Step-by-Step Guide to Install and Configure ModSecurity with Nginx
1. Update and Install Required Packages
First, update your package list and install the necessary dependencies.
• sudo apt update
• sudo apt install git build-essential libpcre3 libpcre3-dev libssl-dev
zlib1g zlib1g-dev
• sudo apt install autoconf automake libtool pkg-config
2. Download and Compile ModSecurity
# Clone ModSecurity repository
• cd /usr/local/src
• sudo git clone --depth 1 [Link]
# Build ModSecurity
• cd ModSecurity
• sudo git submodule init
• sudo git submodule update
• sudo ./[Link]
• sudo ./configure
• sudo make
• sudo make install
3. Download and Compile ModSecurity Nginx Connector
# Clone the ModSecurity Nginx connector
• cd /usr/local/src
• sudo git clone --depth 1 [Link]
[Link]
# Download Nginx source
• sudo wget [Link]
• sudo tar -zxvf [Link]
• cd nginx-1.21.6
# Compile Nginx with the ModSecurity module
• sudo ./configure --add-module=/usr/local/src/ModSecurity-nginx --with-
http_ssl_module --with-stream
• sudo make
• sudo make install
4. Set Up Nginx Configuration
Create directories for your websites if not already done.
• sudo mkdir -p /var/www/[Link]
• sudo mkdir -p /var/www/[Link]
• sudo mkdir -p /var/www/[Link]
Create HTML files for each site.
• echo "<html><body><h1>Welcome to AxisPay</h1></body></html>" | sudo tee
/var/www/[Link]/[Link]
• echo "<html><body><h1>Welcome to Axis 01</h1></body></html>" | sudo tee
/var/www/[Link]/[Link]
• echo "<html><body><h1>Welcome to Axis 02</h1></body></html>" | sudo tee
/var/www/[Link]/[Link]
5. Install OWASP Core Rule Set (CRS)
Download and set up the OWASP Core Rule Set.
• cd /etc/nginx
• sudo mkdir modsec
• cd modsec
• sudo git clone --depth 1 [Link]
• sudo cp coreruleset/[Link] /etc/nginx/modsec/crs-
[Link]
• sudo cp coreruleset/rules/*.conf /etc/nginx/modsec/
6. Configure Nginx for Each Website
Create the main ModSecurity configuration file.
• sudo nano /etc/nginx/modsec/[Link]
Add the following content:
• Include /etc/modsecurity/[Link]
• Include /etc/nginx/modsec/[Link]
• Include /etc/nginx/modsec/rules/*.conf
Edit the Nginx configuration files for each website to include ModSecurity.
• sudo nano /usr/local/nginx/conf/[Link]
Add the following server blocks for each website:
# AxisPay
server {
listen 80;
server_name [Link];
modsecurity on;
modsecurity_rules_file /etc/nginx/modsec/[Link];
root /var/www/[Link];
index [Link];
location / {
try_files $uri $uri/ =404;
}
}
# Axis-01
server {
listen 80;
server_name [Link];
modsecurity on;
modsecurity_rules_file /etc/nginx/modsec/[Link];
root /var/www/[Link];
index [Link];
location / {
try_files $uri $uri/ =404;
}
}
# Axis-02
server {
listen 80;
server_name [Link];
modsecurity on;
modsecurity_rules_file /etc/nginx/modsec/[Link];
root /var/www/[Link];
index [Link];
location / {
try_files $uri $uri/ =404;
}
}
7. Test Nginx Configuration
Check the Nginx configuration for syntax errors.
• sudo /usr/local/nginx/sbin/nginx -t
8. Restart Nginx
Restart Nginx to apply the changes.
• sudo /usr/local/nginx/sbin/nginx -s reload
Verify ModSecurity
To verify that ModSecurity is working, you can check the Nginx error log and ModSecurity
audit log. The default location for the ModSecurity audit log is /var/log/modsec_audit.log.
Conclusion
By following these steps, you have installed and configured ModSecurity with Nginx on Ubuntu.
ModSecurity is now enabled for all three websites ([Link], [Link], and axis-
[Link]), providing a layer of security to protect against common web application attacks.
