Editing Mod Security Issue on BJP Site

[[category:BJP]]

=='''Mod Security Issue on BJP Site - Issue Finally Closed''' ==


While activating the 00_mod_security.conf  it give the following Error 


 httpd: Syntax error on line 212 of /httpdjail/etc/httpd/conf/httpd.conf: Syntax error on line 3 of   /httpdjail/etc/httpd/conf.d/00_mod_security.conf: Cannot load /etc/httpd/modules/mod_security2.so into server:  /etc/httpd/modules/mod_security2.so: '''undefined symbol: ap_get_server_banner'''

==Temporary solution==

'''Solution Came from --'''

 http://www.centos.org/modules/newbb/viewtopic.php?topic_id=13208

Done 
 
 yum install mod_perl-devel


mod_security Activated at line number 212 on file  /httpdjail/etc/httpd/conf/httpd.conf

 Include /httpdjail/etc/httpd/conf.d/00_mod_security.conf



Output Shows that Mod_Security is Running a


 [Wed Feb 20 13:35:50 2013] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
 [Wed Feb 20 13:35:51 2013] [notice] ModSecurity for Apache/2.7.1 (http://www.modsecurity.org/) configured.
 [Wed Feb 20 13:35:51 2013] [notice] ModSecurity: APR compiled version="1.4.6"; loaded version="1.2.7"
 [Wed Feb 20 13:35:51 2013] [warn] ModSecurity: Loaded APR do not match with compiled!
 [Wed Feb 20 13:35:51 2013] [notice] ModSecurity: PCRE compiled version="6.6 "; loaded version="6.6 06-Feb-2006"
 [Wed Feb 20 13:35:51 2013] [notice] ModSecurity: LUA compiled version="Lua 5.1"
 [Wed Feb 20 13:35:51 2013] [notice] ModSecurity: LIBXML compiled version="2.7.6"
 [Wed Feb 20 13:35:51 2013] [notice] Original server signature: Apache
 [Wed Feb 20 13:35:51 2013] [notice] Digest: generating secret for digest authentication ...
 [Wed Feb 20 13:35:51 2013] [notice] Digest: done
 [Wed Feb 20 13:35:51 2013] [notice] mod_chroot: changed root to /httpdjail.
 [Wed Feb 20 13:35:51 2013] [warn] pid file /var/run/httpd.pid overwritten -- Unclean shutdown of previous Apache run?
 [Wed Feb 20 13:35:52 2013] [notice] Apache configured -- resuming normal operations

Version of Httpd on BJP Server

httpd -v 

Server version: Apache/2.2.3
Server built:   Jan 10 2013 08:19:28


'''Still the Issue''' 

# When activated the site is not accessible at all.
# No logs are generated or traceable

== Updrade of httpd ==

So Decided to Update the httpd version to fix the issue of mod-security , as suggested t

We have used the following Repo to update  
 
 http://www.jasonlitka.com/yum-repository/


'''Process of Update httpd to 2.2.22'''

 rpm --import http://www.jasonlitka.com/media/RPM-GPG-KEY-jlitka
 yum utterramblings http://www.jasonlitka.com/media/EL4/$ARCH

 vi /etc/yum.repos.d/utterramblings.repo
 yum update
 yum remove httpd-devel.i386
 yum --enablerepo=utterramblings install httpd
 
'''Updated the httpd version''' 

 httpd -v
 Server version: Apache/2.2.22 (Unix)
 Server built:   Feb 23 2012 12:28:12

While restart of the Server we faced /httpdjail not  found .

