ModSecurity for Apache/2.9.2 (http://www.modsecurity.org/); OWASP_CRS/3.0.0
This is a new server. The following message appears in
modsec_audit.log in every entry:
--c2d2e910-H-- Message: Warning. Operator EQ matched 0 at TX. [file "/usr/share/modsecurity-crs/rules/REQUEST-901-INITIALIZATION.conf"] [line "56"] [id "901001"] [msg "ModSecurity Core Rules setup file has not been detected. Threat detection and blocking may be nonfunctional. Please ensure to make a copy of the setup template crs- setup.conf.example, and include your crs-setup.conf file in your webserver configuration before including the CRS rules."] [severity "WARNING"]
me@www:~$ apache2ctl -t -D DUMP_MODULES |grep security2_module security2_module (shared)
As shown above, the module is loaded. My Apache conf has an
<IfModule security2_module> stanza that includes:
Include /etc/modsecurity/crs/crs-setup.conf IncludeOptional /etc/modsecurity/crs/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf Include /usr/share/modsecurity-crs/rules/*.conf IncludeOptional /etc/modsecurity/crs/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
me@www:~$ ls /etc/modsecurity/crs/crs-setup.conf /etc/modsecurity/crs/crs-setup.conf
As the warning states,
crs-setup.conf can't be found though the file exists in the specified location. However, the system seems to be working properly. For example, in
crs-setup.conf if I remove all HTTP methods from ID
900200 then I get a HTTP 403 Forbidden which is expected based on how I have the system configured.
Your thoughts and experience are appreciated in helping to resolve this.