Use mod_security

Use mod_security 2015/10/27

	Use mod_security module to configure Web Application Firewall (WAF).
[1]	Install mod_security.

[root@www ~]#  yum -y install mod_security

[2]	After installing, config file is placed in the directory below and the setting is enabled. Some settings are already set in it and also you can add your own rules.

[root@www ~]#  cat /etc/httpd/conf.d/mod_security.conf  <IfModule mod_security2.c> # ModSecurity Core Rules Set configuration IncludeOptional modsecurity.d/*.conf IncludeOptional modsecurity.d/activated_rules/*.conf # Default recommended configuration SecRuleEngine On SecRequestBodyAccess On SecRule REQUEST_HEADERS:Content-Type "text/xml" \ "id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML" ..... ..... # iy you'd not like to block requests if matchs rules,  # specify change to the parameter "SecRuleEngine DetectionOnly"

[3]	It's possible to write a rule like follows.     ⇒ SecRule VARIABLES OPERATOR [ACTIONS] Each parameter has many kind of values, refer to official documents below. https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual
[4]	For Exmaple, set some rules and verify it works normally.

[root@www ~]#  vi/etc/httpd/modsecurity.d/activated_rules/rules-01.conf # default action when matching rules SecDefaultAction "phase:2,deny,log,status:406" # "etc/passwd" is included in request URI SecRule REQUEST_URI "etc/passwd" "id:'500001'" # "../" is included in request URI SecRule REQUEST_URI "\.\./" "id:'500002'" # "<SCRIPT" is included in arguments SecRule ARGS "<[Ss][Cc][Rr][Ii][Pp][Tt]" "id:'500003'" # "SELECT FROM" is included in arguments SecRule ARGS "[Ss][Ee][Ll][Ee][Cc][Tt][[:space:]]+[Ff][Rr][Oo][Mm]" "id:'500004'" [root@www ~]#  systemctl restart httpd

[5]	Access to the URI which includes words you set and verify it works normally.

[6]	The logs for mod_security is placed in the directory like follows.

[root@www ~]#  cat /var/log/httpd/modsec_audit.log  --75d36531-A-- [28/Oct/2015:13:52:52 +0900] VjBUpAKZ9yAFgyhKj8zyyAAAAAE 10.0.0.108 53545 10.0.0.31 80 --75d36531-B-- GET /?../../etc/passwd HTTP/1.1 Host: www.server.world User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive --75d36531-F-- HTTP/1.1 406 Not Acceptable Content-Length: 251 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 --75d36531-E-- --75d36531-H-- Message: Access denied with code 406 (phase 2). Pattern match "etc/passwd" at REQUEST_URI. [file "/etc/httpd/modsecurity.d/activated_rules/rules-01.conf"] [line "3"] [id "500001"] Action: Intercepted (phase 2) Stopwatch: 1446007972909468 1333 (- - -) Stopwatch2: 1446007972909468 1333; combined=418, p1=395, p2=17, p3=0, p4=0, p5=6, sr=116, sw=0, l=0, gc=0 Response-Body-Transformed: Dechunked Producer: ModSecurity for Apache/2.7.3 (http://www.modsecurity.org/); OWASP_CRS/2.2.6. Server: Apache/2.4.6 (CentOS) Engine-Mode: "ENABLED" --75d36531-Z--

[7]	General rules are provided from official repository and it's easy to apply them like follows. But maybe you need to customize them for your own web sites not to block necessary requests.

