A step-by-step sysadmin guide to installing ModSecurity Web Application Firewall with the OWASP Core Rule Set on Apache and Nginx on Ubuntu 22.04 to protect against SQLi, XSS, and RCE attacks.

A Web Application Firewall (WAF) sits between your web server and the internet, inspecting every HTTP request and blocking known attack patterns before they reach your application. For any production website running on a dedicated VPS, deploying ModSecurity with the OWASP Core Rule Set (CRS) is a foundational security requirement.

This guide covers the full installation on Ubuntu 22.04 for both Apache and Nginx.

What is ModSecurity + OWASP CRS?

ModSecurity is the open-source WAF engine. It provides the framework for inspecting requests but ships with no rules of its own.

OWASP Core Rule Set (CRS) is the industry-standard ruleset that plugs into ModSecurity. It protects against the OWASP Top 10 vulnerabilities including:

SQL Injection (SQLi)
Cross-Site Scripting (XSS)
Remote Code Execution (RCE)
Local/Remote File Inclusion (LFI/RFI)
HTTP Protocol Violations

Installation on Apache

Step 1: Install ModSecurity Apache Module

sudo apt update
sudo apt install -y libapache2-mod-security2
sudo a2enmod security2
sudo systemctl restart apache2

Step 2: Enable the Default Configuration

sudo cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf
sudo nano /etc/modsecurity/modsecurity.conf

Change DetectionOnly to On to activate blocking mode:

# Change this:
SecRuleEngine DetectionOnly

# To this:
SecRuleEngine On

Step 3: Install OWASP Core Rule Set

cd /tmp
wget https://github.com/coreruleset/coreruleset/archive/v3.3.5.tar.gz
tar -xvzf v3.3.5.tar.gz
sudo mv coreruleset-3.3.5 /etc/modsecurity/crs
sudo cp /etc/modsecurity/crs/crs-setup.conf.example /etc/modsecurity/crs/crs-setup.conf

Add the CRS to Apache’s ModSecurity configuration:

sudo nano /etc/apache2/mods-enabled/security2.conf

Add these lines inside the <IfModule security2_module> block:

IncludeOptional /etc/modsecurity/crs/crs-setup.conf
IncludeOptional /etc/modsecurity/crs/rules/*.conf

Restart Apache: sudo systemctl restart apache2

Installation on Nginx

ModSecurity for Nginx requires the modsecurity-nginx connector and must be compiled or installed as a dynamic module.

Step 1: Install ModSecurity Library

sudo apt install -y libmodsecurity3 libmodsecurity-dev

Step 2: Download Nginx Connector

cd /tmp
git clone --depth 1 https://github.com/SpiderLabs/ModSecurity-nginx.git

Step 3: Compile Nginx with ModSecurity Module

Get your current Nginx version: nginx -v

Download matching Nginx source and compile with the connector:

NGINX_VERSION=1.24.0  # Replace with your version
wget http://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz
tar -xvzf nginx-${NGINX_VERSION}.tar.gz
cd nginx-${NGINX_VERSION}
./configure --with-compat --add-dynamic-module=/tmp/ModSecurity-nginx
make modules
sudo cp objs/ngx_http_modsecurity_module.so /etc/nginx/modules/

Step 4: Load Module and Configure Nginx

In /etc/nginx/nginx.conf at the top level:

load_module /etc/nginx/modules/ngx_http_modsecurity_module.so;

In your server block:

server {
    modsecurity on;
    modsecurity_rules_file /etc/nginx/modsecurity/main.conf;
    # ... rest of config
}

Create /etc/nginx/modsecurity/main.conf:

Include /etc/modsecurity/modsecurity.conf
Include /etc/modsecurity/crs/crs-setup.conf
Include /etc/modsecurity/crs/rules/*.conf

Testing Your WAF

After deployment, test that ModSecurity is blocking attacks:

# Test SQLi detection — should return 403 Forbidden
curl -I "https://yourdomain.com/?id=1' OR '1'='1"

# Test XSS detection — should return 403 Forbidden
curl -I "https://yourdomain.com/?q=<script>alert(1)</script>"

Check the ModSecurity audit log for blocked requests:

sudo tail -f /var/log/modsec_audit.log

Tuning False Positives

CRS in strict mode may block legitimate requests (false positives). When you identify a false positive, add an exclusion rule. For example, if WordPress’s admin editor is being blocked by XSS rules:

# In a custom rules file (loaded after CRS):
SecRuleUpdateTargetById 941100 "!ARGS:content"

For a related guide on securing your server’s SSL configuration, see our post on fixing expired SSL certificates on Apache and Nginx.

Conclusion

ModSecurity with OWASP CRS provides enterprise-grade WAF protection for any web server. The initial setup takes under an hour on Ubuntu 22.04, and it immediately begins blocking the most common web attack vectors automatically, with minimal tuning required for most standard web applications.

Build robust web application firewalls with OWASP Core Rule Sets on Nextgen Hosting’s high-speed VPS.

How to Install and Configure ModSecurity WAF on Apache/Nginx (Ubuntu 22.04)