2

I have installed httpd 2.2.15 on CentOS 6.5 (minimal installation with no cPanel) with modsecurity 2.8. When I am starting httpd I am getting this error:

Starting httpd: Syntax error on line 23  of /etc/httpd/conf.d/modsecurity.conf:  ModSecurity: Found another rule with the same id

The line 23 is:

"id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
  • 1
    File a bug report against mod-security in Centos and you can try editing that line and give the rule a unique number. You can probably continue to use mod-security without giving the rule a unique name, it may make reading the logs a bit more difficult as any violation of 200000 may not have the correct information. – Panther Jun 12 '14 at 19:25
  • I tried changing rule number and still that errror. – Ashish Jun 13 '14 at 2:07
  • You have to use a unique number, try another one. Alternately download a new rule set from mod security or comment out the rule in question. – Panther Jun 13 '14 at 13:12
3

I ran into a similar problem while following a tutorial - http://www.tecmint.com/protect-apache-using-mod_security-and-mod_evasive-on-rhel-centos-fedora/

My httpd.conf file already had an include for *.conf and the tutorial had me explicitly include the modsecurity.conf file. As a result, all my rules were duplicates because the conf file was included twice.

2

It's hard to say exactly where the duplication is occurring based on the information you've provided. Essentially, a rule is being included twice which is usually defined within the modsecurity.conf file. You may be including this file twice, or you have copied its content into another apache conf file. To find the problem, you'll need to search for the duplicate rule. Here's a command that'll do that:

find /etc/httpd -name '*.conf' -exec grep -H "'200000'" {} \;

Once you discover which other file contains the rule (or perhaps its inside modsecurity.conf twice), you'll need to think of a way to organize your rules in a way so that the rules are not included twice. These instructions provide a good basis for using the OWASP ModSecurity Core Rule Set.

0

I was using a similar tutorial, http://idroot.net/tutorials/how-to-install-mod_security-apache-on-centos-6/, and had the same problem.

The issue with my installation is on CentOS the config files in /etc/httpd/conf/httpd.conf are loaded around line 220 with the line:

Include conf.d/*.conf

Then the tutorial had me install the following at the end of the httpd.conf:

<IfModule security2_module>
    Include conf.d/modsecurity.conf
</IfModule>

Which was loading the modsecurity.conf a second time.

I just removed the IfModule Include code at the bottom and it worked fine.

0

I got the same troubles than you and I find that I had included the same file both.

I added my own file for configuring the rules. And I have added the Include directive. But I didn't know that this inclusion was automatically done. After I removed my Include directive everything is working fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.