[root@www ~]#  yum -y install mod_security_crs # rules are placed like follows # they are linked into the directory /etc/httpd/modsecurity.d/activated_rules [root@www ~]#  ll /usr/lib/modsecurity.d/base_rules  total 332 -rw-r--r-- 1 root root 1980 Jun 10 2014 modsecurity_35_bad_robots.data -rw-r--r-- 1 root root 386 Jun 10 2014 modsecurity_35_scanners.data -rw-r--r-- 1 root root 3928 Jun 10 2014 modsecurity_40_generic_attacks.data -rw-r--r-- 1 root root 2610 Jun 10 2014 modsecurity_41_sql_injection_attacks.data -rw-r--r-- 1 root root 2224 Jun 10 2014 modsecurity_50_outbound.data -rw-r--r-- 1 root root 56714 Jun 10 2014 modsecurity_50_outbound_malware.data -rw-r--r-- 1 root root 22861 Jun 10 2014 modsecurity_crs_20_protocol_violations.conf -rw-r--r-- 1 root root 6915 Jun 10 2014 modsecurity_crs_21_protocol_anomalies.conf -rw-r--r-- 1 root root 3792 Jun 10 2014 modsecurity_crs_23_request_limits.conf -rw-r--r-- 1 root root 6933 Jun 10 2014 modsecurity_crs_30_http_policy.conf -rw-r--r-- 1 root root 5394 Jun 10 2014 modsecurity_crs_35_bad_robots.conf -rw-r--r-- 1 root root 19157 Jun 10 2014 modsecurity_crs_40_generic_attacks.conf -rw-r--r-- 1 root root 43961 Jun 10 2014 modsecurity_crs_41_sql_injection_attacks.conf -rw-r--r-- 1 root root 87470 Jun 10 2014 modsecurity_crs_41_xss_attacks.conf -rw-r--r-- 1 root root 1795 Jun 10 2014 modsecurity_crs_42_tight_security.conf -rw-r--r-- 1 root root 3660 Jun 10 2014 modsecurity_crs_45_trojans.conf -rw-r--r-- 1 root root 2253 Jun 10 2014 modsecurity_crs_47_common_exceptions.conf -rw-r--r-- 1 root root 2787 Jun 10 2014 modsecurity_crs_48_local_exceptions.conf.example -rw-r--r-- 1 root root 1835 Jun 10 2014 modsecurity_crs_49_inbound_blocking.conf -rw-r--r-- 1 root root 22314 Jun 10 2014 modsecurity_crs_50_outbound.conf -rw-r--r-- 1 root root 1448 Jun 10 2014 modsecurity_crs_59_outbound_blocking.conf -rw-r--r-- 1 root root 2674 Jun 10 2014 modsecurity_crs_60_correlation.conf

Configure mod_evasive

Configure mod_evasive 2015/08/03

	Enable mod_evasive module to defend from DoS attacks and so on.
[1]	Install and configure mod_evasive.

# install from EPEL [root@www ~]#  yum --enablerepo=epel -y install mod_evasive [root@www ~]#  vi/etc/httpd/conf.d/mod_evasive.conf # line 18: threshhold for the number of requests for the same page per page interval DOSPageCount    5 # line 24: threshhold for the total number of requests for any object by the same client on the same listener per site interval DOSSiteCount    50 # line 28: The interval for the page count threshhold DOSPageInterval    1 # line 32: The interval for the site count threshhold DOSSiteInterval    1 # line 41: amount of time (in seconds) that a client will be blocked for if they are added to the blocking list DOSBlockingPeriod    300 # line 48: notification address if IP address becomes blacklisted DOSEmailNotify    root@localhost # line 66: specify log directory DOSLogDir   " /var/log/mod_evasive " [root@www ~]#  mkdir /var/log/mod_evasive  [root@www ~]#  chown apache. /var/log/mod_evasive  [root@www ~]#  systemctl restart httpd

[2]	Test with a test tool which is included in RPM package.

[root@www ~]#  perl /usr/share/doc/mod_evasive-*/test.pl  HTTP/1.1 200 OK HTTP/1.1 200 OK HTTP/1.1 200 OK HTTP/1.1 200 OK HTTP/1.1 200 OK ..... ..... HTTP/1.1 403 Forbidden HTTP/1.1 403 Forbidden HTTP/1.1 403 Forbidden ..... ..... HTTP/1.1 403 Forbidden # turn to "403 Forbidden" if blocked # logs are saved [root@www ~]#  ll /var/log/mod_evasive  total 4 -rw-r--r-- 1 apache apache 5 Aug 5 15:42 dos-127.0.0.1 # if set notification, it is sent like follows [root@www ~]#  mail  Heirloom Mail version 12.5 7/5/10. Type ? for help. "/var/spool/mail/root": 1 message 1 new >N 1 Apache Wed Aug 3 19:42 20/673 & 1 Message 1: From apache@www.server.world Wed Aug 3 19:42:55 2015 Return-Path: <apache@www.server.world> X-Original-To: root@localhost Delivered-To: root@localhost.server.world Date: Wed, 05 Aug 2015 15:42:54 +0900 To: root@localhost.server.world User-Agent: Heirloom mailx 12.5 7/5/10 Content-Type: text/plain; charset=us-ascii From: apache@www.server.world (Apache) Status: R To: root@localhost Subject: HTTP BLACKLIST 127.0.0.1 mod_evasive HTTP Blacklisted 127.0.0.1

Use mod_limitipconn

Use mod_limitipconn 2015/10/27

	Use mod_limitipconn to limit concurrent connection per IP address.
[1]	Install mod_limitipconn.

