ModSecurity OWASP CRS Setup: Defend Linux Internet Servers

Understanding ModSecurity and the OWASP Core Rule Set (CRS)

ModSecurity is a pluggable net utility firewall engine initially developed for Apache and modernized as libmodsecurity (v3) for Nginx. By itself, ModSecurity is an inspection engine with out predefined risk intelligence; it requires a complete rule set to determine malicious request patterns.

The OWASP Core Rule Set (CRS) offers that intelligence: an open-source assortment of signature and behavioral guidelines designed to detect frequent net utility vulnerabilities recognized within the OWASP Prime 10.

Deploying ModSecurity on high-performance UK VPS situations ensures ample CPU and reminiscence headroom to examine heavy POST payloads with out introducing latency into shopper transactions. To grasp vulnerability disclosure requirements and risk monitoring, learn our information on CVE safety vulnerabilities and OpenCVE monitoring.

Putting in ModSecurity v3 (libmodsecurity) and Nginx Connector

On fashionable Nginx architectures, ModSecurity operates as a dynamic module speaking with the standalone libmodsecurity library.

Set up conditions and compile libmodsecurity and the Nginx connector:

# Set up construct dependencies on Ubuntu/Debian
sudo apt replace && sudo apt set up -y 
    g++ make cmake autoconf automake libtool 
    libcurl4-openssl-dev libpcre3-dev libxml2-dev 
    libyajl-dev libgeoip-dev git

# Clone and compile libmodsecurity v3
cd /decide
sudo git clone --depth 1 -b v3/grasp --single-branch https://github.com/SpiderLabs/ModSecurity
cd ModSecurity
sudo git submodule init && sudo git submodule replace
sudo ./construct.sh && sudo ./configure && sudo make -j$(nproc) && sudo make set up

Subsequent, compile the ModSecurity-Nginx dynamic connector module matching your put in Nginx model:

# Clone connector and construct dynamic module
cd /decide
sudo git clone --depth 1 https://github.com/SpiderLabs/ModSecurity-nginx.git

# Obtain matching Nginx supply and construct dynamic module
NGINX_VER=$(nginx -v 2>&1 | minimize -d"https://onliveserver.com/" -f2)
wget http://nginx.org/obtain/nginx-${NGINX_VER}.tar.gz
tar -zxvf nginx-${NGINX_VER}.tar.gz && cd nginx-${NGINX_VER}
./configure --with-compat --add-dynamic-module=/decide/ModSecurity-nginx
make modules
sudo cp objs/ngx_http_modsecurity_module.so /and so forth/nginx/modules/

Load the module on the prime of /and so forth/nginx/nginx.conf:

load_module modules/ngx_http_modsecurity_module.so;

Deploying ModSecurity on Apache by way of mod_security2 Engine

For environments working Apache net servers, ModSecurity integrates natively by way of the pre-compiled mod_security2 module, avoiding the requirement for handbook supply compilation.

Set up and allow ModSecurity on Apache in Ubuntu/Debian:

# Set up Apache ModSecurity bundle
sudo apt replace && sudo apt set up -y libapache2-mod-security2

# Allow Apache safety module and restart service
sudo a2enmod security2
sudo systemctl restart apache2

Initialize the bottom configuration file by renaming the advisable template:

sudo cp /and so forth/modsecurity/modsecurity.conf-recommended /and so forth/modsecurity/modsecurity.conf

Inside /and so forth/modsecurity/modsecurity.conf, transition from detection-only mode to energetic blocking:

# Allow energetic blocking of malicious payloads
SecRuleEngine On
SecRequestBodyAccess On
SecResponseBodyAccess Off
SecRequestBodyLimit 13107200
SecRequestBodyNoFilesLimit 131072
SecRequestBodyInMemoryLimit 131072

Configuring OWASP CRS v3.3/v4.0 and Paranoia Ranges

Clone the newest steady launch of the OWASP Core Rule Set into your configuration listing:

cd /and so forth/nginx
sudo git clone https://github.com/coreruleset/coreruleset.git owasp-crs
cd owasp-crs
sudo cp crs-setup.conf.instance crs-setup.conf

The Core Rule Set makes use of an anomaly scoring mannequin with 4 configurable Paranoia Ranges:

• Paranoia Stage 1 (Default): Excessive-confidence guidelines with just about zero false positives. Really helpful for manufacturing e-commerce and customary net portals.
• Paranoia Stage 2: Extra common expression checks. Low false optimistic charge; appropriate for portals dealing with delicate monetary data.
• Paranoia Stage 3: Strict validation of character encodings and request constructions. Requires intensive rule tuning.
• Paranoia Stage 4: Excessive paranoia. Blocks non-standard HTTP headers and unknown content material encodings. Reserved for high-value banking endpoints.

