Mod Security Issue on BJP Site

Mod Security Issue on BJP Site - Issue Finally Closed

While activating the 00_mod_security.conf it give the following Error

httpd: Syntax error on line 212 of /httpdjail/etc/httpd/conf/httpd.conf: Syntax error on line 3 of   /httpdjail/etc/httpd/conf.d/00_mod_security.conf: Cannot load /etc/httpd/modules/mod_security2.so into server:  /etc/httpd/modules/mod_security2.so: undefined symbol: ap_get_server_banner

Temporary solution

Solution Came from --

http://www.centos.org/modules/newbb/viewtopic.php?topic_id=13208

Done

yum install mod_perl-devel

mod_security Activated at line number 212 on file /httpdjail/etc/httpd/conf/httpd.conf

Include /httpdjail/etc/httpd/conf.d/00_mod_security.conf

Output Shows that Mod_Security is Running a

[Wed Feb 20 13:35:50 2013] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Wed Feb 20 13:35:51 2013] [notice] ModSecurity for Apache/2.7.1 (http://www.modsecurity.org/) configured.
[Wed Feb 20 13:35:51 2013] [notice] ModSecurity: APR compiled version="1.4.6"; loaded version="1.2.7"
[Wed Feb 20 13:35:51 2013] [warn] ModSecurity: Loaded APR do not match with compiled!
[Wed Feb 20 13:35:51 2013] [notice] ModSecurity: PCRE compiled version="6.6 "; loaded version="6.6 06-Feb-2006"
[Wed Feb 20 13:35:51 2013] [notice] ModSecurity: LUA compiled version="Lua 5.1"
[Wed Feb 20 13:35:51 2013] [notice] ModSecurity: LIBXML compiled version="2.7.6"
[Wed Feb 20 13:35:51 2013] [notice] Original server signature: Apache
[Wed Feb 20 13:35:51 2013] [notice] Digest: generating secret for digest authentication ...
[Wed Feb 20 13:35:51 2013] [notice] Digest: done
[Wed Feb 20 13:35:51 2013] [notice] mod_chroot: changed root to /httpdjail.
[Wed Feb 20 13:35:51 2013] [warn] pid file /var/run/httpd.pid overwritten -- Unclean shutdown of previous Apache run?
[Wed Feb 20 13:35:52 2013] [notice] Apache configured -- resuming normal operations

Version of Httpd on BJP Server

httpd -v

Server version: Apache/2.2.3 Server built: Jan 10 2013 08:19:28

Still the Issue

1. When activated the site is not accessible at all.
2. No logs are generated or traceable

Updrade of httpd

So Decided to Update the httpd version to fix the issue of mod-security , as suggested t

We have used the following Repo to update

http://www.jasonlitka.com/yum-repository/

Process of Update httpd to 2.2.22

rpm --import http://www.jasonlitka.com/media/RPM-GPG-KEY-jlitka
yum utterramblings http://www.jasonlitka.com/media/EL4/$ARCH

vi /etc/yum.repos.d/utterramblings.repo
yum update
yum remove httpd-devel.i386
yum --enablerepo=utterramblings install httpd

Updated the httpd version

httpd -v
Server version: Apache/2.2.22 (Unix)
Server built:   Feb 23 2012 12:28:12

While restart of the Server we faced /httpdjail not found .