Issue - error_log  , Apache failed  

 [Wed Feb 20 16:43:54 2013] [notice] core dump file size limit raised to 18446744073709551615 bytes
 [Wed Feb 20 16:43:54 2013] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
 [Wed Feb 20 16:43:54 2013] [notice] ModSecurity for Apache/2.7.1 (http://www.modsecurity.org/) configured.
 [Wed Feb 20 16:43:54 2013] [notice] ModSecurity: APR compiled version="1.4.6"; loaded version="1.2.7"
 [Wed Feb 20 16:43:54 2013] [warn] ModSecurity: Loaded APR do not match with compiled!
 [Wed Feb 20 16:43:54 2013] [notice] ModSecurity: PCRE compiled version="6.6 "; loaded version="6.6 06-Feb-2006"
 [Wed Feb 20 16:43:54 2013] [notice] ModSecurity: LUA compiled version="Lua 5.1"
 [Wed Feb 20 16:43:54 2013] [notice] ModSecurity: LIBXML compiled version="2.7.6"
 [Wed Feb 20 16:43:54 2013] [notice] Original server signature: Apache
 [Wed Feb 20 16:43:55 2013] [notice] Digest: generating secret for digest authentication ...
 [Wed Feb 20 16:43:55 2013] [notice] Digest: done
 [Wed Feb 20 16:43:56 2013] [notice] mod_chroot: changed root to /httpdjail.
 [Wed Feb 20 16:43:56 2013] [warn] pid file /var/run/httpd.pid overwritten -- Unclean shutdown of previous Apache run?
 [Wed Feb 20 16:43:56 2013] [alert] (2)'''No such file or directory: Can't chdir to /httpdjail'''
 PHP:  Error parsing /etc/php.ini on line 1230
 [Wed Feb 20 16:43:56 2013] [alert] (2)No such file or directory: Can't chdir to /httpdjail
 PHP:  Error parsing /etc/php.ini on line 1230
 [Wed Feb 20 16:43:56 2013] [alert] (2)No such file or directory: Can't chdir to /httpdjail
 PHP:  Error parsing /etc/php.ini on line 1230
 [Wed Feb 20 16:43:56 2013] [notice] Apache/2.2.22 (Unix) DAV/2 mod_chroot/0.5 Apache mod_perl/2.0.4 Perl/v5.8.8 configured -- resuming normal  operations
 [Wed Feb 20 16:43:56 2013] [alert] Child 32602 returned a Fatal error... Apache is exiting!


To fix /httpdjail issue we have followed , which said that mod_chroot is in-built function of httpd and no mod_chroot is required seperately 

 http://www.cyberciti.biz/tips/chroot-apache-under-rhel-fedora-centos-linux.html

Commented the line ( disable chroot as it is inbuilt in 2.2.22 - httpd )

 #LoadModule chroot_module      /usr/lib64/httpd/modules/mod_chroot.so

'''[[After All these efforts too , the Site was not accessible]]'''

== Final Fix and Solution ==

So we have disabled the mod_security2.so and enabled mod_security.so in /etc/httpd/conf.d/00_mod_security.conf file as shown below . 

 # ASL mod_security Template: /var/asl/data/templates/template-00_mod_security.conf
 #
 '''#LoadModule security2_module modules/mod_security2.so'''
 '''LoadModule security2_module modules/mod_security.so'''
 LoadModule unique_id_module modules/mod_unique_id.so
 #
 <IfModule mod_security2.c>
        # Basic configuration goes in here
        Include modsecurity.d/tortix_waf.conf
        # Rule management is handled by ASL
        Include modsecurity.d/00*exclude.conf
        Include modsecurity.d/*asl*.conf
        Include modsecurity.d/99*exclude.conf

 </IfModule>


So Now httpd is loaded with mod_security ( As shown Below ) '''[[and Sites are also working]]'''

 [Thu Feb 21 04:16:35 2013] [notice] core dump file size limit raised to 18446744073709551615 bytes
 [Thu Feb 21 04:16:35 2013] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
 [Thu Feb 21 04:16:35 2013] [notice] ModSecurity for Apache/2.6.6 (http://www.modsecurity.org/) configured.
 [Thu Feb 21 04:16:35 2013] [notice] ModSecurity: APR compiled version="1.2.7"; loaded version="1.2.7"
 [Thu Feb 21 04:16:35 2013] [notice] ModSecurity: PCRE compiled version="6.6"; loaded version="6.6 06-Feb-2006"
 [Thu Feb 21 04:16:35 2013] [notice] ModSecurity: LIBXML compiled version="2.6.26"
 [Thu Feb 21 04:16:35 2013] [notice] Original server signature: Apache
 [Thu Feb 21 04:16:36 2013] [notice] Digest: generating secret for digest authentication ...
 [Thu Feb 21 04:16:36 2013] [notice] Digest: done
 [Thu Feb 21 04:16:37 2013] [notice] Apache/2.2.22 (Unix) DAV/2 Apache mod_perl/2.0.4 Perl/v5.8.8 configured -- resuming normal operations


So as conclusion ,  new module mod_security2.so best works with Apache 2.7 where we are still at apache 2.2.22 so it can suite us the best . 

Thanks 

Biswajit Banerjee