File: //etc/httpd/conf/modsec2.conf
LoadFile /usr/lib64/libxml2.so.2
LoadFile /usr/lib64/liblua-5.1.so
LoadModule security2_module modules/mod_security2.so
<IfModule mod_security2.c>
SecRuleEngine On
# See http://www.modsecurity.org/documentation/ModSecurity-Migration-Matrix.pdf
# "Add the rules that will do exactly the same as the directives"
# SecFilterCheckURLEncoding On
# SecFilterForceByteRange 0 255
SecRequestBodyAccess Off
# SecRequestBodyLimit 134217728
# SecRequestBodyNoFilesLimit 134217728
SecResponseBodyAccess Off
SecResponseBodyMimeType (null) text/html text/plain text/xml
SecResponseBodyLimit 2621440
SecServerSignature Apache
SecComponentSignature 201001051959
SecUploadDir /var/asl/data/suspicious
SecUploadKeepFiles Off
SecAuditEngine off
# SecAuditEngine RelevantOnly
# SecAuditLogRelevantStatus "^(?:5|4(?!04))"
# SecAuditLogType Concurrent
# SecAuditLog logs/modsec_audit.log
SecAuditLogParts ABIFHZ
SecArgumentSeparator "&"
SecCookieFormat 0
SecRequestBodyInMemoryLimit 131072
SecDataDir /var/asl/data/msa
SecTmpDir /tmp
SecAuditLogStorageDir /var/asl/data/audit
SecResponseBodyLimitAction ProcessPartial
SecDataDir /var/asl/data/msa
SecDefaultAction "phase:2,deny,log,status:406"
SecRule REMOTE_ADDR "^127.0.0.1$" nolog,allow,id:1500000
Include "/usr/local/apache/conf/modsec2.user.conf"
</IfModule>