[gentoo-user] ModSecurity: Status engine is currently disabled, enable it by set SecStatusEngine to On.

[gentoo-user] ModSecurity: Status engine is currently disabled, enable it by set SecStatusEngine to On.

[thelma]

ModSecurity is installed:
APACHE2_OPTS="-D DEFAULT_VHOST -D INFO -D SSL -D SSL_DEFAULT_VHOST -D LANGUAGE -D PHP -D SECURITY"

In which file I have to enable "SecStatusEngine On" ?

Re: [gentoo-user] ModSecurity: Status engine is currently disabled, enable it by set SecStatusEngine to On.

[Jigme Datse]

On Fri, 18 Dec 2020 18:20:44 -0700
thelma@sys-concept.com wrote:

> ModSecurity is installed:
> APACHE2_OPTS="-D DEFAULT_VHOST -D INFO -D SSL -D SSL_DEFAULT_VHOST -D
> LANGUAGE -D PHP -D SECURITY"
> 
> In which file I have to enable "SecStatusEngine On" ?
> 
> 

Not worked with Apache for a bit, but I think this is needed in your
Apache configuration.  Though I'm not sure if it's per virtual server
or if it's a global option.  

If this isn't helpful, I'm just sitting here waiting for stuff to
happen, and saw your message, and just thought I'd look to see if I can
maybe help.  

Re: [gentoo-user] ModSecurity: Status engine is currently disabled, enable it by set SecStatusEngine to On.

[thelma]

On 12/18/2020 07:51 PM, Jigme Datse wrote:
> On Fri, 18 Dec 2020 18:20:44 -0700
> thelma@sys-concept.com wrote:
> 
>> ModSecurity is installed:
>> APACHE2_OPTS="-D DEFAULT_VHOST -D INFO -D SSL -D SSL_DEFAULT_VHOST -D
>> LANGUAGE -D PHP -D SECURITY"
>>
>> In which file I have to enable "SecStatusEngine On" ?
>>
>>
> 
> Not worked with Apache for a bit, but I think this is needed in your
> Apache configuration.  Though I'm not sure if it's per virtual server
> or if it's a global option.  
> 
> If this isn't helpful, I'm just sitting here waiting for stuff to
> happen, and saw your message, and just thought I'd look to see if I can
> maybe help.  
> 

Looking at FAQ in:
https://github.com/SpiderLabs/ModSecurity/wiki/ModSecurity-Frequently-Asked-Questions-(FAQ)

Should I initially set the SecRuleEngine to On?

No. Every Ruleset can have false positive in new environments and any
new installation should initially use the log only Ruleset version or if
no such version is available, set ModSecurity to Detection only using
the SecRuleEngine DetectionOnly command. After running ModSecurity in a
detection only mode for a while review the evens generated and decide if
any modification to the rule set should be made before moving to
protection mode.