Is there an easy way to secure Apache on debian?

Question

I run an Apache webserver with lots of PHP-sites of several customers.

I tried install apache-mod_security2 after this (german) tutorial that is using these rulesets: http://www.modsecurity.org/download/modsecurity-core-rules_2.5-1.6.1.tar.gz

but if I enable that, nearly all pages have lots of warnings.

I know, it would be best, to adapt all sites, so no warnings are thrown anymore, but that is just too much work for one admin, so I would like to pull those rules down to only the obvious critical Attacks.

Answer 1

I know your pain; unfortunately, there really is not much you can do if you're using the core rule set.

You will need to whitelist rules using SecRuleRemoveById. This can obviously get cumbersome. So, what we do in our infrastructure is note what rules are whitelisted for what CMS and whitelist all those rules based on the CMS' that are being ran on the server.

I've been told that TrustWave has specific rules that apply to specific CMS'.

Answer 2

For Properly Configuring CRS with Mod Security you need to Configure:

1. Mode of Operation (Traditional vs. Anomaly Scoring)
2. Setting Anomaly Scoring Severity Levels
3. Setting Anomaly Scoring Threshold Levels (Blocking)
4. Enable/Disable Blocking
5. Choose where to log events (Configuration ModSecurity Log Collecter (Mlogc))

Source

• "Advanced Topic of the Week: Traditional vs. Anomaly Scoring Detection Modes"
• "ModSecurity Advanced Topic of the Week: (Updated) Exception Handling"