Mod_Security and Mod_Unique_id Install

[InsertCoin]

Plesk: 9.5.2
OS: Ubuntu Hardy 8.04

I have been crawling around the internet looking for a way to install mod_security, however I have been unable to come up with a guide on how to do this. Most refer to installing it with "apt-get install libapache2-mod-security" and the documentation over at modsecurity.org advises that mod_unique_id needs to be enabled.

I found it on the server in /usr/lib/apache2/modules/mod_unique_id.so and tried to enable it to no avail (assume it needs to be compiled in).

Anyone know how I can get mod_security running?

 

[IgorG]

http://forum.parallels.com/showthread.php?t=98697

 

[InsertCoin]

Doesnt help really, as thats for centos/RH installs.

Ubuntu 8.04 doesn't have mod-security available.

Very strange that Plesk are not taking a more pro-active approach to allow people to be able to secure their server.

 

[IgorG]

What about

apt-cache search mod_security

?

As I remember it may be libapache2-mod-security on Ubuntu.

 

[InsertCoin]

Yep, that was my first attempt:

root@:/# apt-cache search mod_security
root@:/#

Is all that happens.

My sources.list:

deb http://archive.ubuntu.com/ubuntu hardy main restricted universe
deb http://archive.ubuntu.com/ubuntu hardy-updates main restricted universe
deb http://archive.ubuntu.com/ubuntu hardy-security main restricted universe

## This is temporary appended by Autoinstaller for
## specify source of product's packages for APT.
deb http://autoinstall.plesk.com/ubuntu/PSA_9.5.2 hardy all

 

[InsertCoin]

Further information:

The reason for wanting to install is because if I create a file on my hosting (called bad.php) with the contents:

<? $secret_file = $_GET['secret_file'];
include ( $secret_file); ?>

And then call it with:

/bad.php?secret_file=/etc/passwd

It prints the contents of /etc/passwd to the browser, which is not very secure.

 

[danliker]

open_basedir should prevent this, i have tested it on debian right now, it does not work there ...

but maybe it is the same bug as here on centos:
http://forum.parallels.com/showthread.php?goto=newpost&t=99842

 

[InsertCoin]

danliker - its a possibility, I will investigate further.

 

[lvalics]

Did you ever tried to use also Suhosin? - http://www.hardened-php.net/suhosin/
This also is a PHP security layer.