Issue - error_log , Apache failed

[Wed Feb 20 16:43:54 2013] [notice] core dump file size limit raised to 18446744073709551615 bytes
[Wed Feb 20 16:43:54 2013] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Wed Feb 20 16:43:54 2013] [notice] ModSecurity for Apache/2.7.1 (http://www.modsecurity.org/) configured.
[Wed Feb 20 16:43:54 2013] [notice] ModSecurity: APR compiled version="1.4.6"; loaded version="1.2.7"
[Wed Feb 20 16:43:54 2013] [warn] ModSecurity: Loaded APR do not match with compiled!
[Wed Feb 20 16:43:54 2013] [notice] ModSecurity: PCRE compiled version="6.6 "; loaded version="6.6 06-Feb-2006"
[Wed Feb 20 16:43:54 2013] [notice] ModSecurity: LUA compiled version="Lua 5.1"
[Wed Feb 20 16:43:54 2013] [notice] ModSecurity: LIBXML compiled version="2.7.6"
[Wed Feb 20 16:43:54 2013] [notice] Original server signature: Apache
[Wed Feb 20 16:43:55 2013] [notice] Digest: generating secret for digest authentication ...
[Wed Feb 20 16:43:55 2013] [notice] Digest: done
[Wed Feb 20 16:43:56 2013] [notice] mod_chroot: changed root to /httpdjail.
[Wed Feb 20 16:43:56 2013] [warn] pid file /var/run/httpd.pid overwritten -- Unclean shutdown of previous Apache run?
[Wed Feb 20 16:43:56 2013] [alert] (2)No such file or directory: Can't chdir to /httpdjail
PHP:  Error parsing /etc/php.ini on line 1230
[Wed Feb 20 16:43:56 2013] [alert] (2)No such file or directory: Can't chdir to /httpdjail
PHP:  Error parsing /etc/php.ini on line 1230
[Wed Feb 20 16:43:56 2013] [alert] (2)No such file or directory: Can't chdir to /httpdjail
PHP:  Error parsing /etc/php.ini on line 1230
[Wed Feb 20 16:43:56 2013] [notice] Apache/2.2.22 (Unix) DAV/2 mod_chroot/0.5 Apache mod_perl/2.0.4 Perl/v5.8.8 configured -- resuming normal  operations
[Wed Feb 20 16:43:56 2013] [alert] Child 32602 returned a Fatal error... Apache is exiting!

To fix /httpdjail issue we have followed , which said that mod_chroot is in-built function of httpd and no mod_chroot is required seperately

http://www.cyberciti.biz/tips/chroot-apache-under-rhel-fedora-centos-linux.html

Commented the line ( disable chroot as it is inbuilt in 2.2.22 - httpd )

#LoadModule chroot_module      /usr/lib64/httpd/modules/mod_chroot.so

After All these efforts too , the Site was not accessible

Final Fix and Solution

So we have disabled the mod_security2.so and enabled mod_security.so in /etc/httpd/conf.d/00_mod_security.conf file as shown below .

# ASL mod_security Template: /var/asl/data/templates/template-00_mod_security.conf
#
#LoadModule security2_module modules/mod_security2.so
LoadModule security2_module modules/mod_security.so
LoadModule unique_id_module modules/mod_unique_id.so
#
<IfModule mod_security2.c>
       # Basic configuration goes in here
       Include modsecurity.d/tortix_waf.conf
       # Rule management is handled by ASL
       Include modsecurity.d/00*exclude.conf
       Include modsecurity.d/*asl*.conf
       Include modsecurity.d/99*exclude.conf

</IfModule>

So Now httpd is loaded with mod_security ( As shown Below ) and Sites are also working

[Thu Feb 21 04:16:35 2013] [notice] core dump file size limit raised to 18446744073709551615 bytes
[Thu Feb 21 04:16:35 2013] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Thu Feb 21 04:16:35 2013] [notice] ModSecurity for Apache/2.6.6 (http://www.modsecurity.org/) configured.
[Thu Feb 21 04:16:35 2013] [notice] ModSecurity: APR compiled version="1.2.7"; loaded version="1.2.7"
[Thu Feb 21 04:16:35 2013] [notice] ModSecurity: PCRE compiled version="6.6"; loaded version="6.6 06-Feb-2006"
[Thu Feb 21 04:16:35 2013] [notice] ModSecurity: LIBXML compiled version="2.6.26"
[Thu Feb 21 04:16:35 2013] [notice] Original server signature: Apache
[Thu Feb 21 04:16:36 2013] [notice] Digest: generating secret for digest authentication ...
[Thu Feb 21 04:16:36 2013] [notice] Digest: done
[Thu Feb 21 04:16:37 2013] [notice] Apache/2.2.22 (Unix) DAV/2 Apache mod_perl/2.0.4 Perl/v5.8.8 configured -- resuming normal operations

So as conclusion , new module mod_security2.so best works with Apache 2.7 where we are still at apache 2.2.22 so it can suite us the best .

Thanks

Biswajit Banerjee