Configure the paranoia degree inside crs-setup.conf:

SecAction 
 "id:900000,
  part:1,
  nolog,
  move,
  t:none,
  setvar:tx.paranoia_level=1"

Defending Towards Server-Facet Request Forgery (SSRF) and Deserialization Assaults

Trendy cloud architectures are more and more focused by Server-Facet Request Forgery (SSRF) and insecure object deserialization assaults, the place attackers manipulate server staff into issuing unauthorized requests to inside cloud metadata endpoints (e.g., 169.254.169.254) or inside database ports. Reviewing safety analyses just like the WordPress core SSRF vulnerability CVE-2022-3590 underscores the need of deep payload inspection.

ModSecurity offers specialised protocol enforcement guidelines (Guidelines 934100 to 934120) that examine outgoing URL parameters inside POST request our bodies:

# Implement strict blocking of personal IP ranges in user-supplied URLs
SecRule REQUEST_BODY "@rx (?i)(?:https?|ftp|gopher)://(?:10.|192.168.|172.(?:1[6-9]|2[0-9]|3[01]).|127.|169.254.)" 
    "id:1000010,
     part:2,
     block,
     t:none,t:urlDecodeUni,
     msg:'SSRF Assault Try: Personal Subnet Entry Blocked',
     logdata:'%{MATCHED_VAR}',
     severity:'CRITICAL'"

This practice rule drops any request making an attempt to drive backend microservices to probe non-public subnets or inside metadata APIs, stopping SSRF exploits earlier than payloads attain the applying tier. As well as, ModSecurity intercepts DNS rebinding makes an attempt by validating that Host headers match authoritative digital host definitions, stopping attackers from exploiting inside headless providers sure to 127.0.0.1.

Price-Limiting and Behavioral DoS Safety Utilizing ModSecurity Persistent Collections

Past static sample matching, ModSecurity maintains persistent state tables throughout consumer periods, enabling behavioral Denial of Service (DoS) mitigation. If an attacker unleashes an automatic scraping bot or rapid-fire brute-force script, ModSecurity tracks request velocity per IP:

# Initialize persistent storage assortment for shopper IPs
SecStorageDir /var/cache/modsecurity
SecRule REQUEST_HEADERS:Consumer-Agent "!@rx Googlebot|Bingbot" 
    "id:1000020,
     part:1,
     nolog,
     move,
     initcol:ip=%{REMOTE_ADDR}"

# Increment request counter and implement charge restrict (100 requests per 10 seconds)
SecRule REQUEST_METHOD "@rx ^POST$" 
    "id:1000021,
     part:1,
     nolog,
     move,
     setvar:ip.post_count=+1,
     expirevar:ip.post_count=10"

# Block IP when threshold is exceeded
SecRule IP:POST_COUNT "@gt 100" 
    "id:1000022,
     part:1,
     deny,
     standing:429,
     msg:'HTTP POST Flooding: Automated Price Restrict Triggered',
     expirevar:ip.post_count=60"

When an IP triggers Rule 1000022, ModSecurity responds with HTTP 429 Too Many Requests, defending utility databases from useful resource exhaustion.

Tuning Guidelines and Dealing with False Positives with SecRuleRemoveById

Working a WAF in blocking mode with out tuning will inevitably disrupt official customers. Complicated CMS dashboards like WordPress or Drupal regularly transmit HTML markup or serialized JSON payloads inside POST our bodies, triggering SQLi or XSS guidelines.

At all times run ModSecurity in detection mode (SecRuleEngine DetectionOnly) for 7 to 14 days to determine benign triggers earlier than switching to SecRuleEngine On.

When a false optimistic happens on a official endpoint, by no means disable your entire WAF. As an alternative, apply focused rule exclusions in /and so forth/nginx/owasp-crs/guidelines/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf:

# Disable Rule 941100 (XSS detection) completely for the WordPress admin put up editor
SecRule REQUEST_URI "@beginsWith /wp-admin/put up.php" 
    "id:1000001,
     part:1,
     move,
     nolog,
     ctl:ruleRemoveById=941100"

# Disable SQLi checking on WooCommerce cart checkout endpoint for particular parameter
SecRule REQUEST_URI "@beginsWith /checkout" 
    "id:1000002,
     part:2,
     move,
     nolog,
     ctl:ruleRemoveTargetById=942100;ARGS:billing_address_1"

Automating OWASP CRS Rule Updates and CI/CD Safety Regression Testing

Assault vectors evolve constantly. The OWASP Core Rule Set workforce releases common signature updates addressing new evasion strategies, obfuscation methods, and CVE assault patterns.

