# Nginx modsecurity on Debian 8 **URL:** \ **Category:** NGINX\ **Created:** [December 23, 2015, 1:22pm UTC](https://www.ruby-forum.com/t/nginx-modsecurity-on-debian-8/243704 "2015-12-23T13:22:13Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Rafa\_F](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/958977/32.png) [@Rafa\_F](https://www.ruby-forum.com/u/Rafa_F)\ **Post date:** [December 23, 2015, 1:22pm UTC](https://www.ruby-forum.com/t/nginx-modsecurity-on-debian-8/243704/1 "2015-12-23T13:22:13Z")
Hi, A bit lost … I know nothing concerning nginx, I am more confortable with Apache2. I am using an email server who is using nginx on debian 8. I would need to install modsecurity as module. I have understood that I need to compile from the working directory of nginx … ./configure --add-module=/opt/ModSecurity-nginx But how to deal with it if nginx as been installed from binary (debian package) ? I have followed these instructions: $ sudo dnf install gcc-c++ flex bison curl-devel curl yajl yajl-devel GeoIP-devel doxygen $ cd /opt/ $ git clone [GitHub - SpiderLabs/ModSecurity: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx that is developed by Trustwave's SpiderLabs. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis. With over 10,000 deployments world-wide, ModSecurity is the most widely deployed WAF in existence.](https://github.com/SpiderLabs/ModSecurity) $ cd ModSecurity $ git checkout libmodsecurity $ sh build.sh $ ./configure $ make $ make install $ cd /opt/ $ git clone [GitHub - SpiderLabs/ModSecurity-nginx: ModSecurity v3 Nginx Connector](https://github.com/SpiderLabs/ModSecurity-nginx) $ cd /opt/Modsecurity-nginx $ git checkout experimental $ cd /opt/ * * * $ wget [http://nginx.org/download/nginx-1.9.2.tar.gz](http://nginx.org/download/nginx-1.9.2.tar.gz) $ tar -xvzf nginx-1.9.2.tar.gz $ yum install zlib-devel * * * $ ./configure --add-module=/opt/ModSecurity-nginx Everything went fine until the last ./configure … I didn’t apply what’s between " \*\*\* " because my nginx server is already installed and working. Any ideas ? ## Thx Cordialement, Thierry e-mail : removed\_email\_address@domain.invalid ---
**Author:** ![Thierry](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/65b543/32.png) [@Thierry](https://www.ruby-forum.com/u/Thierry)\ **Post date:** [December 23, 2015, 1:35pm UTC](https://www.ruby-forum.com/t/nginx-modsecurity-on-debian-8/243704/2 "2015-12-23T13:35:05Z")
nginx -V will show configure arguments. You need to add mod\_sec at the beginning of whatever is in there. ---
**Author:** ![Thierry](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/65b543/32.png) [@Thierry](https://www.ruby-forum.com/u/Thierry)\ **Post date:** [December 23, 2015, 1:46pm UTC](https://www.ruby-forum.com/t/nginx-modsecurity-on-debian-8/243704/3 "2015-12-23T13:46:39Z")
What I have … Could you please explain to me what do I have to do ? I do not understand … Sorry nginx version: nginx/1.6.2 TLS SNI support enabled configure arguments: --with-cc-opt=‘-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -D\_FORTIFY\_SOURCE=2’ –with-ld-opt=-Wl,-z,relro --prefix=/usr/share/nginx –conf-path=/etc/nginx/nginx.conf –http-log-path=/var/log/nginx/access.log –error-log-path=/var/log/nginx/error.log –lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid –http-client-body-temp-path=/var/lib/nginx/body –http-fastcgi-temp-path=/var/lib/nginx/fastcgi –http-proxy-temp-path=/var/lib/nginx/proxy –http-scgi-temp-path=/var/lib/nginx/scgi –http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-debug --with-pcre-jit –with-ipv6 --with-http\_ssl\_module --with-http\_stub\_status\_module –with-http\_realip\_module --with-http\_auth\_request\_module –with-http\_addition\_module --with-http\_dav\_module –with-http\_geoip\_module --with-http\_gzip\_static\_module –with-http\_image\_filter\_module --with-http\_spdy\_module –with-http\_sub\_module --with-http\_xslt\_module --with-mail –with-mail\_ssl\_module –add-module=/tmp/buildd/nginx-1.6.2/debian/modules/nginx-auth-pam –add-module=/tmp/buildd/nginx-1.6.2/debian/modules/nginx-dav-ext-module –add-module=/tmp/buildd/nginx-1.6.2/debian/modules/nginx-echo –add-module=/tmp/buildd/nginx-1.6.2/debian/modules/nginx-upstream-fair –add-module=/tmp/buildd/nginx-1.6.2/debian/modules/ngx\_http\_substitutions\_filter\_module > nginx -V will show configure arguments. You need to add mod\_sec at > the beginning of whatever is in there. ---
