Comprehensive Guide to ModSecurity: Logs, Configuration, and Important Limits Print

ModSecurity is a powerful web application firewall (WAF) that provides comprehensive protection for web applications by detecting and blocking attacks. In this guide, we will explore the fundamentals of ModSecurity, how to view and analyze logs, modify settings, and the importance of configuration files. We will also cover key directives like SecRequest/SecRule and provide insights into troubleshooting common issues.

1. Introduction to ModSecurity

ModSecurity, often referred to as "modsec," acts as a security layer that intercepts HTTP requests and filters out harmful traffic. By monitoring web traffic for suspicious behavior, it provides a robust defense against common web vulnerabilities such as SQL injection, cross-site scripting (XSS), and more.

• Primary Features of ModSecurity:
  • Real-time web application monitoring
  • Blocking malicious traffic based on predefined rules
  • Logging HTTP requests and responses for auditing purposes
  • Flexibility to create custom security rules

ModSecurity is highly customizable and works well with Apache, Nginx, and other web servers.

2. How ModSecurity Works

ModSecurity operates in two key phases:

• Phase 1: Request Processing: Inspects the incoming HTTP requests before they are processed by the web application.
• Phase 2: Response Processing: Inspects the server’s response to the client to ensure no sensitive information is exposed.

When traffic matches a rule, ModSecurity either allows, logs, or blocks the request based on its configuration.

3. Key Configuration Files in ModSecurity

ModSecurity’s behavior is defined by its configuration files. These files are used to enable or disable features, customize rules, and set size limits.

3.1. modsecurity.conf

This is the main configuration file that typically includes default directives for ModSecurity. You’ll find it in locations such as /etc/modsecurity/ or /etc/httpd/conf.d/.

3.2. /etc/httpd/conf/extra/httpd-modsecurity.conf

In certain configurations, you’ll find advanced settings, such as size limits, in this file. This is where global ModSecurity settings like SecRequestBodyLimit can be configured.

3.3. Rule Configuration Files

ModSecurity uses rule sets such as OWASP ModSecurity Core Rule Set (CRS) and Imunify360 rules. These rule files define which traffic ModSecurity considers malicious. Example locations:

• /etc/modsecurity.d/owasp-modsecurity-crs/
• /etc/modsecurity.d/

4. How to Access and Analyze ModSecurity Logs

ModSecurity maintains detailed logs for all requests that match its rules. These logs are crucial for troubleshooting and understanding blocked requests.

4.1. Key Log Files

• Audit Log: The primary log for ModSecurity, typically found at /var/log/httpd/modsec_audit.log or /var/log/apache2/modsec_audit.log.
• Error Log: Captures any issues encountered during ModSecurity operation, located at /var/log/httpd/error_log.

4.2. Viewing ModSecurity Logs

Use the following commands to view the logs:

# Display the most recent entries in the audit log
tail -f /var/log/httpd/modsec_audit.log

To search for specific requests or rule matches, use grep:

# Search for a specific transaction ID
grep 'transaction_id' /var/log/httpd/modsec_audit.log

4.3. Understanding Audit Log Format

ModSecurity's audit log contains multiple sections:

• Transaction Information: Includes the request details (method, URI, headers).
• Matched Rules: Lists the rules that were triggered, including rule ID and message.
• Action Taken: Whether the request was allowed or blocked.

5. Modifying ModSecurity Configuration and Settings

To adapt ModSecurity to your needs, you can modify the configuration and adjust important limits such as the size of the request body or response body.

5.1. Editing ModSecurity Configuration

You can modify ModSecurity's configuration by editing its main configuration file:

nano /etc/httpd/conf/extra/httpd-modsecurity.conf

5.2. Key Directives in ModSecurity

SecRequestBodyLimit

Defines the maximum size of the request body that ModSecurity will process. This is critical when dealing with large file uploads.

• Default Value: 13107200 (12.5 MB)
• To increase it to 50 MB:

  SecRequestBodyLimit 52428800
  ​

SecResponseBodyLimit

Limits the size of the response body that ModSecurity processes.

• Default Value: 524288 (512 KB)
• Increase it as necessary:

  SecResponseBodyLimit 1048576
  ​

SecRuleEngine

Enables or disables ModSecurity.

• To disable ModSecurity temporarily:

SecRuleEngine Off

# For Apache:
service httpd reload

# For Nginx:
service nginx reload

grep 'Request_URI' /var/log/httpd/modsec_audit.log

SecRuleRemoveById 981176