1

Ubuntu 18.04
Apache/2.4.29
ModSecurity for Apache/2.9.2 (http://www.modsecurity.org/); OWASP_CRS/3.0.0
modsecurity-crs 3.0.2-1

This is a new server. The following message appears in modsec_audit.log in every entry:

--c2d2e910-H--
Message: Warning. Operator EQ matched 0 at TX. [file 
"/usr/share/modsecurity-crs/rules/REQUEST-901-INITIALIZATION.conf"] 
[line "56"] [id "901001"] [msg "ModSecurity Core Rules setup file has 
not been detected. Threat detection and blocking may be nonfunctional. 
Please ensure to make a copy of the setup template crs- 
setup.conf.example, and include your crs-setup.conf file in your 
webserver configuration before including the CRS rules."] [severity 
"WARNING"]

 

me@www:~$ apache2ctl -t -D DUMP_MODULES |grep security2_module
 security2_module (shared)

As shown above, the module is loaded. My Apache conf has an <IfModule security2_module> stanza that includes:

IncludeOptional /usr/share/modsecurity-crs/owasp-crs.load

The file owasp-crs.load has:

Include /etc/modsecurity/crs/crs-setup.conf
IncludeOptional /etc/modsecurity/crs/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
Include /usr/share/modsecurity-crs/rules/*.conf
IncludeOptional /etc/modsecurity/crs/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf

 

me@www:~$ ls /etc/modsecurity/crs/crs-setup.conf
/etc/modsecurity/crs/crs-setup.conf

As the warning states, crs-setup.conf can't be found though the file exists in the specified location. However, the system seems to be working properly. For example, in crs-setup.conf if I remove all HTTP methods from ID 900200 then I get a HTTP 403 Forbidden which is expected based on how I have the system configured.

Your thoughts and experience are appreciated in helping to resolve this.

Thank you.

2
  • The message concerns [file "/usr/share/modsecurity-crs/rules/REQUEST-901-INITIALIZATION.conf" while conf samples are 900 / 999 files: where is the 901 located? in /usr/share/modsecurity-crs/rules/*.conf? If so, replace the IncludeOptional of 900 with Include : if error is now on file 900, then it means the crs-setup is indeed not loaded (check the file permissions maybe) and if error is still on 901 then it means the 900 file is breaking the conf defined by crs-setup.conf so check 900's content – Xenos Nov 19 '19 at 10:49
  • File /usr/share/modsecurity-crs/rules/REQUEST-901-INITIALIZATION.conf exists - that's where the text "ModSecurity Core Rules setup file has not been detected. Threat detection and blocking may be nonfunctional. Please ensure to make a copy of the setup template crs-setup.conf.example, and include your crs-setup.conf file in your webserver configuration before including the CRS rules." comes from in the warning message. File /etc/modsecurity/crs/crs-setup.conf is loaded as noted in my original post. Further proof of that is if I rename crs-setup.conf then Apache fails to restart. – user1801810 Nov 19 '19 at 14:05
0

After further research and testing I've come to the conclusion that this is a spurious message which can safely be ignored in my situation. My system is otherwise working as intended and expected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.