**Author:** ![Thierry](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/65b543/32.png) [@Thierry](https://www.ruby-forum.com/u/Thierry)\ **Post date:** [December 23, 2015, 2:03pm UTC](https://www.ruby-forum.com/t/nginx-modsecurity-on-debian-8/243704/4 "2015-12-23T14:03:36Z")
Greetings, On Wed, 2015-12-23 at 14:21 +0200, Thierry wrote: > A bit lost … > I know nothing concerning nginx, I am more confortable with Apache2. > I am using an email server who is using nginx on debian 8. > I would need to install modsecurity as module. > I have understood that I need to compile from the working directory > of > nginx … FWIW I am in a similar boat. Apache has been my weapon of choice for a long time, I have inherited a system where they prefer nginx. We are a Debian shop, using Jessie (8) on production systems. I use the packages from the nginx repositories rather than the Debian builds. deb [Index of /packages/mainline/debian/](http://nginx.org/packages/mainline/debian/) jessie nginx # nginx -V nginx version: nginx/1.9.7 built by gcc 4.9.2 (Debian 4.9.2-10) built with OpenSSL 1.0.1k 8 Jan 2015 TLS SNI support enabled configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx –conf-path=/etc/nginx/nginx.conf –error-log-path=/var/log/nginx/error.log –http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid –lock-path=/var/run/nginx.lock –http-client-body-temp-path=/var/cache/nginx/client\_temp –http-proxy-temp-path=/var/cache/nginx/proxy\_temp –http-fastcgi-temp-path=/var/cache/nginx/fastcgi\_temp –http-uwsgi-temp-path=/var/cache/nginx/uwsgi\_temp –http-scgi-temp-path=/var/cache/nginx/scgi\_temp --user=nginx –group=nginx --with-http\_ssl\_module --with-http\_realip\_module –with-http\_addition\_module --with-http\_sub\_module –with-http\_dav\_module --with-http\_flv\_module --with-http\_mp4\_module –with-http\_gunzip\_module --with-http\_gzip\_static\_module –with-http\_random\_index\_module --with-http\_secure\_link\_module –with-http\_stub\_status\_module --with-http\_auth\_request\_module –with-threads --with-stream --with-stream\_ssl\_module --with-mail –with-mail\_ssl\_module --with-file-aio --with-http\_v2\_module –with-cc-opt=‘-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D\_FORTIFY\_SOURCE=2’ –with-ld-opt=‘-Wl,-z,relro -Wl,–as-needed’ --with-ipv6 If that is of any help 🙂 ---
**Author:** ![Thierry](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/65b543/32.png) [@Thierry](https://www.ruby-forum.com/u/Thierry)\ **Post date:** [December 23, 2015, 4:09pm UTC](https://www.ruby-forum.com/t/nginx-modsecurity-on-debian-8/243704/5 "2015-12-23T16:09:48Z")
Hi Nikolai, Seems for me to be a bit tricky. Not going to do something because I do not want to break something who is already working perfectly… Why is it so complicated to install a module for nginx ? Thx anyway and happy christmas. Le mercredi 23 décembre 2015 à 15:03:10, vous écriviez : > Greetings, > On Wed, 2015-12-23 at 14:21 +0200, Thierry wrote: > > > A bit lost … > > I know nothing concerning nginx, I am more confortable with Apache2. > > I am using an email server who is using nginx on debian 8. > > I would need to install modsecurity as module. > > I have understood that I need to compile from the working directory > > of > > nginx … > FWIW I am in a similar boat. Apache has been my weapon of choice for a > long time, I have inherited a system where they prefer nginx. We are a > Debian shop, using Jessie (8) on production systems. I use the packages > from the nginx repositories rather than the Debian builds. > deb [Index of /packages/mainline/debian/](http://nginx.org/packages/mainline/debian/) jessie nginx > –http-client-body-temp-path=/var/cache/nginx/client\_temp > –with-threads --with-stream --with-stream\_ssl\_module --with-mail > –with-mail\_ssl\_module --with-file-aio --with-http\_v2\_module > –with-cc-opt=‘-g -O2 -fstack-protector-strong -Wformat > -Werror=format-security -Wp,-D\_FORTIFY\_SOURCE=2’ > –with-ld-opt=‘-Wl,-z,relro -Wl,–as-needed’ --with-ipv6 > If that is of any help 🙂 – Cordialement, Thierry e-mail : [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![Thierry](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/65b543/32.png) [@Thierry](https://www.ruby-forum.com/u/Thierry)\ **Post date:** [December 23, 2015, 5:47pm UTC](https://www.ruby-forum.com/t/nginx-modsecurity-on-debian-8/243704/6 "2015-12-23T17:47:56Z")
