Search our site for answers
Help Docs Security Overview Firewall Management ConfigServer Security & Firewall (CSF) Installing Configserver’s ModSecurity Control Plugin on Your Server

Installing Configserver’s ModSecurity Control Plugin on Your Server

ModSecurity is a Web Application Firewall (WAF) enhancing external security by detecting and preventing web application attacks in real-time. Deploy it seamlessly with minimal infrastructure changes on Apache, IIS7, or Nginx servers. Easily customize its features, but remember to add the plugin to WHM if using cPanel.
Control Panel WHM
2 min read

ModSecurity is a web application firewall (WAF). It is deployed to established increased external security to detect and prevent attacks before they reach your web applications. ModSecurity allows for http traffic monitoring and real-time analysis with very few changes to the existing infrastructure.

ModSecurity is deployed as part of your existing server infrastructure on Apache, IIS7 or Nginx servers. You can use only the features you need and deploy ModSec in increments.

Notice Regarding ModSec Installation:

ModSecurity is installed on your cPanel, but the plugin is not automatically added to WHM. Instructions to install ModSecurity are included in this tutorial, but will likely not be needed.

Install ModSecurity

  1. In order to enable ModSecurity, Apache2 will need to be compiled with UniqueID and mod_security needs to be checked as well. If both are compiled correctly, you will see the following lines in the httpd.conf:
    LoadModule security2_module modules/mod_security2.so
    include "/usr/local/apache/conf/modes2.conf"











    Note:


    If you can’t find the LoadModule statement in the httpd.conf file, check the modsec2.conf file.

  2. Next, install ModSec rules:
    yum install lp-modsec2-rules.noarch

  3. Then install the rules on CentOS 6
    yum install lp-modsec2-rules.noarch

Install Plugin for WHM

Installing the ModSecurity Plugin for WHM is done through CMC, Configserver’s ModSec Control plugin. It is a free plugin and makes whitelisting problem ModSec rules easy.

Note:

The plugin requires that files be located in /usr/local/apache2/conf/modsec* or are named beginning with the word modsec and each rule has an ID number to identify it.
  1. Download and install CMC from Github. Follow the directions on the Github page to install CMC.
  2. The plugin automatically adds the following lines to /usr/local/apache2/conf/modsec2.user.conf:
    # ConfigServer ModSecurity whitelist file
    Include /usr/local/apache2/conf/modsec2/whitelist.conf

  3. Once you have downloaded and installed the plugin, you can log into WHM to configure the plugin and whitelist rules. For information on how to navigate and use the ModSecurity plugin for WHM, see our article Getting Started with Configserver’s ModSecurity Control Plugin.
Was this article helpful?