Debianization

[szepeviktor]

Hello!

Do you know something about packaging for Debian?
AFAIK only v2 is packaged although lib v3 is available but that cannot be used directly in Apache 2.4.x
Thanks.

[szepeviktor]

@inittab Could you help?

[inittab]

Hi, either @airween or myself will eventually look at it, yes. Since Debian Buster is frozen now and no new packages will make it past testing, I'm taking a break on packaging new stuff. Regards, Alberto

[airween]

The Apache connector is not production ready, please do not use it.

[zimmerle]

@airween is correct. please do not generate a package for it as it is not yet ready for production. That may lead the user to think that it is ready and it is not.

[airween]

@szepeviktor, @inittab note, that there is the package ready Nginx version:

https://salsa.debian.org/airween-guest/nginx/tree/modsecurity

and I've asked the Nginx maintainers to add this patch, but no aswer till 3 months... :(

[ericloveacp]

When will the modsecurity-apache connector be ready for production? I was able to do this build on Ubuntu 16.04 as follows with no problem:

This will downloads the ModSecurity-apache connector into the /opt directory from GitHub repo at https://github.com/SpiderLabs/ModSecurity-apache. The ModSecurity-apache connector will be build after apache2 is configured to use the connector.

cd /opt &&
git clone https://github.com/SpiderLabs/ModSecurity-apache.git

Configure Apache2 to use the ModSecurity-apache connector.

cd /opt/httpd-2.4.39 &&
./configure --with-libmodsecurity=/opt/ModSecurity-apache
--enable-cgi
--enable-info
--enable-speling
--enable-usertrack
--enable-deflate
--enable-ssl
--enable-proxy
--enable-proxy-connect
--enable-proxy-ftp
--enable-expires
--enable-headers
--enable-proxy-http
--enable-rewrite
--enable-so
--enable-proxy-balancer
--with-included-apr

Build Apache2 with the ModSecurity-apache connector.

sh /opt/ModSecurity-apache/autogen.sh &&
cd /opt/httpd-2.4.39 &&
./configure &&
make && make install

[szepeviktor]

@ericloveacp Could you enclose your output in tripple backticks? ```

it will look nice

[airween]

When will the modsecurity-apache connector be ready for production?

sorry, don't know :)

I was able to do this build on Ubuntu 16.04 as follows with no problem:

yes, but after this:

sh /opt/ModSecurity-apache/autogen.sh &&
cd /opt/httpd-2.4.39 &&
./configure &&
make && make install

type:
make test

and - perhaps - you can see the problem (I don't know, which commits are in the master branch).

The request body handling isn't completed yet.

[ericloveacp]

I performed the make test when I did build. I did not see any errors. But when I build another dev environment, I will do test and put the output here. But I can see the modsecurity-apache connector running and the version in logs after restarting apache as follows:

grep ModSecurity-Apache error_log
[Thu Jun 27 11:58:49.123977 2019] [:notice] [pid 31980:tid 139632326576000] ModSecurity: ModSecurity-Apache v0.1.1-beta configured.
[Thu Jun 27 12:00:32.535170 2019] [:notice] [pid 32087:tid 140393527097216] ModSecurity: ModSecurity-Apache v0.1.1-beta configured.
[Fri Jun 28 11:14:23.538484 2019] [:notice] [pid 12685:tid 140345924384640] ModSecurity: ModSecurity-Apache v0.1.1-beta configured.
[Fri Jun 28 11:42:58.240207 2019] [:notice] [pid 13061:tid 140414344103808] ModSecurity: ModSecurity-Apache v0.1.1-beta configured.
[Fri Jun 28 13:14:04.382257 2019] [:notice] [pid 14411:tid 139807209174912] ModSecurity: ModSecurity-Apache v0.1.1-beta configured.
[Fri Jun 28 13:16:49.681327 2019] [:notice] [pid 14532:tid 140411336214400] ModSecurity: ModSecurity-Apache v0.1.1-beta configured.
[Mon Jul 01 14:49:10.265871 2019] [:notice] [pid 21486:tid 140149394323328] ModSecurity: ModSecurity-Apache v0.1.1-beta configured.

It would be nice to get an eta on when the modsecurity-apache connector will be ready for production. A lot of us want to take advantage of using ModSecurity v3 (libmodsecurity) for apache2. Can't really do this without the modsecurity-apache connector.

[zimmerle]

The apache connector is still experimental. We are currently short in effort to make it production-ready.

[airween]

Hi @ericloveacp,
yes, the code successfully build, and everything works as well - seemingly. But when you start to run the tests (eg. CRS test - here), then you will see the errors. And some errors occur by Apache connector (wrong request handling) not by libmodsecurity3.

Here is the last version of the code, I think this contains the most less error (less than the other versions :)). With this version, the most regression tests of CRS will passed, but the connector own test will failed.

Please note, that it doesn't matter, what you see in apache logs (above), that's so far from the real state.

[zimmerle]

Important to mention that the link posted by @airween is not the latest version of this project, but the latest version of what he is working with. The code for this project is not in the state to be put in production.

[airween]

Important to mention that the link posted by @airween is not the latest version of this project, but the latest version of what he is working with. The code for this project is not in the state to be put in production.

Sure, of course - sorry for the ambiguous post :)