Hello Thierry, Here’s a quick howto build a nginx debian package, I hope it’s clear and that I’m not making mistakes. First, you need to get the source of nginx and others files to build the package. You can probably do something like “apt-get source nginx”, but I prefer to go on this page: [Debian -- Error](https://packages.debian.org/jessie/nginx) and manually download the 3 files on the right. Something like “wget [http://http.debian.net/debian/pool/main/n/nginx/nginx\_1.6.2-5.dsc](http://http.debian.net/debian/pool/main/n/nginx/nginx_1.6.2-5.dsc) [http://http.debian.net/debian/pool/main/n/nginx/nginx\_1.6.2.orig.tar.gz](http://http.debian.net/debian/pool/main/n/nginx/nginx_1.6.2.orig.tar.gz) [http://http.debian.net/debian/pool/main/n/nginx/nginx\_1.6.2-5.debian.tar.xz](http://http.debian.net/debian/pool/main/n/nginx/nginx_1.6.2-5.debian.tar.xz)”. Then, you uncompress everything with: “dpkg-source -x nginx\_1.6.2-5.dsc” Then “cd nginx\_1.6.2-5” Here, you will have to do something to add ModSecurity. Normally, you add a 3rd party module by adding something like “–add-module=full/path/to/the/module-source” in the “debian/rules” file (where there are others parameters like “–with-ipv6” or “–with-http\_ssl\_module”). Check the “debian/rules” and add your parameter only to the flavor you will use (full, light,…). Or add the parameter for each of them if you are not sure. I don’t know if ModSecurity need something special. Last step, execute: “dpkg-buildpackage -B -uc” to compile everything and build the “.deb” packages. Note that you will get several of them: full, extras, light, with or without debug,… (regarding this flavors, see previous step: where you added the parameter). Then install your newly created package with: “dpkg -i nginx-THE-FLAVOR-YOU-WANT.deb” PS: I’m really sorry if there are some mistakes (maybe in the filenames?), I just wrote the instructions from memory. PS2: I suggest you first do all this steps, without the one regarding ModSecurity (so without editing “debian/rules”), just to be sure everything goes well. Best Regards. Posted at Nginx Forum: > **[Re: nginx modsecurity on Debian 8](https://forum.nginx.org/read.php?2,263657,263671#msg-263671)** > > Hi, A bit lost ... I know nothing concerning nginx, I am more confortable with Apache2. I am using an email server who is using nginx on debian 8. I would need to install modsecurity as module. I have understood that I need to compile from the... ---
**Author:** ![Thierry](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/65b543/32.png) [@Thierry](https://www.ruby-forum.com/u/Thierry)\ **Post date:** [December 23, 2015, 6:31pm UTC](https://www.ruby-forum.com/t/nginx-modsecurity-on-debian-8/243704/7 "2015-12-23T18:31:45Z")
Bonjour Alt, Thx a lot … But, I might mistaken … My nginx is already working, as already been compiled with a certain number of modules … I do not want to break something … If I am doing what you said … It might happen no ? Thx\* Le mercredi 23 dcembre 2015 18:47:18, vous criviez : > Hello Thierry, > Here’s a quick howto build a nginx debian package, I hope it’s clear and > that I’m not making mistakes. > First, you need to get the source of nginx and others files to build the > package. You can probably do something like “apt-get source nginx”, but I > prefer to go on this page: [I Challenge Thee](https://packages.debian.org/jessie/nginx) and > manually download the 3 files on the right. > Something like “wget > [http://http.debian.net/debian/pool/main/n/nginx/nginx\_1.6.2-5.dsc](http://http.debian.net/debian/pool/main/n/nginx/nginx_1.6.2-5.dsc) > [http://http.debian.net/debian/pool/main/n/nginx/nginx\_1.6.2.orig.tar.gz](http://http.debian.net/debian/pool/main/n/nginx/nginx_1.6.2.orig.tar.gz) > [http://http.debian.net/debian/pool/main/n/nginx/nginx\_1.6.2-5.debian.tar.xz](http://http.debian.net/debian/pool/main/n/nginx/nginx_1.6.2-5.debian.tar.xz)”. > Then, you