Debian 12 Apache2 mod_security

安裝
apt install -y libapache2-mod-security2
a2enmod security2

設定 ModSecurity 設定檔 /etc/modsecurity/modsecurity.conf
cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf
將 SecRuleEngine 的 DetectionOnly 改成 On

設定 OWASP ModSecurity 核心規則集
mv /usr/share/modsecurity-crs /usr/share/modsecurity-crs.bak
git clone https://github.com/coreruleset/coreruleset /usr/share/modsecurity-crs
mv /usr/share/modsecurity-crs/crs-setup.conf.example /usr/share/modsecurity-crs/crs-setup.conf

設定 預設請求排除規則檔案
mv /usr/share/modsecurity-crs/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example /usr/share/modsecurity-crs/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf

在 Apache 2 中啟用 ModSecurity 修改 /etc/apache2/mods-available/security2.conf
<IfModule security2_module>
        SecDataDir /var/cache/modsecurity
        IncludeOptional /usr/share/modsecurity-crs/crs-setup.conf
        IncludeOptional /usr/share/modsecurity-crs/rules/*.conf
</IfModule>

編輯虛擬主機設定檔，設定 SecRuleEngine 為 On
<VirtualHost *:443>
    SecRuleEngine On
</VirtualHost>

systemctl restart apache2

相關指令
apache2ctl -M

測試
curl http://127.0.0.1/index.html?exec=/bin/bash