# install from EPEL [root@www ~]#  yum --enablerepo=epel -y install mod_limitipconn

[2]	Configure mod_limitipconn as an example.

[root@www ~]#  vi/etc/httpd/conf.d/limitipconn.conf # set no limitation for default MaxConnPerIP 0 # set for /limit <Location /limit> # limit concurrent connection for 3 MaxConnPerIP 3 # not apply above if MIME type is "text/*" NoIPLimit text/* </Location> # set for /limit2 <Location /limit2> # limit concurrent connection for 2 MaxConnPerIP 2 # apply above if MIME type is "application/x-tar" OnlyIPLimit application/x-tar </Location> [root@www ~]#  systemctl restart httpd

[3]	Verify it work normally with a command "ab" which is included in httpd-tools package like follows.

[root@www html]#  ab -n 10 -c 10 http://localhost/limit/index.html  This is ApacheBench, Version 2.3 <$Revision: 1430300 $> Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/ Licensed to The Apache Software Foundation, http://www.apache.org/ Benchmarking localhost (be patient).....done Server Software: Apache/2.4.6 Server Hostname: localhost Server Port: 80 Document Path: /limit/index.html Document Length: 130 bytes Concurrency Level: 10 Time taken for tests: 0.004 seconds Complete requests: 10 Failed requests: 0 Write errors: 0 Total transferred: 3910 bytes HTML transferred: 1300 bytes Requests per second: 2223.21 [#/sec] (mean) Time per request: 4.498 [ms] (mean) Time per request: 0.450 [ms] (mean, across all concurrent requests) Transfer rate: 848.90 [Kbytes/sec] received ..... ..... [root@www html]#  ab -n 10 -c 10 http://localhost/limit/test.gif  This is ApacheBench, Version 2.3 <$Revision: 1430300 $> Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/ Licensed to The Apache Software Foundation, http://www.apache.org/ Benchmarking localhost (be patient).....done Server Software: Apache/2.4.6 Server Hostname: localhost Server Port: 80 Document Path: /limit/test.gif Document Length: 228 bytes Concurrency Level: 10 Time taken for tests: 0.005 seconds Complete requests: 10 Failed requests: 7 (Connect: 0, Receive: 0, Length: 7, Exceptions: 0) Write errors: 0 Non-2xx responses: 7 Total transferred: 4838 bytes HTML transferred: 2777 bytes Requests per second: 2182.45 [#/sec] (mean) Time per request: 4.582 [ms] (mean) Time per request: 0.458 [ms] (mean, across all concurrent requests) Transfer rate: 1031.12 [Kbytes/sec] received ..... ..... [root@www ~]#  ab -n 10 -c 10 http://localhost/limit2/test.tar  This is ApacheBench, Version 2.3 <$Revision: 1430300 $> Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/ Licensed to The Apache Software Foundation, http://www.apache.org/ Benchmarking localhost (be patient).....done Server Software: Apache/2.4.6 Server Hostname: localhost Server Port: 80 Document Path: /limit2/test.tar Document Length: 10240 bytes Concurrency Level: 10 Time taken for tests: 0.006 seconds Complete requests: 10 Failed requests: 8 (Connect: 0, Receive: 0, Length: 8, Exceptions: 0) Write errors: 0 Non-2xx responses: 8 Total transferred: 24900 bytes HTML transferred: 22872 bytes Requests per second: 1785.40 [#/sec] (mean) Time per request: 5.601 [ms] (mean) Time per request: 0.560 [ms] (mean, across all concurrent requests) Transfer rate: 4341.44 [Kbytes/sec] received ..... .....

Configure mod_ratelimit

Configure mod_ratelimit 2015/08/03

	Enable mod_ratelimit module to limit bandwidth of clients.
[1]	mod_ratelimit is included in httpd package, so it's possible to configure quickly.

