WordPress を運用している Apache に ModSecurity を導入

apt update
apt install libapache2-mod-security2 modsecurity-crs

# ModSecurity モジュールを有効化
sudo a2enmod security2

# 推奨設定を有効化
sudo mv /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf

# Apache 再起動
sudo systemctl restart apache2.service

apt update
apt install libpcre-dev yajl-tools yajl2 ssdeep libyajl-dev lib-lua5.3-dev

# ディレクトリ移動
cd /usr/local/src

# ソースコードダウンロード
wget https://github.com/owasp-modsecurity/ModSecurity/releases/download/v2.9.7/modsecurity-2.9.7.tar.gz

# ソースコード解凍
# 知らない人もいたのが以外だけど、 a オプションは z とか j とか拡張子でよきにはからってくれるよ
tar xavf modsecurity-2.9.7.tar.gz

# ソースコードディレクトリに移動
cd modsecurity-2.9.7

# configure
./configure --with-apxs=[PATH_TO_APXS] --with-apr=[PATH_TO_APX_UTILS] --with-yajl --with-ssdeep --with-lua --with-libxml

# 4 は CPU コア数に合わせて修正
make -j4

# モジュールインストール
sudo make install

# CRS ダウンロード
mkdir /usr/share/modsecurity
cd /usr/share/modsecurity
git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git

sudo vim [PATH_TO_httpd.conf]
LoadModule unique_id_module modules/mod_unique_id.so
LoadModule security2_module modules/mod_security2.so

cd [PATH_TO_HTTPD-CONF-DIR]/conf/extra/
cat << EOF > modsecurity.conf
<IfModule security2_module>
        SecDataDir /var/cache/modsecurity
        IncludeOptional /etc/modsecurity/*.conf
        IncludeOptional /usr/share/modsecurity-crs/*.load
</IfModule>
EOF

sudo mkdir -p /etc/modsecurity/crs
sudo cd /etc/modsecurity
sudo cat << EOF > mod_security.conf
# ブロック有効化
SecRuleEngine On
# 検出のみ
#SecRuleEngine DetectionOnly
SecRequestBodyAccess On
SecRule REQUEST_HEADERS:Content-Type "(?:application(?:/soap\+|/)|text/)xml" \
    "id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
SecRule REQUEST_HEADERS:Content-Type "application/json" \
    "id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON"
SecRequestBodyLimit 2147483648
SecRequestBodyNoFilesLimit 2147483648
SecRequestBodyInMemoryLimit 1310720
SecRequestBodyLimitAction Reject
SecRule REQBODY_ERROR "!@eq 0" \
    "id:'200002', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2"
SecRule MULTIPART_STRICT_ERROR "!@eq 0" \
    "id:'200003',phase:2,t:none,log,deny,status:400, \
    msg:'Multipart request body failed strict validation: \
    PE %{REQBODY_PROCESSOR_ERROR}, \
    BQ %{MULTIPART_BOUNDARY_QUOTED}, \
    BW %{MULTIPART_BOUNDARY_WHITESPACE}, \
    DB %{MULTIPART_DATA_BEFORE}, \
    DA %{MULTIPART_DATA_AFTER}, \
    HF %{MULTIPART_HEADER_FOLDING}, \
    LF %{MULTIPART_LF_LINE}, \
    SM %{MULTIPART_MISSING_SEMICOLON}, \
    IQ %{MULTIPART_INVALID_QUOTING}, \
    IP %{MULTIPART_INVALID_PART}, \
    IH %{MULTIPART_INVALID_HEADER_FOLDING}, \
    FL %{MULTIPART_FILE_LIMIT_EXCEEDED}'"
SecRule MULTIPART_UNMATCHED_BOUNDARY "!@eq 0" \
    "id:'200004',phase:2,t:none,log,deny,msg:'Multipart parser detected a possible unmatched boundary.'"
SecPcreMatchLimit 100000
SecPcreMatchLimitRecursion 100000
SecRule TX:/^MSC_/ "!@streq 0" \
    "id:'200005',phase:2,t:none,deny,msg:'ModSecurity internal error flagged: %{MATCHED_VAR_NAME}'"
SecResponseBodyAccess Off
SecResponseBodyMimeType text/plain text/html text/xml
SecResponseBodyLimit 524288
SecResponseBodyLimitAction ProcessPartial
SecTmpDir /usr/local/apache2/logs/mod_security/tmp
SecDataDir /usr/local/apache2/logs/mod_security/data
SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4(?!04))"
SecAuditLogParts ABDEFHIJZ
SecAuditLogType Serial
SecAuditLog /usr/local/apache2/logs/mod_security/modsec_audit.log
SecArgumentSeparator &
SecCookieFormat 0
SecUnicodeMapFile unicode.mapping 20127
SecStatusEngine On
EOF

sudo systemctl restart [apache サービス名]