uncompress everything with: “dpkg-source -x nginx\_1.6.2-5.dsc” > Then “cd nginx\_1.6.2-5” > Here, you will have to do something to add ModSecurity. Normally, you add a > 3rd party module by adding something like > “–add-module=full/path/to/the/module-source” in the “debian/rules” file > (where there are others parameters like “–with-ipv6” or > “–with-http\_ssl\_module”). > Check the “debian/rules” and add your parameter only to the flavor you will > use (full, light,…). Or add the parameter for each of them if you are not > sure. > I don’t know if ModSecurity need something special. > Last step, execute: “dpkg-buildpackage -B -uc” to compile everything and > build the “.deb” packages. Note that you will get several of them: full, > extras, light, with or without debug,… (regarding this flavors, see > previous step: where you added the parameter). > Then install your newly created package with: “dpkg -i > nginx-THE-FLAVOR-YOU-WANT.deb” > PS: I’m really sorry if there are some mistakes (maybe in the filenames?), I > just wrote the instructions from memory. > PS2: I suggest you first do all this steps, without the one regarding > ModSecurity (so without editing “debian/rules”), just to be sure everything > goes well. > Best Regards. > Posted at Nginx Forum: > [https://forum.nginx.org/read.php?2,263657,263671#msg-263671](https://forum.nginx.org/read.php?2,263657,263671#msg-263671) > * * * > > nginx mailing list > [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > [mailman.nginx.org archive](http://mailman.nginx.org/mailman/listinfo/nginx) – Cordialement, Thierry e-mail : [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![Thierry](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/65b543/32.png) [@Thierry](https://www.ruby-forum.com/u/Thierry)\ **Post date:** [December 23, 2015, 1:53pm UTC](https://www.ruby-forum.com/t/nginx-modsecurity-on-debian-8/243704/8 "2015-12-23T13:53:40Z")
append the configure argument you already mentioned ./configure –add-module=/opt/ModSecurity-nginx with the –with-cc-opt=‘-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -D\_FORTIFY\_SOURCE=2’ --with-ld-opt=-Wl,-z,relro –prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf –http-log-path=/var/log/nginx/access.log –error-log-path=/var/log/nginx/error.log –lock-path=/var/lock/nginx.lock –pid-path=/run/nginx.pid –http-client-body-temp-path=/var/lib/nginx/body –http-fastcgi-temp-path=/var/lib/nginx/fastcgi –http-proxy-temp-path=/var/lib/nginx/proxy –http-scgi-temp-path=/var/lib/nginx/scgi –http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-debug --with-pcre-jit –with-ipv6 --with-http\_ssl\_module --with-http\_stub\_status\_module –with-http\_realip\_module --with-http\_auth\_request\_module –with-http\_addition\_module --with-http\_dav\_module –with-http\_geoip\_module –with-http\_gzip\_static\_module --with-http\_image\_filter\_module –with-http\_spdy\_module --with-http\_sub\_module --with-http\_xslt\_module –with-mail --with-mail\_ssl\_module –add-module=/tmp/buildd/nginx-1.6.2/debian/modules/nginx-auth-pam –add-module=/tmp/buildd/nginx-1.6.2/debian/modules/nginx-dav-ext-module –add-module=/tmp/buildd/nginx-1.6.2/debian/modules/nginx-echo –add-module=/tmp/buildd/nginx-1.6.2/debian/modules/nginx-upstream-fair –add-module=/tmp/buildd/nginx-1.6.2/debian/modules/ngx\_http\_substitutions\_filter\_module ## One problem I see here is that you need to place the modules added there in their exact path like for example /tmp/buildd/nginx-1.6.2/debian/modules/nginx-upstream-fair .Otherwise you will have to modify those path accordingly. you need to install build deps for nginx too Also you might be able to use 1.8.0 stable version Follow - > **[How To Add ngx\_pagespeed Module to Nginx in Debian Wheezy | DigitalOcean](https://www.digitalocean.com/community/tutorials/how-to-add-ngx_pagespeed-module-to-nginx-in-debian-wheezy)** > > In this tutorial, you are going to add ngx\_pagespeed module to nginx by building it from Debian wheezy backport source, because Debian backports repository h… . The difference is you are adding mod\_sec instead of pagespeed . ---