[root@www ~]#  vi /etc/httpd/conf.modules.d/00-base.conf # line 72: uncomment LoadModule ratelimit_module modules/mod_ratelimit.so [root@www ~]#  vi/etc/httpd/conf.d/ratelimit.conf # create new # for example, limit bandwidth as 500 KB/sec under the /download location <IfModule mod_ratelimit.c>     <Location /download>         SetOutputFilter RATE_LIMIT         SetEnv rate-limit 500     </Location> </IfModule> [root@www ~]#  systemctl restart httpd

[2]	Access to the location to make sure the settings is effective. The upper one is downloading from the limited location, the lower is downloading from a unlimited location.

Use mod_proxy_wstunnel

Use mod_proxy_wstunnel 2015/08/16

	Enable mod_proxy_wstunnel module to set WebSocket Proxy.
[1]	For example, configure httpd to set proxy on /chat for an application which listens on localhost:1337. The sample application is from here (section [3]).

[root@www ~]#  vi /etc/httpd/conf.modules.d/00-proxy.conf # add to the end LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so [root@www ~]#  vi /etc/httpd/conf.d/wstunnel.conf # create new ProxyRequests Off <Proxy *> Require all granted </Proxy> ProxyPass /socket.io/ http://127.0.0.1:1337/socket.io/ ProxyPassReverse /socket.io/ http://127.0.0.1:1337/socket.io/ ProxyPass /chat http://127.0.0.1:1337/ ProxyPassReverse /chat http://127.0.0.1:1337/ [root@www ~]#  systemctl restart httpd

Access to the sample App to make sure it works normally on proxy environment.

Configure mod_proxy#2

Configure mod_proxy#2 2015/08/03

	Enable mod_proxy module to configure reverse proxy settings. This example is based on the environment below. (1) www.server.world     [10.0.0.31]     - Web Server#1 (2) node01.server.world     [10.0.0.51]     - Web Server#2 This example set servers that requests to (1)Web server forward to / on (2)webserver.
[1]	mod_proxy is included in httpd package and it is enabled by default, so it's possible to configure quickly.

# module is enabled by default [root@www ~]#  grep "mod_proxy" /etc/httpd/conf.modules.d/00-proxy.conf  LoadModule proxy_module modules/mod_proxy.so LoadModule proxy_ajp_module modules/mod_proxy_ajp.so ..... LoadModule proxy_http_module modules/mod_proxy_http.so LoadModule proxy_scgi_module modules/mod_proxy_scgi.so [root@www ~]#  vi /etc/httpd/conf.d/r_proxy.conf # create new <IfModule mod_proxy.c>     ProxyRequests Off     <Proxy *>         Require all granted     </Proxy>      # backend server and forwarded path     ProxyPass / http://node01.server.world/     ProxyPassReverse / http://node01.server.world/ </IfModule> [root@www ~]#  systemctl restart httpd

Access to frontend server to make sure backend server responses like follows.

[2]

It's possible to configure load balancing settings. (1) www.server.world     [10.0.0.31]     - Web Server#1 (2) node01.server.world     [10.0.0.51]     - Web Server#2 (3) node02.server.world     [10.0.0.52]     - Web Server#3 This example shows to configure servers that http requests to (1)Webserver are forwarded to (2)Webserver and (3)Webserver.

[root@www ~]#  vi/etc/httpd/conf.d/r_proxy.conf # create new <IfModule mod_proxy.c>     ProxyRequests Off     <Proxy *>         Require all granted     </Proxy>      # specify the way of load balancing with "lbmethod". it's also possible to set "bytraffic".     ProxyPass / balancer://cluster lbmethod=byrequests     <proxy balancer://cluster>         BalancerMember http://node01.server.world/ loadfactor=1         BalancerMember http://node02.server.world/ loadfactor=1     </proxy> </IfModule> [root@www ~]#  systemctl restart httpd

Access to frontend server to make sure backend servers responses like follows.

Configure mod_proxy#1

Configure mod_proxy#1 2015/08/03

	Enable mod_proxy module to configure forward proxy settings.
[1]	mod_proxy is included in httpd package and it is enabled by default, so it's possible to configure quickly.

