mod security

install mod security then

Add in httpd.conf

 Include /etc/httpd/conf/extra/modsecurity.d/owasp-modsecurity-crs/crs-setup.conf

Include /etc/httpd/conf/extra/modsecurity.d/owasp-modsecurity-crs/rules/*.conf

LoadModule security2_module /usr/local/modsecurity/lib/mod_security2.so

<IfModule mod_security2.c>

Include /etc/httpd/conf/extra/modsecurity.conf

</IfModule>

https://www.netnea.com/cms/apache-tutorial-7_including-modsecurity-core-rules/

Step 1: Downloading OWASP ModSecurity Core Rule Set

The ModSecurity Core Rule Set are being developed under the umbrella of OWASP, the Open Web Application Security Project. The rules themselves are available on GitHub and can be downloaded via git or with the following wget command:

$> cd /apache/conf
$> wget https://github.com/coreruleset/coreruleset/archive/v3.3.0.tar.gz

Installing on Apache

--------------------

    1. Install ModSecurity for Apache

    2. Ensure that ModSecurity is loading correctly by checking error.log

    at start up for lines indicating ModSecurity is installed. An example

    might appear as follows:

    ```ModSecurity for Apache/2.9.1 (http://www.modsecurity.org/) configured.```

    3. The most common method of deploying ModSecurity we have seen is

    to create a new folder underneath the Apache directory (typically

    /usr/local/apache/, /etc/httpd/, or /etc/apache2). Often this folder

    is called 'modsecurity.d'. Create this folder and cd into it.

    4. Download our release from https://coreruleset.org/installation/

    and unpack it into a new owasp-modsecurity-crs folder.

    5. Move the crs-setup.conf.example file to crs-setup.conf.

    Please take the time to go through this file and customize the settings

    for your local environment. Failure to do so may result in false

    negatives and false positives. See the section entitled OWASP CRS

    Configuration for more detail.

    6. Rename rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example and

    rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example to remove the

    '.example' extension. This will allow you to add exclusions without updates

    overwriting them in the future.

  

 7. Add the following line to your httpd.conf/apache2.conf (the following

    assumes you've put CRS into modsecurity.d/owasp-modsecurity-crs). You

    can alternatively place these in any config file included by Apache:

    ```

        <IfModule security2_module>

                Include modsecurity.d/owasp-modsecurity-crs/crs-setup.conf

                Include modsecurity.d/owasp-modsecurity-crs/rules/*.conf

    </IfModule>

        ```

    8. Restart web server and ensure it starts without errors

    9. Make sure your web sites are still running fine.

    10. Proceed to the section "Testing the Installation" below.

check mod sec logs in /var/log/mod_Sec.log