ModSecurity and Fail2ban under Virtualmin for Associations: GDPR-Compliant Protection Against Attacks

Associations often face the challenge of operating their website securely without blowing their budget. Virtualmin offers a powerful platform to integrate ModSecurity and Fail2ban. In this article, we show you how to set up a Web Application Firewall (WAF), configure IP blocklists, and defend against brute-force attacks—all GDPR-compliant.

Why ModSecurity and Fail2ban are important for associations

Association websites are often exposed to attacks, whether from automated bots or targeted hacker attacks. ModSecurity acts as a WAF and filters malicious requests, while Fail2ban blocks the IP address after repeated failed logins. This combination protects not only your data but also that of your members—an important aspect of GDPR compliance.

Prerequisites for setup

Before you start, make sure you meet the following prerequisites:

• A server with virtual servers or web hosting at DezHost.
• Virtualmin installed and ready to use.
• Root access or corresponding sudo privileges.
• Basic knowledge of Linux and Apache/Nginx.

If you don't have hosting yet, you can book web hosting or virtual servers at DezHost. For associations, it's also worth taking a look at reseller hosting if multiple websites are managed.

Install and configure ModSecurity

Installing ModSecurity

ModSecurity is an open-source WAF module for Apache and Nginx. Under Virtualmin, you can install it via the package manager. Run the following commands:

sudo apt update
sudo apt install libapache2-mod-security2

After installation, enable the module and restart Apache:

sudo a2enmod security2
sudo systemctl restart apache2

Basic configuration

You can find the configuration file at /etc/modsecurity/modsecurity.conf. Set the mode to On or DetectionOnly for the beginning. For production use, we recommend On to actively block attacks. Also adjust the rule sets, e.g., the OWASP Core Rule Set (CRS), which you install separately.

Tip: Test the configuration first in DetectionOnly mode to avoid false alarms.

Set up Fail2ban

Installation and basic configuration

Fail2ban monitors log files and blocks IPs on suspicious behavior. Install it with:

sudo apt install fail2ban

The main configuration is located in /etc/fail2ban/jail.conf. Create a local copy jail.local to make your adjustments. Enable SSH protection and adjust the thresholds:

[sshd]
enabled = true
maxretry = 3
bantime = 3600

For web applications, you can configure additional jails for Apache or Nginx to block brute-force attacks on login pages.

Manage IP blocklists

Fail2ban automatically creates IP tables. You can also add manual blocklists, e.g., via fail2ban-client set sshd banip 192.0.2.1. Monitor the blocks with fail2ban-client status.

GDPR-compliant setup

The GDPR requires that personal data be protected. When storing IPs through Fail2ban, you must ensure that the data is retained only as long as necessary. Do not set the bantime too high and inform your members about the processing in the privacy policy. You can find more information in our knowledge base.

ModSecurity logs requests; here too, the rule applies: delete logs regularly and restrict access. A good option is configuring logrotate.

Regular maintenance and updates

Keep ModSecurity and Fail2ban always up to date to defend against new attack vectors. Regularly check the logs for suspicious activities. Virtualmin offers a user-friendly interface for this.

Conclusion

With ModSecurity and Fail2ban under Virtualmin, you can effectively protect your association's website while meeting GDPR requirements. The setup requires some technical know-how but is worthwhile for the security of your data. If you have questions, our support is there to help.