# module is enabled by default [root@www ~]#  grep "mod_proxy" /etc/httpd/conf.modules.d/00-proxy.conf  LoadModule proxy_module modules/mod_proxy.so LoadModule proxy_ajp_module modules/mod_proxy_ajp.so ..... LoadModule proxy_http_module modules/mod_proxy_http.so LoadModule proxy_scgi_module modules/mod_proxy_scgi.so [root@www ~]#  vi /etc/httpd/conf.d/f_proxy.conf # create new <IfModule mod_proxy.c>      # forward proxy function ON     ProxyRequests On     <Proxy *>          # access permission         Require ip 127.0.0.1 10.0.0.0/24     </Proxy> </IfModule> [root@www ~]#  vi /etc/httpd/conf/httpd.conf # line 42: change listening port Listen  8080 [root@www ~]#  systemctl restart httpd

[2]	Configure Proxy client setiings on a Clientand make sure it's possible to access to any websites normally.

Install MediaWiki

Install MediaWiki 2015/10/25

	Install Wiki System MediaWiki.
[1]	Install PHP, refer to here.
[2]	Install MariaDB server, refer to here.
[3]	Create a database for MediaWiki.

[root@www ~]#  mysql -u root -p  Enter password: Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 10 Server version: 5.5.44-MariaDB MariaDB Server Copyright (c) 2000, 2015, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. # create "mediawiki" databse (set any password for "password" section) MariaDB [(none)]>  create database mediawiki;  Query OK, 1 row affected (0.00 sec) MariaDB [(none)]>  grant all privileges on mediawiki.* to mediawiki@'localhost' identified by 'password';  Query OK, 0 rows affected (0.00 sec) MariaDB [(none)]>  flush privileges;  Query OK, 0 rows affected (0.00 sec) MariaDB [(none)]>  exit  Bye

[4]	Install MediaWiki. ( Make sure and Download the latest one ⇒ https://www.mediawiki.org/wiki/Download/en )

[root@www ~]#  yum -y install php-mysql [root@www ~]#  curl -O http://releases.wikimedia.org/mediawiki/1.25/mediawiki-1.25.3.tar.gz  [root@www ~]#  tar zxvf mediawiki-1.25.3.tar.gz  [root@www ~]#  mv mediawiki-1.25.3 /var/www/html/mediawiki  [root@www ~]#  chown -R apache. /var/www/html/mediawiki  [root@www ~]#  systemctl restart httpd

[5]	Access to "http://(server's hostname or IP address)/mediawiki/mw-config/" and configure final settings.

[6]	Scroll down to the bottom of the page and Click "Continue".

[7]	Input Database infomation for MediaWiki to connect.

[8]	It's OK with default.

[9]	Set Wiki name and admin username.

[10]	Click "Continue".

[11]	Click "Continue".

[12]	Setting up completed. Download "LocalSettings.php" and place it under "mediawiki" directory on your server.

[13]	This is the index page of MediaWiki. Try to use it.

Install WordPress

Install WordPress 2015/10/25

	Install the Blog system WordPress.
[1]	Install PHP, refer to here.
[2]	Install MariaDB server, refer to here.
[3]	Create a database for WordPress.

[root@www ~]#  mysql -u root -p  Enter password: Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 12 Server version: 5.5.44-MariaDB MariaDB Server Copyright (c) 2000, 2015, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. # create "wordpress" databse (set any password for "password" section) MariaDB [(none)]>  create database wordpress;  Query OK, 1 row affected (0.00 sec) MariaDB [(none)]>  grant all privileges on wordpress.* to wordpress@'localhost' identified by 'password';  Query OK, 0 rows affected (0.00 sec) MariaDB [(none)]>  flush privileges;  Query OK, 0 rows affected (0.00 sec) MariaDB [(none)]>  exit  Bye

[4]	Install WordPress.

# install from EPEL [root@www ~]#  yum --enablerepo=epel -y install wordpress [root@www ~]#  vi /etc/wordpress/wp-config.php # line 23: specify Database define('DB_NAME', ' wordpress '); # line 26: specify DB user define('DB_USER', ' wordpress '); # line 29: specify DB password define('DB_PASSWORD', ' password '); [root@www ~]#  vi/etc/httpd/conf.d/wordpress.conf # line 8: add Require all granted [root@www ~]#  systemctl restart httpd

[5]	Access to "http://(server's hostname or IP address)/wordpress/" and configure final settings.

[6]	After configuring, Click "login" button to login.

[7]	Login with a user you added.

[8]	This is the admin panel to manage your blog. Refer to the official site to use admin panel.

[9]	The index page is "http://(hostname or IP address)/wordpress/", access to it and make sure it is shown normally.