However, we could still improve on this. Additional measures do have potential false positive issues (e.g. initial issues with mod_evasive in v18.0) - so we should be careful of what we enable by default and should document it regardless.
A couple of specific ideas are:
Enable additional/default mod_security2 config. I.e. something like this:
This is potentially more risky as while it does have some default rules which configure for specific apps, there is a risk that there may be false positives for specific apps not explicitly accounted for.
Perhaps initially we could enable it for the software that has specific config and document it for others?
This applies to LAMP/LAPP and all dependent apps.
We have some Apache security measures installed and enabled by default. See:
However, we could still improve on this. Additional measures do have potential false positive issues (e.g. initial issues with mod_evasive in v18.0) - so we should be careful of what we enable by default and should document it regardless.
A couple of specific ideas are:
Enable additional/default mod_security2 config. I.e. something like this:
From my reading this is low risk as the default/example config provided by Debian is set to detected only. Thus minimizing risk of negative impacts.
Consider Installing
modsecurity-crs- "OWASP ModSecurity Core Rule Set"This is potentially more risky as while it does have some default rules which configure for specific apps, there is a risk that there may be false positives for specific apps not explicitly accounted for.
Perhaps initially we could enable it for the software that has specific config and document it for others?