modsecurity2 installation error

[Barakat]

all what i did is like this

the libxml2 ---> http://xmlsoft.org/downloads.html is already on my server

i stoped the httpd from the directadmin ,


and connect throu the root by putty!

the cd ..

mkdir pro

cd pro

wget http://www.modsecurity.org/download/modsecurity-apache_2.5.7.tar.gz

tar xvfz modsecurity-apache_2.5.7.tar.gz

cd modsecurity-apache_2.5.7

cd apache2

then i start it that way

./configure --with-apxs=/usr/sbin/apxs

make

then
make test

then

make install

after that on the last line of the httpd.conf

nano -w /etc/httpd/conf/httpd.conf i add those line


## Load Mod Security Modules and Required Libraries
LoadFile /usr/lib/libxml2.so

LoadModule security2_module modules/mod_security2.so
Include conf.d/modsecurity2/*.conf
Include conf.d/modsecurity2/optional_rules/*.conf

i got error coz the mod_security2.so is not found in that directory and i dont know why the files wont be copied to its locations ,,, ????


so i cp mod_security2.so to the /usr/lib/modules/mod_security2.so

then i cp also all the rules and the optional_rules to /etc/httpd/conf.d/modsecurity2/


adding after the last line in the httpd.conf file to :

## Load Mod Security Modules
LoadFile /usr/lib/libxml2.so
LoadModule security2_module modules/mod_security2.so
include /etc/httpd/conf.d/modsecurity2/*.conf
include /etc/httpd/conf.d/modsecurity2/optional_rules/*.conf

then try to see errors from typeing the apachectl configtest at root

i got that i have errory of



[root@server /]# apachectl configtest
Syntax error on line 191 of /etc/httpd/conf.d/modsecurity2/modsecurity_crs_10_config.conf:
ModSecurity: Failed to open the audit log file: /etc/httpd/logs/modsec_audit.log


shall i make a directory in /etc/httpd/ and name it logs
and try to copy the modsec_audit.log to it ??????????????


or what is happening over there ?


thanks in advance

 

[Barakat]

any way it works ,,,, after i remove the

include /etc/httpd/conf.d/modsecurity2/optional_rules/*.conf

coz it seems i need to install the mlog ,,,,


thanks ,,,