Question New Install of ModSecurity

[Scott.B]

First I would like to say I have very limited knowledge when it comes to Linux and I can make my way around Plesk fairly well. However by no means am I an expert on either system.

With that being said I went to setup ModSecurity on my plesk 12.5.30 Update #60 install.

I installed the application just fine and per the Plesk documentation https://docs.plesk.com/en-US/onyx/a...n/web-application-firewall-modsecurity.73383/

It states to run these commands from the shell if you are going to use the Atomic Ruleset which I am using.

aum -u
plesk sbin modsecurity_ctl --disable
plesk sbin modsecurity_ctl –enable
service httpd restart

Which I did, however when I ran the aum -u command the first time I got the following error

[root@u16271698 /]# aum -u

Checking versions ...

Updating asl components
(this may take several minutes)
Updating ASL Core: successful [PASS]
Updating Web Application Firewall to 201703101023: updated [PASS]
Restarting Apache ...
Generating report ...

Finished
-------------------------------------------------------------------------------
Errors were encountered:

L CODE SOURCE MESSAGE
- ---- ----------------------------- ------------------------------------------
2 9901 ASLCommon::cmd_system ERROR: '/bin/cp -af /var/asl/rules/modsec/
template-* /var/asl/data/templates/ >/dev/
null 2>&1 (1)'

Does this mean something wrong went with the install/setup? What should I do to resolve this and ensure it is working properly.

Thank you

 

[Bitpalast]

I have done some tests on this and found that it is a bad idea to manually run "aum -u" unless you are sure that you do not want to use the "Atomic Basic ModSecurity".

Using mod_security with the free Basic set that comes with Plesk does not show that error. The error you have quoted comes from Atomic in connection with the paid ruleset, so you will need to ask them to fix it. According to http://forums.atomicorp.com/viewtopic.php?t=8497&p=43887 there are other users who are experiencing the same. However, that thread is rather old already, and meanwhile there is probably a solution.

@UFHH01 suggests in https://talk.plesk.com/threads/issue-with-atomiccorp-rules-updates.340272/ to upgrade aum. Maybe you can check that one out, too. That thread was marked as "solved", so it has probably worked out for the other user.