional_rules/*.conf

test.php looks like

$secret_file = $_GET['secret_file'];
include ( $secret_file);

which several sites say mod_security should block.

My problem is that accessing test.php?secret_file='whatever' shows me the file.

Is this normal, and is mod_security working, or if not, what do I need to change?

migrated from webmasters.stackexchange.com May 4 '11 at 4:21

This question came from our site for pro webmasters.

  • Hmm, perhaps this belongs on ServerFault afterall... flagging... – Andrew May 4 '11 at 3:40

Looking at /usr/share/doc/libapache-mod-security/examples/modsecurity.conf-minimal you will see that there are more things to add to the conf, like SecRuleEngine On, are you sure that the core ruleset include those basic commands?

You can add it to your conf.d file or maybe use the example file to guide you.

  • I added the minimal conf and it's still not tripping - do I need to add them to my Apache VirtualHosts definitions? – Andrew May 4 '11 at 23:28
  • Theoretically its working. Use phpinfo() to check if the module is loaded, and try some other tests like embedding a SQL query on the URL. – coredump May 4 '11 at 23:40
  • Well, it turns out that using the minimal conf enabled it after all (uploads stopped working) - so I'll accept your answer as correct and read up on how to write a decent rules file. – Andrew May 8 '11 at 22:50

I have same issue ahead, Debian 6.0.6 x64 squeeze, lipapache2-modsecurity 2.6.5-5 installed installed trough apt-get. Looks like working, preventing all the other things, however still allowing to access passwd and other files like apache2.conf trough the script posted in first post, any solution guys?

may it be related to other config of web server itself?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.