{"id":797,"date":"2014-06-05T09:09:26","date_gmt":"2014-06-05T02:09:26","guid":{"rendered":"http:\/\/masrifqi.staff.ugm.ac.id\/?p=797"},"modified":"2014-06-05T09:09:26","modified_gmt":"2014-06-05T02:09:26","slug":"instalasi-mod_security-di-centos-linux-5-x","status":"publish","type":"post","link":"http:\/\/masrifqi.staff.ugm.ac.id\/index.php\/2014\/06\/instalasi-mod_security-di-centos-linux-5-x\/","title":{"rendered":"Instalasi mod_security di CentOS Linux 5.x"},"content":{"rendered":"<h4>Instalasi mod_security di CentOS Linux 5.x<\/h4>\n<p>Seperti biasa, dapet temuan ngurusin server yang sistemnya lumayan &#8220;tua&#8221;, jadi ceritanya dapet laporan ini mesin vulnerable, mau di update takut aplikasinya berantakan, karena celahnya adanya di aplikasi web, lebih spesifiknya mysql injection maka akhirnya coba di pasang mod_security aja dulu, Bagi yang belum tau apa itu mod_security, berikut sedikit kutipan yang saya ambil dari inmotionhosting.com<\/p>\n<blockquote><p>Mod_security is an apache module that helps to protect your website from various attacks. Mod_Security is used to block commonly known exploits by use of regular expressions and rule sets. Mod_Security is enabled on all InMotion Servers by default. Mod_Security can potentially block common code injection attacks which strengthens the security of the server<\/p><\/blockquote>\n<p><!--more--><\/p>\n<p>Untuk menginstall mod_security di centos linux, langkah pertamanya tentunya install dulu aplikasinya, karena paket mod_security nya tidak tersedia secara default di centos maka terlebih dahulu kita tambahkan dulu reposirotynya (epel repo), pertama download dulu paket epel repo<br \/>\n<code><br \/>\nwget http:\/\/kartolo.sby.datautama.net.id\/EPEL\/5\/i386\/epel-release-5-4.noarch.rpm<br \/>\n<\/code><br \/>\nlanjutkan dengan menginstall paketnya<br \/>\n<code><br \/>\nsudo rpm -ivh epel-release-5-4.noarch.rpm<br \/>\n<\/code><br \/>\nsetelah repository epel repo terinstall, lanjutkan dengan instalasi mod_security<br \/>\n<code><br \/>\nsudo yum -y install mod_security<br \/>\n<\/code><br \/>\nUntuk mengecek paket mod_security yang sudah terinstall jalankan perintah berikut<br \/>\n<code><br \/>\nsudo rpm -ql mod_security<br \/>\n<\/code><br \/>\noutput<br \/>\n<code><br \/>\n\/etc\/httpd\/conf.d\/mod_security.conf<br \/>\n\/etc\/httpd\/modsecurity.d<br \/>\n\/etc\/httpd\/modsecurity.d\/activated_rules<br \/>\n\/usr\/lib\/httpd\/modules\/mod_security2.so<br \/>\n\/usr\/share\/doc\/mod_security-2.6.8<br \/>\n\/usr\/share\/doc\/mod_security-2.6.8\/CHANGES<br \/>\n\/usr\/share\/doc\/mod_security-2.6.8\/LICENSE<br \/>\n\/usr\/share\/doc\/mod_security-2.6.8\/NOTICE<br \/>\n\/usr\/share\/doc\/mod_security-2.6.8\/README.TXT<br \/>\n\/var\/lib\/mod_security<br \/>\n<\/code><br \/>\nFile konfigurasi mod_security ada pada file<br \/>\n<code><br \/>\n\/etc\/httpd\/conf.d\/mod_security.conf<br \/>\n<\/code><br \/>\nuntuk memastikan mod_security sudah aktif, cek pada bagian ini<br \/>\n<code><br \/>\nSecRuleEngine On<br \/>\n<\/code><br \/>\nTerakhir, jalankan ulang service httpd nya<br \/>\n<code><br \/>\n\/etc\/init.d\/httpd restart<br \/>\n<\/code><br \/>\nHasil output log mod_security akan di log disini<br \/>\n<code><br \/>\nSecAuditLog \/var\/log\/httpd\/modsec_audit.log<br \/>\n<\/code><br \/>\nDan untuk menganalisa insiden-insiden yang terjadi di server, semuanya akan di log pada file log di atas.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Instalasi mod_security di CentOS Linux 5.x Seperti biasa, dapet temuan ngurusin server yang sistemnya lumayan &#8220;tua&#8221;, jadi ceritanya dapet laporan ini mesin vulnerable, mau di update takut aplikasinya berantakan, karena celahnya adanya di aplikasi web, lebih spesifiknya mysql injection maka &hellip;<\/p>\n<p class=\"read-more\"><a href=\"http:\/\/masrifqi.staff.ugm.ac.id\/index.php\/2014\/06\/instalasi-mod_security-di-centos-linux-5-x\/\">Read more &raquo;<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[16,2,10,9],"tags":[],"_links":{"self":[{"href":"http:\/\/masrifqi.staff.ugm.ac.id\/index.php\/wp-json\/wp\/v2\/posts\/797"}],"collection":[{"href":"http:\/\/masrifqi.staff.ugm.ac.id\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/masrifqi.staff.ugm.ac.id\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/masrifqi.staff.ugm.ac.id\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/masrifqi.staff.ugm.ac.id\/index.php\/wp-json\/wp\/v2\/comments?post=797"}],"version-history":[{"count":3,"href":"http:\/\/masrifqi.staff.ugm.ac.id\/index.php\/wp-json\/wp\/v2\/posts\/797\/revisions"}],"predecessor-version":[{"id":800,"href":"http:\/\/masrifqi.staff.ugm.ac.id\/index.php\/wp-json\/wp\/v2\/posts\/797\/revisions\/800"}],"wp:attachment":[{"href":"http:\/\/masrifqi.staff.ugm.ac.id\/index.php\/wp-json\/wp\/v2\/media?parent=797"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/masrifqi.staff.ugm.ac.id\/index.php\/wp-json\/wp\/v2\/categories?post=797"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/masrifqi.staff.ugm.ac.id\/index.php\/wp-json\/wp\/v2\/tags?post=797"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}