How to install and secure egroupware - Directory UMM

ModSecurity supports Apache 1.3x and Apache 2.x.
6.2.1 Installing ModSecurity
Unpack the mod_security source:
[root@server tmp]# tar xzvf mod_security-x.x.x.tar.gz
Change to the mod_security directory:
[root@server tmp]# cd mod_security-x.x.x/apache2
You can compile the module as an Apache DSO (Dynamic Shared Object) module or statically into the web
server. If you compile it statically, you must also recompile Apache. This may yield a slight performance gain,
but in general it is not significant. The following example shows only how to compile ModSecurity as a DSO
module:
[root@server apache2]# apxs -cia mod_security.c
Under Redhat, add the follow line to your httpd.conf under the section where the modules are loaded:
[root@server mod_security-1.7.4]# vi /etc/httpd/conf/httpd.conf
Include /etc/httpd/conf.d/mod_security.conf
You must restart your Apache web server to activate ModSecurity:
6.2.2 Basic setup
[root@server mod_security-1.7.4]# apachectl stop
[root@server mod_security-1.7.4]# apachectl start
ModSecurity has some sample setup files included to help you configure it. You can also convert Snort rules to
use them inside ModSecurity. Sample Snort rules can found on the project server or you can convert them
yourself.
# Turn the filtering engine On or Off
SecFilterEngine On
# Make sure that URL encoding is valid
SecFilterCheckURLEncoding On
# The audit engine works independently and
# can be turned On of Off on the per-server or
# on the per-directory basis. "On" will log everything,
# "DynamicOrRelevant" will log dynamic requests or violations,
# and "RelevantOnly" will only log policy violations
SecAuditEngine RelevantOnly
Reiner Jung Install and Secure eGroupWare Page 34 of 67