Enable mod_rewrite in Apache2

http://www.grosseosterhues.com/2011/07/enabling-mod-security-protection-in-apache2-on-ubuntu/
http://www.linuxlog.org/?p=135

a2enmod rewrite

/etc/apache2/sites-available/000-default

Options Indexes FollowSymLinks MultiViews
AllowOverride all
Order allow,deny
allow from all

/etc/init.d/apache2 restart

.htaccess

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

Enable mod_evasive and mod_security in Apache2

aptitude install libapache-mod-security libapache2-mod-evasive

a2enmod mod-security mod-evasive

ln -s /usr/sbin/sendmail /bin/mail
mkdir /var/log/mod_evasive
chown www-data:www-data /var/log/mod_evasive/

/etc/apache2/conf.d/modevasive

<ifmodule mod_evasive20.c>
DOSHashTableSize 3097
DOSPageCount 2
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 10
DOSLogDir /var/log/mod_evasive
DOSEmailNotify jan.faix@gmail.com
DOSWhitelist 127.0.0.1
</ifmodule>

Check if /etc/apache2/apache2.conf contain:

# Include generic snippets of statements
Include /etc/apache2/conf.d/[^.#]*

mkdir /etc/apache2/mod_security_rules
chown -R root:root /etc/apache2/mod_security_rules
sed '/^$/d; /^#/d;' /usr/share/doc/mod-security-common/examples/rules/*conf >> /etc/apache2/mod_security_rules/modsecurity_crs_10_config_global.conf
cp /usr/share/doc/mod-security-common/examples/rules/base_rules/* /etc/apache2/mod_security_rules/
touch /var/log/apache2/modsec_audit.log /var/log/apache2/modsec_debug.log
chown www-data:www-data /var/log/apache2/modsec_audit.log /var/log/apache2/modsec_debug.log

/etc/apache2/mod_security_rules/modsecurity_crs_10_config_global.conf

SecAuditLog /var/log/apache2/modsec_audit.log
SecDebugLog /var/log/apache2/modsec_debug.log

/etc/apache2/conf.d/mod_security

<IfModule security2_module>
Include /etc/apache2/mod_security_rules/*.conf
</IfModule>

cd /etc/apache2/mod_security_rules/
mv modsecurity_crs_41_phpids_filters.conf modsecurity_crs_41_phpids_filters.conf.disabled

/etc/init.d/apache2 restart

Test mod_security

/var/www/test.php

<?php
$secret_file = $_GET['secret_file'];
include ( $secret_file);
?>

http://yourserver.tld/test.php?secret_file=/etc/passwd

Correct response is “403 Forbidden” error message.

rm -f /var/www/test.php

Test mod_evasive

Run from another box than your server, change domain to your web server.
Correct response is HTTP/1.1 404 Not Found.

~/test.pl

#!/usr/bin/perl
# test.pl: small script to test mod_dosevasive’s effectiveness
use IO::Socket;
use strict;
for(0..100) {
my($response);
my($SOCKET) = new IO::Socket::INET( Proto => "tcp",PeerAddr=> "faix.homelinux.net:80");
if (! defined $SOCKET) { die $!; }
print $SOCKET "GET /?$_ HTTP/1.0\n\n";
$response = <$SOCKET>;
print $response;
close($SOCKET);
}

rm -r ~/test.pl