1

I read about the hack at Ubuntu Forums yesterday. Since we hold customer data things like this always makes me worried, and I look to minimise our risk of attack.

There is an option to enable ModSecurity in my CPanel. I assume this is done without breaking anything on the site? But what extra security does this bring against hackers and does it allow notification of hacks?

4

what extra security does this bring

Out of the box? None. You need to add rules to the system in order to start restricting access. The problem is that some of these may break your application.

We don't know what your magic button in cPanel does. I would recommend you have a look at the OWASP rules. If they don't make any sense to you then you need to work on your knowledge of HTTP, attack methods and mod_security before you press that button. And you should be asking the people who provided the button to tell you what it does.

You didn't say if this was a VM, container or shared host.

I look to minimise our risk of attack

Is that your question or are you only asking about mod_security? Your biggest risk is probably the applications you are running on your server. Keeping them patched and up to date will therefore give you your biggest security wins. Similar for the underlying OS and distribution.

The attack you reference in your post was possible because the admins had not installed a patch available from the software supplier.

1

modSecurity is a software application firewall as part of Apache.

assuming Apache v2+; modSecurity provides a significant array of analysis via regular expressions. the idea is to analysis content coming to your application and modSecurity makes a best guess on the content; if modSecurity believes the content to be malicious it is blocked.

modSecurity has many sub components including SQL injection, XSS etc. from experience I would not make the assumption your site will be perfect after you enable it.

if your web app is very string/text originated modSecurity can throw out lots of false positives.

it's a nice module and some very impressive regular expressions. it is possible to run in analyze mode and just report on findings without blocking content. you can run in this mode for a period of time and then decide if this works for your web app. the best mode I found was anomaly mode; this is where modSecurity decides on the threshold eg if enough rules are flagged then block the content.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.