4 ms·

Is there any straightforward guide to getting started with mod_security? I installed it on a box with some ruleset and it seems to basically block everything.

• curiouscats 14y ago
  I liked http://www.thefanclub.co.za/how-to/how-install-apache2-modsecurity-and-modevasive-ubuntu-1204-lts-server http://www.thefanclub.co.za/how-to/how-install-apache2-modse... For some rules to allow Wordpress to work http://wpsecure.net/2012/01/using-mod_security-2-with-wordpress/ http://wpsecure.net/2012/01/using-mod_security-2-with-wordpr...
• druiid 14y ago
  Well, I'm not sure if I'd suggest looking at mod_security in a 'straightforward' manner particularly. Doing so will likely get you frustrated with the interaction you are likely to have with any default rule-set. A good way to look at it is to start by installing it and a good rule-set. A good one could be the gotroot/ASL kit http://updates.atomicorp.com/channels/rules/ http://updates.atomicorp.com/channels/rules/ From that point your best bet would perhaps be one of the freely available 'getting started' guides like https://www.feistyduck.com/books/modsecurity-handbook/gettingStarted.html https://www.feistyduck.com/books/modsecurity-handbook/gettin... Mostly though, my suggestion is to deploy it, have your application break (you should be doing this all in a staging environment), figure out if unbreaking your application can be done with scripting changes, bypassing rules, etc.