Apache Module — ModSecurity® | cPanel & WHM Documentation

Apache Module — ModSecurity®

Last modified: August 23, 2024

The mod_security2 Apache module provides the ModSecurity web application firewall for Apache.

Warning:

If your ruleset contains rule ID conflicts or syntactical errors, ModSecurity will fail and Apache will not start. For more information about how EasyApache handles issues with your ModSecurity rules, read the Compatibility section.

Use the mod_security2 Apache module to install the ModSecurity web application firewall. You can configure this module to protect your Apache web applications from various attacks. The ModSecurity web application firewall also provides additional tools to monitor your Apache web server.

Requirements

This module possesses no additional requirements.

Compatibility

Major versions of the mod_security2 Apache module use different syntaxes for ModSecurity rules.

Warning:

No conversion utility exists to rewrite rules between versions.
Minor versions of ModSecurity may also include syntactical changes that are incompatible with older rulesets.

How to install or uninstall the module

You can install or uninstall the mod_security2 Apache module in WHM’s EasyApache 4 interface (WHM » Home » Software » EasyApache 4).

Important:

After you install the mod_security2 Apache module, you must configure the application in WHM’s ModSecurity® Configuration interface (WHM » Home » Security Center » ModSecurity® Configuration).

Configuration

EasyApache 4 enables the mod_security2 Apache module for all virtual hosts by default, except for the default virtual host. You can configure your ModSecurity installation in WHM’s ModSecurity® Configuration interface (WHM » Home » Security Center » ModSecurity® Configuration).

Configuration details

When the mod_ruid2 and mod_mpm_itk Apache modules are not installed, the mod_security2 Apache module stores its log file in the /etc/apache2/logs/modsec_audit.log file.

Important:

ModSecurity adds information to the log files as the user when the mod_ruid2 and mod_mpm_itk Apache modules are installed. This action causes the system to use more disk space. The system logs this information concurrently to the following directory, where username represents the user’s username:
```
 /etc/apache2/logs/modsec_audit/username 
```
EasyApache 4 installs the mod_security2 Apache module with several include files.

When you install the mod_security2 package, the installation places the following files into your /etc/apache2/conf.d/ directory:

1
2
3


/etc/apache2/conf.d
modsec2.user.conf
modsec2.cpanel.conf

When the system loads, it uses the conf.d/*.conf glob file to pull the files into your configuration.

The /etc/apache2/conf.d/modsec2.conf file contains the basic directives for the mod_security2 Apache module, and the following Include directives:

1
2


Include "/etc/apache2/conf.d/modsec/modsec2.user.conf"
Include "/etc/apache2/conf.d/modsec/modsec2.cpanel.conf"

The /etc/apache2/conf.d/modsec/modsec2.user.conf file contains the ModSecurity firewall application rules that you define.

Warning:

We strongly recommend that you do not use Include directives in the modsec2.user.conf file.

ModSecurity utilities

ModSecurity SDBM

cPanel & WHM provides the ModSecurity SDBM utility to purge expired entries from the /var/cpanel/secdatadir/users/username/ip.pag cache file, where username represents the cPanel username. For more information, read our ModSecurity SDBM Utility documentation.

ModSecurity Audit Log Collector (mlogc)

cPanel & WHM includes the ModSecurity Audit Log Collector (mlogc) with the ModSecurity installation. Mlogc implements remote logging of your ModSecurity audit logs. For more information, read the mlogc documentation.

You can also install or uninstall the mlogc module in WHM’s EasyApache 4 interface (WHM » Home » Software » EasyApache 4).