OWASP Installation and Configuration

Prerequisites

Log in to your server as user “root” user credentials and make sure that all packages are up to date. You can make use of the below command to update your CentOS 7 server.

#yum -y update

After the system, update install the following dependencies as ModSecurity 2.x works only with Apache 2.0.x or higher. Let’s run the below command to install apache and its other dependencies as shown below.

#yum install gcc make httpd-devel libxml2 pcre-devel libxml2-devel curl-devel git

Installing mod_security

#cd /opt/

#wget https://www.modsecurity.org/tarball/2.9.1/modsecurity-2.9.1.tar.gz

Extract the downloaded archive and change the current working directory to the newly extracted directory using the below commands.

#tar xzfv modsecurity-2.9.1.tar.gz

#cd modsecurity-2.9.1

Now, using the below commands configure, compile, and install mod_security from the source code

#./configure

#make install

Configure mod_security

After installation setup of mod_security, copy recommended configuration files

#cp modsecurity.conf-recommended /etc/httpd/conf.d/modsecurity.conf

#cp unicode.mapping /etc/httpd/conf.d/

Now we need to configure the Apache webserver. Open the web server configuration file and add the following lines to it.

#cat /etc/httpd/conf/httpd.conf

LoadModule security2_module modules/mod_security2.so

LoadModule unique_id_module modules/mod_unique_id.so

Save the changes using and restart Apache services.

#systemctl restart httpd.service

#systemctl status httpd.service

#systemctl enable httpd.service

Installing OWASP

Now we will install OWSAP CRS to be integrated with Apache’s ModSecurity. Use below commands to download and configure OWASP

#cd /etc/httpd

#git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git

#mv owasp-modsecurity-crs modsecurity-crs

#cd modsecurity-crs

#cp modsecurity_crs_10_setup.conf.example modsecurity_crs_10_config.conf

Again open the Apache configuration file to add the following lines at the end

#cat /etc/httpd/conf/httpd.conf

LoadModule security2_module modules/mod_security2.so

LoadModule unique_id_module modules/mod_unique_id.so

So now you’ve installed Mod_Security and OWASP-CRS, it’s time to restart Apache service

#systemctl restart httpd.service

It will protect your Linux CentOS 7 Apache server. It gives you a couple of other advantages like

Real-time Blacklist Lookups: utilizes 3rd Party IP Reputation

Web-based Malware Detection identifies malicious web content by check against the Google Safe Browsing API.

Identification of Application Defects: alerts on application misconfigurations.

HTTP Denial of Service Protections: defense against HTTP Flooding and Slow HTTP DoS Attacks.

Relevant Blogs:

Jfrog integrating with jenkins

OWASP Installation and Configuration

Docker volumes

Aws Launch instance from AMI

Recent Comments

No comments

OWASP Installation and Configuration

Recent Comments

Leave a Comment