Automate CRS rule updates with a weekly verification cron script:

#!/usr/bin/env bash
# Automated OWASP CRS Replace Script
cd /and so forth/nginx/owasp-crs
git fetch origin
LATEST_TAG=$(git describe --tags $(git rev-list --tags --max-count=1))
CURRENT_TAG=$(git describe --tags)

if [ "$LATEST_TAG" != "$CURRENT_TAG" ]; then
    git checkout $LATEST_TAG
    nginx -t && systemctl reload nginx
    echo "OWASP CRS up to date to $LATEST_TAG and Nginx reloaded." | mail -s "WAF Replace Discover" ops@instance.co.uk
fi

Earlier than deploying rule updates to manufacturing clusters, run automated HTTP regression take a look at suites (reminiscent of FTW – Framework for Testing WAFs) in your staging atmosphere to substantiate that official shopper workflows stay unaffected.

Actual-Time Log Evaluation with ModSecurity Audit Logs

ModSecurity generates complete audit logs containing the total HTTP request headers, POST physique, matched common expressions, and anomaly scores.

Configure JSON-formatted concurrent audit logging:

SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4(?!04))"
SecAuditLogParts ABIJDEFHZ
SecAuditLogType Concurrent
SecAuditLogStorageDir /var/log/modsecurity/audit/
SecAuditLog /var/log/modsecurity/modsec_audit.log

By setting SecAuditLogFormat JSON, logs may be ingested immediately into Elasticsearch, Grafana Loki, or Graylog, offering visible telemetry of blocked assault geographic origins, focused endpoints, and prime assault classes throughout your server fleet. Automated alert webhooks notify on-call engineers by way of Slack or PagerDuty each time an anomaly rating spike signifies an energetic zero-day exploitation marketing campaign.

Correlating ModSecurity with Fail2ban for Automated IP Null-Routing

Whereas ModSecurity effectively drops HTTP requests with an HTTP 403 Forbidden standing, persistent automated botnets proceed slamming the net server with tons of of malicious payloads each second. Even when each assault request is blocked by WAF guidelines, the sheer quantity of TCP handshakes, TLS negotiations, and common expression evaluations burns invaluable CPU cycles.

To get rid of this useful resource drain, configure Fail2ban to observe ModSecurity’s audit log and mechanically ban repeat offenders on the kernel iptables layer.

Create a devoted Fail2ban filter in /and so forth/fail2ban/filter.d/modsecurity.conf:

[Definition]
failregex = [client <HOST>] ModSecurity: Entry denied with code 403
ignoreregex =

Then add the corresponding jail definition in /and so forth/fail2ban/jail.native:

[nginx-modsecurity]
enabled  = true
port     = http,https
filter   = modsecurity
logpath  = /var/log/nginx/error.log
maxretry = 3
findtime = 300
bantime  = 86400
motion   = iptables-multiport[name=ModSec, port="http,https"]

With this correlation rule in place, an IP handle that triggers three ModSecurity blocks inside 5 minutes is immediately null-routed on the Linux firewall for twenty-four hours. The malicious shopper is dropped through the preliminary TCP SYN handshake, liberating Nginx and ModSecurity to serve official prospects with out processing overhead.

Integrating OWASP CRS with Brotli and Gzip Compression Engines

Trendy net architectures depend on dynamic compression algorithms (Gzip and Google Brotli) to speed up asset supply. Nevertheless, compression introduces distinctive challenges for net utility firewalls. If an attacker compresses malicious JSON or XML payloads inside a gzipped HTTP request physique, customary WAF string matching can not examine the obfuscated payload.

ModSecurity v3 incorporates native request physique decompression:

# Allow computerized request decompression in modsecurity.conf
SecRequestBodyAccess On
SecRequestBodyLimitAction Reject
SecRequestBodyNoFilesLimit 131072

When a shopper sends a compressed HTTP POST request with a Content material-Encoding: gzip or Content material-Encoding: br header, ModSecurity expands the stream into a brief reminiscence buffer, runs the entire OWASP CRS inspection guidelines towards the plain textual content, and discards malicious payloads earlier than decompression bombs can exhaust server RAM.

✓ Verified Technical Creator
5+ Years Enterprise Server Internet hosting, Safety Hardening & Programs Administration

Siddharth Upadhyay
(Senior Linux Safety & Infrastructure Advisor)

Siddharth Upadhyay is a Programs Advisor and Infrastructure Specialist at Onlive Server Pvt. Ltd. With over 5 years of expertise in Linux kernel safety, firewall architectures, and devoted internet hosting programs, he helps organizations harden manufacturing environments.