Project 16: Protecting Apache with mod_security (20 pts.)

Requirements

You will need two machines--they can be physical or virtual, but they must be on the same LAN:

Introducing mod_security

mod_security is a Web Application Firewall. It protects your Web server from SQL injection and many other attacks, and in the latest version, it stops some Incomplete HTTP Request attacks.

Installing mod_security

First we will install the archive's version, and later upgrade it to the latest version.

Start Ubuntu and log in. From the Menu bar, click Applications, Accessories, Terminal. Ping ubuntu.com and make sure you are getting replies. If you are not, you need to fix your networking before you can proceed.

In the Terminal window, execute this command (when you are prompted to, enter your password):

sudo apt-get install libapache-mod-security -y

Creating the modsecurity Configuration File

In the Terminal window, execute this command:
sudo nano /etc/apache2/conf.d/modsecurity2.conf
In nano, enter these three lines:
<ifmodule mod_security2.c>
Include modsecurity-rules/*.conf
</ifmodule>
Save the file with Ctrl+X, Y, Enter.

Adding Rules

Modsecurity has no effect without rules, which describe the commands to block. We'll use a basic rule set that stops common attacks.

In the Terminal window, execute these commands:

cd /tmp

wget http://downloads.sourceforge.net/project/mod-security/modsecurity-apache/2.5.12/modsecurity-apache_2.5.12.tar.gz

tar -xzf modsecurity-apache_2.5.12.tar.gz

cd modsecurity-apache_2.5.12

sudo mkdir /etc/apache2/modsecurity-rules

sudo cp rules/*.conf /etc/apache2/modsecurity-rules/

sudo cp rules/base_rules/* /etc/apache2/modsecurity-rules/

Restarting Apache

In the Terminal window, execute this command:
sudo /etc/init.d/apache2 restart

Testing modsecurity

To test modsecurity, we will use curl to send HTTP requests to the Apache server. One of the modsecurity default rules is to reject requests with a User Agent of "Nessus"--I suppose this is intended to deny information to attackers who use automated scanners.

In the Terminal window, execute these commands:

sudo apt-get install curl -y

curl -i http://localhost/

This requests your default Web page, which loads normally, with a status of HTTP/1.1 200 OK, as shown below on this page.

In the Terminal window, execute this command:

curl -i http://localhost/ -A Nessus
You should see a 403 Forbidden response, as shown below on this page. Modsecurity has blocked the request, because the User Agent identifies it as a Nessus scan.

Saving the Screen Image

Make sure you can see the 403 Forbidden message, as shown in the image above on this page.

Save a screen image with the filename Proj 16a from Your Name.

Upgrading modsecurity to version 2.5.13

In the Terminal window, execute these commands:
sudo apt-get install apache2-threaded-dev lua5.1 liblua5.1-0-dev libxml++2.6-dev libpcre3 -y

cd /tmp

sudo wget http://www.modsecurity.org/download/modsecurity-apache_2.5.13.tar.gz

sudo tar -xzf modsecurity-apache_2.5.13.tar.gz

cd modsecurity-apache_2.5.13

cd apache2

sudo make

sudo make install

sudo cp /tmp/modsecurity-apache_2.5.13/rules/base_rules/* /etc/apache2/modsecurity-rules/

sudo /etc/init.d/apache2 restart

Testing modsecurity Again

In the Terminal window, execute this command:
curl -i http://localhost/ -A Nessus
You should see a 403 Forbidden response, as you did before. This shows that modsecurity is working.

Viewing the Apache Server Status

In the Linux machine, open Firefox. Enter this address: http://localhost/server-status

You should see only one letter in the grid, indicating that only one client is being served at the moment, as shown below on this page.

Attacking Apache

On the Windows attacker, run the OWASP HTTP Attack tool as you did in previous projects. Attack the IP address of your Linux Apache server. Start with these parameters, which are sufficient to bring Apache to a total stop:

Click the "Run attack" button. You should see the "HTTP Attack information" box, as shown below on this page.

Viewing the Apache Server Status

In the Linux machine, in Firefox, click the Refresh button. If the page does not load, you may have to stop the attack briefly to get the session started, and then restart the attack, and then refresh the Firefox page.

You should see the grid full of letters, indicating that all possible connections are in use, as shown below on this page.

Stopping the Attack

In the Windows machine, in the "HTTP Attack information" box, click the "Cancel attack" button.

Enabling Layer 7 DoS Protection

To enable modsecurity's new layer 7 DoS protection, you need to add a directive to a configuration file.

In the Linux machine, in the Terminal window, execute these commands:

cd /etc/apache2/modsecurity-rules

sudo nano modsecurity_crs_10_config.conf

Move the cursor to the end of this file. Add these lines, as shown below on this page:

#
# Stop Layer 7 Slow Request Attacks
#
SecReadStateLimit 5

Save the file with Ctrl+X, Y, Enter.

Now, to restart Apache, in the Terminal window, enter this command:

sudo /etc/init.d/apache2 restart

Attacking Apache Again

On the Windows attacker, in the OWASP HTTP Attack tool, click the "Run attack" button. You should see the "HTTP Attack information" box, as shown below on this page.

Viewing the Apache Server Status

In the Linux machine, in Firefox, click the Refresh button.

You should see only six letters in the grid. Modsecurity is stopping the attack!

Saving the Screen Image

Make sure you can see the status grid with only six letters, as shown in the image above on this page.

Save a screen image with the filename Proj 16b from Your Name.

Stopping the Attack

In the Windows machine, in the "HTTP Attack information" box, click the "Cancel attack" button.

Turning in Your Project

Email the images to [email protected] with a Subject line of Proj 16 from Your Name.

Sources

http://linuxlog.org/?p=135

http://blog.spiderlabs.com/modsecurity/page/2/

http://mdessus.free.fr/?p=7

http://blog.ebizdaddy.com/2010/11/fortify-apache-web-server-with-mod_evasive-and-mod_security-on-ubuntu-10-04-lts-server/

Last modified: 9 pm 4-13-11