How to Set Up Modsecurity Waf on Apache with the Owasp Core Rule Set on Ubuntu

ByAkensai

Learning how to set up ModSecurity WAF on Apache with the OWASP Core Rule Set on Ubuntu is one of the smartest moves you can make for your server’s security. ModSecurity is an open-source web application firewall. It sits in front of your web applications and filters out malicious traffic. When you pair it with the OWASP Core Rule Set (CRS), you get a powerful, community-maintained set of rules that block common attacks. These include SQL injection, cross-site scripting, and remote code execution attempts. This tutorial walks you through the full installation and configuration process. By the end, your Apache server will actively inspect and block dangerous requests before they ever reach your application.

Prerequisites and Requirements for This ModSecurity Setup

Before you start, make sure you have the following in place.

System requirements:

  • Ubuntu 20.04 or 22.04 (fresh install recommended)
  • Apache 2.4 installed and running
  • Root or sudo access to the server
  • A basic understanding of the Linux command line
  • An active internet connection

Estimated time: 30–45 minutes

You don’t need to be a security expert to follow this guide. If you can run commands in a terminal and edit configuration files, you’re ready. Make sure Apache is already installed before you begin. If it isn’t, run sudo apt install apache2 -y first. You should also have a domain or test site running on Apache so you can verify the WAF is working after setup.

How to Set Up ModSecurity WAF on Apache with the OWASP Core Rule Set

You might also find this useful: How to Create a Wordpress Block Theme From Scratch Using the Create Block Theme Plugin

Follow these steps carefully. Each one builds on the last.

Step 1: Update your system packages

Always start with a system update. This ensures you install the latest available versions of all packages.

sudo apt update && sudo apt upgrade -y

Step 2: Install ModSecurity and the Apache connector

Install the ModSecurity module for Apache directly from Ubuntu’s repositories.

sudo apt install libapache2-mod-security2 -y

Once installed, enable the module with Apache’s module manager.

sudo a2enmod security2
sudo systemctl restart apache2

Step 3: Configure ModSecurity in detection mode

ModSecurity ships with a default recommended configuration file. Copy it to activate it.

sudo cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf

Now open the file and switch ModSecurity from detection-only mode to active blocking mode. First, let’s start in detection mode so nothing breaks.

sudo nano /etc/modsecurity/modsecurity.conf

Find this line:

SecRuleEngine DetectionOnly

Leave it as DetectionOnly for now. You’ll change it to On after testing. Save and close the file.

Step 4: Download the OWASP Core Rule Set

The OWASP CRS is not included by default. You need to download it manually. Check the official OWASP CRS website for the latest release. Then run the following commands to download and install it.

cd /etc/modsecurity
sudo git clone https://github.com/coreruleset/coreruleset.git owasp-crs

If git isn’t installed, run sudo apt install git -y first.

Step 5: Set up the CRS configuration file

The CRS includes an example configuration file. Copy it to create your active config.

sudo cp /etc/modsecurity/owasp-crs/crs-setup.conf.example /etc/modsecurity/owasp-crs/crs-setup.conf

Step 6: Tell Apache to load the CRS rules

Open the ModSecurity configuration file for Apache.

sudo nano /etc/apache2/mods-enabled/security2.conf

Find the IncludeOptional line. Replace its contents so it loads both the CRS setup file and all the rules. Your file should look like this:

<IfModule security2_module>
    SecDataDir /var/cache/modsecurity
    IncludeOptional /etc/modsecurity/.conf
    IncludeOptional /etc/modsecurity/owasp-crs/crs-setup.conf
    IncludeOptional /etc/modsecurity/owasp-crs/rules/.conf
</IfModule>

Save the file and exit.

Step 7: Restart Apache and test the setup

Restart Apache to apply all changes.

sudo systemctl restart apache2

Check that Apache started without errors.

sudo systemctl status apache2

Now test ModSecurity by sending a simulated attack request to your server. Replace yourdomain.com with your actual domain or IP.

curl -I "http://yourdomain.com/?param=<script>alert(1)</script>"

In detection mode, you’ll see the request logged but not blocked. Check the audit log for entries.

sudo tail -f /var/log/apache2/modsec_audit.log

Step 8: Switch ModSecurity to blocking mode

Once you’re confident everything works, enable active blocking. Open the main config file again.

sudo nano /etc/modsecurity/modsecurity.conf

Change this line:

SecRuleEngine DetectionOnly

To this:

SecRuleEngine On

Save the file. Restart Apache one more time.

sudo systemctl restart apache2

Your WAF is now actively blocking malicious requests. For more details on tuning rules, refer to the Apache ModSecurity documentation.

Troubleshooting Common ModSecurity and OWASP CRS Issues

Even with a clean setup, you may run into a few problems. Here are the most common ones.

Apache fails to start after enabling ModSecurity

Run sudo apache2ctl configtest to check for syntax errors. Look at the output carefully. A missing rule file or a typo in security2.conf is usually the cause.

Legitimate traffic is being blocked (false positives)

This is common with the OWASP CRS at its default paranoia level. The CRS uses a scoring system. You can lower the anomaly threshold in crs-setup.conf by editing these values:

SecAction 
  "id:900110,
  phase:1,
  nolog,
  pass,
  t:none,
  setvar:tx.inbound_anomaly_score_threshold=10,
  setvar:tx.outbound_anomaly_score_threshold=4"

Increase the threshold numbers to reduce false positives. You can also whitelist specific rules using SecRuleRemoveById in a custom configuration file.

ModSecurity audit log is growing too large

Edit /etc/modsecurity/modsecurity.conf and change the SecAuditLogParts directive to log less detail. You can also set up log rotation using logrotate.

Git command not found during CRS download

Install git with sudo apt install git -y and retry Step 4.

Conclusion

You now know how to set up ModSecurity WAF on Apache with the OWASP Core Rule Set on Ubuntu. Your server is now protected against a wide range of common web attacks. You went from a bare Apache install to a fully configured web application firewall with industry-standard rules. The next step is to monitor your audit logs regularly. Look for patterns in blocked requests. Tune your rules over time to reduce false positives without lowering your security. You might also consider enabling HTTPS with Let’s Encrypt if you haven’t already. Combining a WAF with SSL gives your server strong, layered protection that’s hard to beat.

Similar Posts