Red Hat / CentOS Install mod_security Apache Intrusion Detection And Prevention Engine

To install the mod_security Apache module, which is an intrusion detection and prevention engine, on a Red Hat or CentOS Linux system, you can follow these steps:

1. Install the mod_security package using the package manager:

sudo yum install mod_security

2. Enable the mod_security module in Apache by adding the following line to the /etc/httpd/conf/httpd.conf file:

LoadModule security2_module modules/mod_security2.so

3. Restart Apache to apply the changes:

sudo systemctl restart httpd

4. Configure the mod_security rules by editing the /etc/httpd/conf.d/mod_security.conf file. You can use the SecRule directive to specify the rules you want to apply.

For example, to block requests that contain the string "XSS" in the query string, you can add the following rule:

SecRule REQUEST_URI "XSS" \
    "id:'200001',\
    phase:1,\
    deny,\
    status:403"

It's always a good idea to carefully review the documentation and use the appropriate options to configure the mod_security module and specify the rules you want to apply. This will help protect your Apache server from potential intrusions and attacks.