libModSecurity v3 with Apache

The ModSecurity-apache connector loads libModSecurity into Apache HTTP Server as the module mod_security3.

Warning

The Apache connector is not production ready. Its only release is v0.0.9-beta1 from December 2017, the master branch has not changed since 2021, request body handling is incomplete, and no distribution packages it. For Apache, use ModSecurity v2 (mod_security2), which is the maintained and recommended engine on that platform.

Compilation

Install libModSecurity first (see Building libModSecurity v3 from source), make sure apxs from the Apache development package is on the path, then:

git clone https://github.com/owasp-modsecurity/ModSecurity-apache
cd ModSecurity-apache
./autogen.sh
./configure
make
sudo make install

Usage

Load the module and point it at a rules file. The directives mirror the NGINX connector’s:

LoadModule security3_module modules/mod_security3.so

modsecurity on
modsecurity_rules_file /etc/my_modsecurity_rules.conf

modsecurity_rules_remote <key> <URL> and modsecurity_rules '<inline rules>' are also available, with the same meaning as in the NGINX connector. All of them are accepted in the server and virtual host configuration and in <Location> and <Directory> blocks.