Comments on Installing ModSecurity2 On Debian Etch

Note that you don't need to download the ModSecurity2 source package to get the minimal config. After you install the module, the same file will be at /usr/share/doc/mod-security2-common/examples/modsecurity.conf-minimal

Enter one of the following in your sourcelist: 

Packages for Sid:
deb http://etc.inittab.org/~agi/debian/libapache-mod-security2 ./

Packages for Etch are in etch/
deb http://etc.inittab.org/~agi/debian/libapache-mod-security2/etch ./

Packages for Sarge (apache2.0) are in sarge/
deb http://etc.inittab.org/~agi/debian/libapache-mod-security2/sarge ./

Source:
http://etc.inittab.org/~agi/debian/libapache-mod-security2/README 

 

For Debian 5.0 (Lenny), in /etc/apt/sources.list;  this works:

deb http://etc.inittab.org/~agi/debian/libapache-mod-security2/ ./

Then as above,

gpg --keyserver pgpkeys.mit.edu --recv-keys C514AF8E4BA401C3
gpg --export -a C514AF8E4BA401C3 | apt-key add -
apt-get update

And finally:

apt-get install libapache2-mod-security2

 Also note that in other guides there are rule sets for mod_security that are NOT compatible with this module.

 

Thanks for your information have you installed that on Lenny without any problem?? what did you mean "Also note that in other guides there are rule sets for mod_security that are NOT compatible with this module" ?? thanks in advanced

How to then add rules,

 Please help

I cannot get this working. apt always tells me that libapache-mod-security will be installed instead of libapache2-mod-security. Using lenny with your tip, keys + apt-get update obviously

I had to do this, since I was getting an  NO_PUBKEY error when running apt-get (after adding inittab.org to /etc/apt/sources.list):

Err http://etc.inittab.org etch/ mod-security2-common 2.1.1-0
  404 Not Found
Err http://etc.inittab.org etch/ libapache2-mod-security2 2.1.1-0
  404 Not Found
Failed to fetch http://etc.inittab.org/~agi/debian/libapache-mod-security2/./mod-security2-common_2.1.1-0_all.deb  404 Not Found
Failed to fetch http://etc.inittab.org/~agi/debian/libapache-mod-security2/./libapache2-mod-security2_2.1.1-0_i386.deb  404 Not Found

I was unable to obtain the above. I got around the key problem but apparently it is not on the host now.

I did find a updated version but am getting dependency issues with 

http://etc.inittab.org/~agi/debian/libapache-mod-security2/

dpkg -i mod-security2-common_2.1.2-1_all.deb
Selecting previously deselected package mod-security2-common.
(Reading database ... 113386 files and directories currently installed.)

Almost, but not quite there....thanking you for your research into this, it sure looked like it might work.

Please run

apt-get update

and try again.

I had to modify my sources.list as follows to get libapache2-mod-security2 installed via apt-get otherwise it gave me a 404 for  mod-security2-common and mod-security2-common packages:

deb http://etc.inittab.org/~agi/debian/libapache-mod-security2/etch ./ 

For me MIT server wouldn't work, so i found alternative:

# gpg –keyserver wwwkeys.eu.pgp.net –recv-keys C514AF8E4BA401C3
# gpg –export C514AF8E4BA401C3 | apt-key add -

# apt-get update

 

What can I do? I get this massage:

Failed to fetch http://etc.inittab.org/~agi/debian/libapache-mod-security2/./mod-security-common_2.5.9-1_all.deb  Size mismatch
Failed to fetch http://etc.inittab.org/~agi/debian/libapache-mod-security2/./libapache-mod-security_2.5.9-1_amd64.deb  Size mismatch
E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?
 

For Debian 5.0 (Lenny), in /etc/apt/sources.list; this works: deb http://etc.inittab.org/~agi/debian/libapache-mod-security2/ ./ Then as above, gpg --keyserver pgpkeys.mit.edu --recv-keys C514AF8E4BA401C3 gpg --export -a C514AF8E4BA401C3 | apt-key add - apt-get update And finally: apt-get install libapache2-mod-security2

 

use this one

I have got the same error on Debian Lenny 5 :

Get: 1 http://etc.inittab.org etch/ mod-security-common 2.5.9-1 [840kB]
Get: 2 http://etc.inittab.org etch/ libapache-mod-security 2.5.9-1 [113kB]
Fetched 115kB in 3s (32.3kB/s)                
Failed to fetch http://etc.inittab.org/~agi/debian/libapache-mod-security2/./mod-security-common_2.5.9-1_all.deb  Size mismatch
Failed to fetch http://etc.inittab.org/~agi/debian/libapache-mod-security2/./libapache-mod-security_2.5.9-1_amd64.deb  Size mismatch
E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?
 

Hi Falko

To attach a file on RC the following error occurs:

ModSecurity: Request body (Content-Length) is larger than the configured limit (131072)

That happend because the value of SecRequestBodyLimit es 131072, I have configure with the value SecRequestBodyLimit 10000000. The units is KB right?

Best Regards.