Step-by-Step Guide to Install BunkerWeb with ModSecurity

Introduction:

BunkerWeb is a powerful web application firewall (WAF) that helps protect your websites from attacks. When combined with ModSecurity, it becomes a robust solution for enhancing website security. In this guide, we’ll walk you through the installation process for BunkerWeb and ModSecurity, including advanced configuration options to further strengthen your security setup.

---

Step 1: Install Prerequisites

Before setting up BunkerWeb and ModSecurity, make sure your server meets the necessary requirements.

1. Server: A Linux-based server (Ubuntu, CentOS, etc.)
2. Web Server: Apache or Nginx (depending on your choice)
3. ModSecurity: A WAF module for Apache or Nginx
4. Git: To clone repositories (if needed)
5. curl & wget: For downloading packages

Install Apache (If not already installed):

sudo apt update
sudo apt install apache2 -y

Install ModSecurity:

sudo apt install libapache2-mod-security2 -y

Step 2: Install BunkerWeb

BunkerWeb is available on GitHub, so you’ll need to clone the repository.

1. Clone BunkerWeb repository:

cd /var/www/
sudo git clone https://github.com/bunkerweb/bunkerweb.git

2. Navigate to the BunkerWeb directory:

cd bunkerweb

3. Install required dependencies:

sudo bash install.sh

4. Configure BunkerWeb settings:
   Edit configuration files as needed for your environment, such as database settings, firewall configurations, etc.

nano /var/www/bunkerweb/config/settings.conf

Step 3: Configure ModSecurity with Apache

Now, let’s configure ModSecurity to work with Apache.

1. Enable ModSecurity module:
   Make sure ModSecurity is enabled in Apache.

sudo a2enmod security2
sudo systemctl restart apache2

2. Edit ModSecurity configuration:
   ModSecurity comes with a basic configuration file. You can enhance this by modifying the ruleset. Open ModSecurity configuration:

sudo nano /etc/apache2/mods-available/security2.conf

3. Activate the OWASP CRS (Core Rule Set) for advanced protection:

• Download and install the OWASP CRS (Core Rule Set):

   cd /usr/share/modsecurity-crs
   sudo git clone https://github.com/coreruleset/coreruleset.git

• Enable CRS:

   sudo cp /usr/share/modsecurity-crs/coreruleset/crs-setup.conf.example /etc/modsecurity/
   sudo cp /usr/share/modsecurity-crs/coreruleset/rules/* /etc/modsecurity/

• Add the following line to security2.conf to include the CRS ruleset:

   IncludeOptional /etc/modsecurity/*.conf

4. Test ModSecurity installation:
   After configuring ModSecurity, restart Apache:

   sudo systemctl restart apache2

Verify the installation by checking Apache’s error log for any errors:

   tail -f /var/log/apache2/error.log

---

Step 4: Test Your Setup

1. Check BunkerWeb’s firewall status:
   Navigate to BunkerWeb’s admin panel to ensure that it’s actively running and protecting your website.
2. Test ModSecurity:
   You can test ModSecurity by attempting to access known attack patterns, like SQL injection or XSS scripts. You should see that the ModSecurity rules block these attempts.

---

Step 5: Advanced Configuration (Optional)

Enable Logging for ModSecurity:

To better monitor and fine-tune your security rules, enable logging for ModSecurity.

1. Edit the ModSecurity configuration file:

sudo nano /etc/modsecurity/modsecurity.conf

2. Set the SecAuditEngine and SecAuditLog directives:

SecAuditEngine On
SecAuditLog /var/log/modsec_audit.log

3. Restart Apache for changes to take effect:

sudo systemctl restart apache2

Customize ModSecurity Rules:

If you want to customize the ModSecurity rules, you can add your own custom rules under /etc/modsecurity/ or modify the crs-setup.conf file to enable or disable specific rules.

nano /etc/modsecurity/crs-setup.conf

For example, to disable a specific rule (e.g., for a false positive), you can comment it out in the configuration file.

Configure BunkerWeb for Better Performance:

BunkerWeb can be optimized for high-traffic environments by configuring its database and firewall settings. Consult the BunkerWeb documentation for performance tweaks and optimizations.

---

Conclusion

With BunkerWeb and ModSecurity properly installed and configured, your website will be significantly more secure against various types of attacks. Regularly update your rulesets, monitor logs, and tweak settings based on the security needs of your web environment.

By following this guide, you’ve taken the first step toward securing your web applications with a reliable firewall solution.