HOW TO modsecurity (freeBSD)

Updated- how to from for DA with FreeBSD: http://www.webhostgear.com/62.html

Oke, This is to install mod_security
How to install?
1. Login to your server through SSH and su to the root user.

2. First your going to start out by grabbing the latest version of mod_security
wget http://www.modsecurity.org/download/modsecurity-1.8.7.tar.gz

3. Next we untar the archive and cd into the directory:
tar zxvf modsecurity-1.8.7.tar.gz
cd modsecurity-1.8.7/

4. Now you need to determine which version of apache you use:
APACHE 1.3.x users
cd apache1/
APACHE 2.x users
cd apache2/

5. Lets Compile the module now:
/usr/sbin/apxs -cia mod_security.c

6. Ok, now its time to edit the httpd conf file. First we will make a backup just incase something goes wrong:
cp /etc/httpd/conf/httpd.conf /etc/httpd/conf/httpd.conf.backup

7. Now that we have backed it all up, we can edit the httpd.conf. Replace pico with nano depending on what you have:
ee /etc/httpd/conf/httpd.conf

8. Lets look for something in the config, you are going to search for

<IfModule mod_dir.c> (altho any of the IfModules would work fine)

9. Now add this

<IfModule mod_security.c>
# Turn the filtering engine On or Off
SecFilterEngine On

# Change Server: string
SecServerSignature "Apache"


# This setting should be set to On only if the Web site is
# using the Unicode encoding. Otherwise it may interfere with
# the normal Web site operation.
SecFilterCheckUnicodeEncoding Off

# The audit engine works independently and
# can be turned On of Off on the per-server or
# on the per-directory basis. "On" will log everything,
# "DynamicOrRelevant" will log dynamic requests or violations,
# and "RelevantOnly" will only log policy violations
SecAuditEngine RelevantOnly

# The name of the audit log file
SecAuditLog logs/audit_log

# Should mod_security inspect POST payloads
SecFilterScanPOST On

# Action to take by default
SecFilterDefaultAction "deny,log,status:403"

## ## ## ## ## ## ## ## ## ##
## ## ## ## ## ## ## ## ## ##

# Require HTTP_USER_AGENT and HTTP_HOST in all requests
# SecFilterSelective "HTTP_USER_AGENT|HTTP_HOST" "^$"

# Require Content-Length to be provided with
# every POST request
SecFilterSelective REQUEST_METHOD "^POST$" chain
SecFilterSelective HTTP_Content-Length "^$"

# Don't accept transfer encodings we know we don't handle
# (and you don't need it anyway)
SecFilterSelective HTTP_Transfer-Encoding "!^$"

# Protecting from XSS attacks through the PHP session cookie
SecFilterSelective ARG_PHPSESSID "!^[0-9a-z]*$"
SecFilterSelective COOKIE_PHPSESSID "!^[0-9a-z]*$"

SecFilter "viewtopic\.php\?" chain
SecFilter "chr\(([0-9]{1,3})\)" "deny,log"

# Block various methods of downloading files to a server
SecFilterSelective THE_REQUEST "wget "
SecFilterSelective THE_REQUEST "lynx "
SecFilterSelective THE_REQUEST "scp "
SecFilterSelective THE_REQUEST "ftp "
SecFilterSelective THE_REQUEST "cvs "
SecFilterSelective THE_REQUEST "rcp "
SecFilterSelective THE_REQUEST "curl "
SecFilterSelective THE_REQUEST "telnet "
SecFilterSelective THE_REQUEST "ssh "
SecFilterSelective THE_REQUEST "echo "
SecFilterSelective THE_REQUEST "links -dump "
SecFilterSelective THE_REQUEST "links -dump-charset "
SecFilterSelective THE_REQUEST "links -dump-width "
SecFilterSelective THE_REQUEST "links http:// "
SecFilterSelective THE_REQUEST "links ftp:// "
SecFilterSelective THE_REQUEST "links -source "
SecFilterSelective THE_REQUEST "mkdir "
SecFilterSelective THE_REQUEST "cd /tmp "
SecFilterSelective THE_REQUEST "cd /var/tmp "
SecFilterSelective THE_REQUEST "cd /etc/httpd/proxy "
</IfModule>

10. Save the file

11. Restart Apache

/usr/local/etc/rc.d/httpd restart

If sites start to have problems look at error log.
/etc/httpd/logs/audit_log

Someone have beter rules?

Very hard to get a perfect ruleset, the best advice is to start and then monitor and monitor some more keep an eye on the audit log so no false positives.

Apache 1.x also struggles a bit with regex.

# Turn the filtering engine On or Off
SecFilterEngine DynamicOnly

(stops scanning of files such as static images)

# Debug level set to a minimum
SecFilterDebugLog logs/modsec_debug_log
SecFilterDebugLevel 0

# The name of the audit log file
SecAuditLog /var/log/httpd/audit_log

(very important you log whats going on)

# Should mod_security inspect POST payloads
SecFilterScanPOST On

(be careful as forums can be affected with false positives)

# Very crude filters to prevent SQL injection attacks
SecFilter "delete[[:space:]]+from"
SecFilter "insert[[:space:]]+into"

(this breaks phpmyadmin fix below)

# allow phpmyadmin
<Location /phpMyAdmin/>
SecFilterInheritance Off
</Location>
<Location /phpmyadmin/>
SecFilterInheritance Off
</Location>

and finally

# normalise cookies
SecFilterNormalizeCookies Off
# enable version 1 (RFC 2965) cookies
SecFilterCookieFormat 1

Now to use dynamic only, on default httpd.conf configurations php will NOT count as dynamic as it isnt a handler so add this to httpd.conf

<IfModule mod_php4.c>
AddHandler application/x-httpd-php .inc .php .php4 .php3 .phtml
AddHandler application/x-httpd-php-source .phps
</IfModule>
<IfModule mod_php3.c>
AddHandler application/x-httpd-php3 .php3
AddHandler application/x-httpd-php3-source .phps
</IfModule>
<IfModule mod_php.c>
AddHandler application/x-httpd-php .phtml
</IfModule>

now php is treated as dynamic content.

How do i know that mod_security works?