**Author:** ![Thierry](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/65b543/32.png) [@Thierry](https://www.ruby-forum.com/u/Thierry)\ **Post date:** [December 23, 2015, 7:38pm UTC](https://www.ruby-forum.com/t/nginx-modsecurity-on-debian-8/243704/9 "2015-12-23T19:38:56Z")
Bonjour nanaya, Ok, but if I recompile everything, do I lose the actual nginx’s config ? Le mercredi 23 dcembre 2015 19:33:11, vous criviez : > On Thu, Dec 24, 2015, at 02:31, Thierry wrote: > > > Bonjour Alt, > > > > Thx a lot … But, I might mistaken … > > My nginx is already working, as already been compiled with a certain > > number of modules … I do not want to break something … > > If I am doing what you said … It might happen no ? > nginx doesn’t have support for loadable modules yet so any modules you > want to add/remove requires recompiling nginx. > * * * > > nginx mailing list > [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > [mailman.nginx.org archive](http://mailman.nginx.org/mailman/listinfo/nginx) – Cordialement, Thierry e-mail : [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![Thierry](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/65b543/32.png) [@Thierry](https://www.ruby-forum.com/u/Thierry)\ **Post date:** [December 23, 2015, 6:33pm UTC](https://www.ruby-forum.com/t/nginx-modsecurity-on-debian-8/243704/10 "2015-12-23T18:33:31Z")
On Thu, Dec 24, 2015, at 02:31, Thierry wrote: > Bonjour Alt, > > Thx a lot … But, I might mistaken … > My nginx is already working, as already been compiled with a certain > number of modules … I do not want to break something … > If I am doing what you said … It might happen no ? nginx doesn’t have support for loadable modules yet so any modules you want to add/remove requires recompiling nginx. ---
**Author:** ![Thierry](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/65b543/32.png) [@Thierry](https://www.ruby-forum.com/u/Thierry)\ **Post date:** [December 23, 2015, 10:30pm UTC](https://www.ruby-forum.com/t/nginx-modsecurity-on-debian-8/243704/11 "2015-12-23T22:30:41Z")
Hello again 🙂 As said in my last message, in theory you shouldn’t lose your configuration. But : backup, backup and backup 🙂 And compile and test on a test server, not on a production server 🙂 Best Regards. Posted at Nginx Forum: > **[Re: nginx modsecurity on Debian 8](https://forum.nginx.org/read.php?2,263657,263677#msg-263677)** > > Hi, A bit lost ... I know nothing concerning nginx, I am more confortable with Apache2. I am using an email server who is using nginx on debian 8. I would need to install modsecurity as module. I have understood that I need to compile from the... ---
**Author:** ![Thierry](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/65b543/32.png) [@Thierry](https://www.ruby-forum.com/u/Thierry)\ **Post date:** [December 23, 2015, 10:27pm UTC](https://www.ruby-forum.com/t/nginx-modsecurity-on-debian-8/243704/12 "2015-12-23T22:27:45Z")
Hello Thierry, Just rebuilding a Debian package and installing it shouldn’t break anything. But a problem or mistake can always happen, so I don’t recommend doing eveything I said in my previous message on your production server. I don’t think you want to spend your XMas fixing your server 🙂 So compile, package and test nginx on a test server (a virtual machine for example). And anyway, you really must have a backup of your production server (with all your config files), because shit can happen (mistake of an admin, hardware failure, a hack,…) and you could lose everything. If you want to keep the modules already compiled in, you should add ModSecurity to the same flavor you used on your server. If you installed the package “nginx-full” flavor, you should add ModSecurity to “nginx-full”, rebuild the packages and install your new “nginx-full.deb”. Best Regards. Posted at Nginx Forum: > **[Re: nginx modsecurity on Debian 8](https://forum.nginx.org/read.php?2,263657,263676#msg-263676)** > > Hi, A bit lost ... I know nothing concerning nginx, I am more confortable with Apache2. I am using an email server who is using nginx on debian 8. I would need to install modsecurity as module. I have understood that I need to compile from the...