Issue Problem with modsecurity - modsecurity_ctl failed

[Alfonzo12]

Server operating system version

Ubuntu 18.04.6 LTS

Plesk version and microupdate number

Plesk Obsidian Web Admin Edition 18.0.52 Update #3

Hello,

This morning we had a 502 error on our website, after a reboot and using the repair tool, the site was online again.

From last 5 this morning i get the following mail:

Cron <root@h2913878> cd / && run-parts --report /etc/cron.hourly

/etc/cron.hourly/asl:

Error: ASL has not been configured

run-parts: /etc/cron.hourly/asl exited with return code 1



Modsecurity does not activate anymore and gives the following error:



modsecurity_ctl failed: START httpd_modules_ctl --enable security2,unique_id
Enabling module security2.
To activate the new configuration, you need to run: systemctl restart apache2
Module unique_id already enabled
apache_control_adapter[5068]: apache_action(restart): invoke_httpd_action failed, trying second time
INFO: [Thu Jul 27 11:14:31 CEST 2023]:
Service: apache, Action: start Trying to start service apache2... failed Jul 27 11:14:31 h2913878.stratoserver.net systemd[1]:
Starting The Apache HTTP Server... Jul 27 11:14:31 h2913878.stratoserver.net apachectl[5410]: AH00526: Syntax error on line 24 of /etc/apache2/modsecurity.d/rules/tortix/modsec/tortix_waf.conf: Jul 27 11:14:31 h2913878.stratoserver.net apachectl[5410]: ModSecurity: failed to load IPs from: /etc/asl/whitelist Could not open ipmatch file "/etc/asl/whitelist":
No such file or directory Jul 27 11:14:31 h2913878.stratoserver.net apachectl[5410]: Action 'start' failed. Jul 27 11:14:31 h2913878.stratoserver.net apachectl[5410]:
The Apache error log may have more information. Jul 27 11:14:31 h2913878.stratoserver.net systemd[1]: apache2.service: Control process exited, code=exited status=1 Jul 27 11:14:31 h2913878.stratoserver.net systemd[1]: apache2.service: Failed with result 'exit-code'. Jul 27 11:14:31 h2913878.stratoserver.net systemd[1]: Failed to start The Apache HTTP Server. Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable. ***** problem report ***** Warning: start service apache2 failed /opt/psa/admin/sbin/pleskrc execution failed: Job for apache2.service failed because the control process exited with error code. See "systemctl status apache2.service" and "journalctl -xe" for details. /opt/psa/admin/sbin/pleskrc execution failed: Job for apache2.service failed because the control process exited with error code. See "systemctl status apache2.service" and "journalctl -xe" for details.

Please help

 

[Peter Debik]

Please try the solution from this article:

https://support.plesk.com/hc/en-us/articles/14801826549527

 

[King555]

I have exactly the same problem. See also this posting and the following ones: Issue - ModSecurity/AtomicCorp: Get rid of "N: Skipping acquire of configured file [...] doesn't support architecture 'i386'" (apt update)

 

[Alfonzo12]

Thank you for the reply. I followed the instructions from Peter Debik and the erros above are gone. But now i get the following error:

modsecurity_ctl failed: [Errno 2] No such file or directory: '/var/asl/bin/aum': '/var/asl/bin/aum'

On the server there is no /bin/aum only the '/var/asl/ folder

 

[Peter Debik]

Maybe switching to Comodo ruleset and then back to Atomic can fix this. I am not perfectly sure. It's about a path change that Atomic did this spring, and that change caused lots of similar, but different error situations. Probably deinstalling their ruleset and reinstalling it will help, so switching rulesets might be a solution.

 

[Alfonzo12]

Switched to comodo and then back, but it gives the same error and stays on comodo now. Is there anyway to reinstall atomic? Or wil comodo do? and if so, can we switch of the cronmail of asl:

/etc/cron.hourly/asl:

Error: ASL has not been configured

run-parts: /etc/cron.hourly/asl exited with return code 1

We using comodo but still getting that mail

 

[Peter Debik]

To remove Atomic:

1) Remove Modsecurity
# plesk installer --select-release-current --remove-component modsecurity

2) Uninstall AUM package:
# yum remove aum

3) Re-install Plesk ModSecurity:
# plesk installer --select-release-current --install-component modsecurity

 

[King555]

@Alfonzo12 Did you have any success concerning this? I still cannot activate the Atomic ruleset. I followed every suggestion from this thread, from my thread (see link in post #3) and the support article (link in post #2).

 

[Alfonzo12]

We have not been able to solve the problem yet, currently we are running Comodo instead of atomic.