Apache failing due to Mod_security SecAuditLogFormat JSON

S

SteveN2020

Verified User
Joined
Jun 21, 2020
Messages
6
Hi all,

The file
Code: 
./custombuild/configure/ap2/conf/extra/httpd-modsecurity.conf
was updated on 19th June, and I am now unable to start apache due to
Code: 
Invalid command 'SecAuditLogFormat', perhaps misspelled or defined by a module
. Removing the line
Code: 
SecAuditLogFormat JSON
from
Code: 
/etc/httpd/conf/extra/httpd-modsecurity.conf
solves this, but on a rebuild of conf or mod_security the problem returns, presumably due to the template file.

I have seen this bug-fix : https://forum.directadmin.com/threads/changelog.60248/
Code: 
2509 - Fix "SecAuditLogFormat JSON" support in ModSecurity 2.9 (used for Apache). Requires recompilation of ModSecurity.
But can't find the original bug. Has this issue regressed back into the code base? Anyone else having similar problems?

Thanks.
 
Yes it does, same problem :
Code: 
make[1]: Leaving directory '/usr/local/directadmin/custombuild/modsecurity-2.9.3'
ModSecurity has been installed successfully.
Installing OWASP Core Rule Set for ModSecurity...
Copying custom ModSecurity rules to /etc/modsecurity.d/...
Installation of ModSecurity Rule Set has been finished.
Job for httpd.service failed because the control process exited with error code.
See "systemctl status httpd.service" and "journalctl -xe" for details.
 
SteveN2020 said:
Yes it does, same problem :
Code: 
make[1]: Leaving directory '/usr/local/directadmin/custombuild/modsecurity-2.9.3'
ModSecurity has been installed successfully.
Installing OWASP Core Rule Set for ModSecurity...
Copying custom ModSecurity rules to /etc/modsecurity.d/...
Installation of ModSecurity Rule Set has been finished.
Job for httpd.service failed because the control process exited with error code.
See "systemctl status httpd.service" and "journalctl -xe" for details.
Click to expand...
Anything in custom/modsecurity? Are you sure you’re running latest version of CustomBuild? Any errors when building modsecurity? What’s the OS there, does it have yajl library installed?
 
smtalk said:
Anything in custom/modsecurity? Are you sure you’re running latest version of CustomBuild? Any errors when building modsecurity? What’s the OS there, does it have yajl library installed?
Click to expand...

Custombuild 2.0.0 (rev: 2510), Centos 8.1.1911, only a couple of rule customisations to disable the engine based on some IPs, errors in modsecurity build are :
Code: 
No match for argument: lua-devel
Error: Unable to find a match: lua-devel
Last metadata expiration check: 0:14:03 ago on Sun Jun 21 20:57:29 2020.
No match for argument: yajl-devel
Error: Unable to find a match: yajl-devel

I'll hunt them down and see if that helps. Looks like that might be the issue.
 
All sorted, I was missing those dependencies. On Cenots 8 I needed to:
Code: 
dnf config-manager --set-enabled PowerTools
dnf install yajl-devel lua-devel

Thanks for your help.
 
We are facing this same issue.

Tried "./build modsecurity", but no luck.

Please advise.

root@srv [/]# ./build modsecurity
-bash: ./build: No such file or directory
root@srv [/]#
Click to expand...
 
You need to do this first:
Code: 
cd /usr/local/directadmin/custombuild
 
smtalk said:
You need to do this first:
Code: 
cd /usr/local/directadmin/custombuild
Click to expand...

Now able to run ' ./build modsecurity', but it's showing many errors including following and server went offline.

dm-0: write failed, user file limit reached.

sh: -c: line 0: syntax error near unexpected token `(' sh: -c: line 0: `/usr/local/cwaf/scripts/suid /usr/local/cwaf/scripts/cwaf-wrapper.pl da_get_aliases LANGUAGE = (unset), 2>&1'
 
I'd suggest trying owasp ruleset (default). /usr/local/cwaf/scripts/cwaf-wrapper.pl comes from Comodo (3rd party script).
 
smtalk said:
I'd suggest trying owasp ruleset (default). /usr/local/cwaf/scripts/cwaf-wrapper.pl comes from Comodo (3rd party script).
Click to expand...
I'm facing same issue. Could you please explain how to do this exactly? I'm new to server administration. If possible, please advise with exact steps or commands to sole this issue.
 
You must log in or register to reply here.
Back
Top