ModSecurity
The optional InfraFence ModSecurity rules for Apache - 13 rules that block attacks on the first request, how they are enabled, tested and rolled back, and the audit log.
Last updated:
The web firewall reads the logs after the request. On Apache with ModSecurity, InfraFence can also add 13 rules of its own that refuse attacks inside the web server, on the first request.
Requirements
- Apache with the ModSecurity module (
mod_security2) already installed. InfraFence does not install ModSecurity. - Allow web server configuration changes turned on under Settings › Agent. It is off by default.
- No hosting panel, LiteSpeed or configuration-management tool in charge of the web server configuration. The read-only check finds them and InfraFence then never edits the configuration (for example
cPanel manages the web server configuration and may overwrite edits).
nginx is not edited for ModSecurity.
What it adds
The rules go in /etc/modsecurity/infrafence/, included from the existing ModSecurity configuration with IncludeOptional /etc/modsecurity/infrafence/*.conf. Each rule answers 403:
| Rule | Blocks |
|---|---|
| 9910001 | SQL injection |
| 9910002 | Cross-site scripting |
| 9910003 | Remote code execution |
| 9910004 | Path traversal |
| 9910005 | SSRF, including cloud metadata addresses |
| 9910006 | Shellshock |
| 9910007 | Web shell access |
| 9910008 | .env probes |
| 9910009 | Configuration probes |
| 9910010 | Header injection |
| 9910012 | Log4Shell |
| 9910013 | Spring4Shell |
| 9910014 | Known scanner user agents |
Active bans are also written as ModSecurity rules (up to 5,000 addresses), which matters when visitors reach Apache through a proxy or a CDN and the firewall only sees the proxy.
How it is applied safely
The setup is one transaction: the agent saves the files it is about to change, writes the rules and the include, and runs apachectl configtest. If anything fails, everything is put back as it was and the dashboard gets a webserver_config_error event. If the test passes, Apache reloads gracefully (apachectl graceful), without cutting open connections, and the dashboard gets modsecurity_enabled. Reloads are batched, at most one every 5 minutes.
Turning it off
Turning Allow web server configuration changes off stops further changes. The rules already in place are removed by infrafence-agent uninstall --clean or by the uninstaller, again with a configuration test first.
The audit log
Whatever web server you run, if ModSecurity writes an audit log the agent reads it and reports each interception with its rule ids, the URL, the method and the engine mode (ENABLED or DETECTION_ONLY). It finds the log in the usual places, or at MODSEC_AUDIT_LOG.
Virtual patches
Virtual patches for exploited CVEs use the same ModSecurity setup.