Web Application Firewalls and Intrusion Detection for Associations: Setting Up ModSecurity with OWASP Core Rule Set and Fail2ban on Virtualmin Correctly

Why Associations Need a Web Application Firewall

Associations often face the challenge of protecting their member data without having a large IT budget. Websites with member areas, contact forms, or donation functions are popular targets for attackers. SQL injection, cross-site scripting (XSS), and brute-force attacks can not only endanger data but also shake members' trust. A web application firewall (WAF) and an intrusion detection system (IDS) are therefore indispensable protective measures.

In this article, we show you how to set up ModSecurity with the OWASP Core Rule Set (CRS) and Fail2ban on a virtual server with Virtualmin to effectively secure your association's website.

What is ModSecurity and the OWASP Core Rule Set?

ModSecurity is an open-source web application firewall that monitors HTTP traffic and blocks attack patterns. The OWASP Core Rule Set (CRS) is a collection of rules specifically designed to detect known attacks such as SQL injection, XSS, and other OWASP Top 10 vulnerabilities.

By integrating ModSecurity and CRS into your web server (Apache or Nginx), you can filter malicious requests before they reach your application.

Install ModSecurity with OWASP CRS on Virtualmin

Virtualmin offers a user-friendly interface for managing web servers. Installing ModSecurity and CRS is possible via the package manager or manually. Here is a step-by-step guide for Apache:

1. Install ModSecurity

Run the following commands on your server (depending on the distribution):

sudo apt install libapache2-mod-security2
sudo a2enmod security2
sudo systemctl restart apache2

2. Set Up OWASP Core Rule Set

Download the CRS from the official GitHub page and copy it to the ModSecurity directory:

git clone https://github.com/coreruleset/coreruleset.git /etc/modsecurity/crs
cp /etc/modsecurity/crs/crs-setup.conf.example /etc/modsecurity/crs/crs-setup.conf

Adjust the ModSecurity configuration to load the CRS. Add the following lines in /etc/apache2/mods-enabled/security2.conf:

IncludeOptional /etc/modsecurity/*.conf
Include /etc/modsecurity/crs/crs-setup.conf
Include /etc/modsecurity/crs/rules/*.conf

3. Configure ModSecurity

In the file /etc/modsecurity/modsecurity.conf, you should set SecRuleEngine to On to enable protection. For testing, you can initially use DetectionOnly.

Further details on configuration can be found in the knowledge base.

Fail2ban for Defense Against Brute-Force Attacks

Fail2ban monitors log files and blocks IP addresses that repeatedly make failed login attempts. This is particularly important to defend against brute-force attacks on login pages (e.g., WordPress, Joomla, or custom member areas).

1. Install Fail2ban

sudo apt install fail2ban
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

2. Configure Fail2ban for Web Applications

Create a local configuration file /etc/fail2ban/jail.local and add jails for Apache and ModSecurity. Example for a jail that detects failed login attempts:

[apache-auth]
enabled = true
port = http,https
filter = apache-auth
logpath = /var/log/apache2/error.log
maxretry = 3
bantime = 3600

For ModSecurity, there are special filters that access the ModSecurity audit logs. You can also create custom filters that react to specific rules.

Best Practices for Associations

• Regular Updates: Keep ModSecurity, CRS, and Fail2ban up to date to detect new attack patterns.
• Monitoring: Monitor the logs and adjust the rules to minimize false positives.
• Backups: Create regular backups of your website and database.
• Training: Raise awareness among your members about secure passwords and phishing.

For a professional environment, we recommend web hosting or a virtual server at dezhost, which offers optimal conditions for security tools.

Conclusion

With ModSecurity, the OWASP Core Rule Set, and Fail2ban, you can effectively protect your association's member data from SQL injection, XSS, and brute-force attacks. Setting it up on Virtualmin is feasible even for less experienced administrators. Invest time in security – your members will thank you.