Adding ModSecurity to CloudPanel.io

apt update && apt -y upgrade && apt -y install curl wget sudo
curl -sSL https://installer.cloudpanel.io/ce/v1/install.sh | sudo bash

apt-get install libtool autoconf build-essential libpcre3-dev zlib1g-dev libssl-dev libxml2-dev libgeoip-dev liblmdb-dev libyajl-dev libcurl4-openssl-dev libpcre++-dev pkgconf libxslt1-dev libgd-dev automake

cd /opt/
# The correct command for downloading the latest Libmodsecurity source code
git clone --depth 100 -b v3/master --single-branch https://github.com/SpiderLabs/ModSecurity
cd ModSecurity
git submodule init
git submodule update

# Generate configure file
sh build.sh
# Pre compilation step. Checks for dependencies
./configure
# Compiles the source code
make
# grab a Coffee! That's going to take its time.
# Installs the Libmodsecurity to **/usr/local/modsecurity/lib/libmodsecurity.so**
make install

cd /opt/
# Fetch the Nginx source code. See the directory: **http://nginx.org/download/** for all versions of Nginx
wget http://nginx.org/download/nginx-1.18.0.tar.gz
# Extract the downloaded source code
gunzip nginx-1.18.0.tar.gz
tar -xvf nginx-1.18.0.tar
rm nginx-1.18.0.tar
# Fetch the source code for ModSecurity-nginx connector
git clone https://github.com/SpiderLabs/ModSecurity-nginx
# Change directory to the Nginx source code
cd nginx-1.18.0/
# Compile the Nginx 
./configure --with-cc-opt='-g -O2 -fdebug-prefix-map=/home/clp/packaging/nginx/tmp/nginx-1.18.0=. -fstack-protector-strong -Wformat -Werror=format-security -fPIC -Wdate-time -D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-z,relro -Wl,-z,now -fPIC' --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --modules-path=/usr/lib/nginx/modules --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-debug --with-pcre-jit --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_v2_module --with-http_dav_module --with-http_slice_module --with-threads --with-http_addition_module --with-http_geoip_module=dynamic --with-http_gunzip_module --with-http_gzip_static_module --with-http_image_filter_module=dynamic --with-http_sub_module --with-http_xslt_module=dynamic --with-stream=dynamic --with-stream_ssl_module --with-stream_ssl_preread_module --with-mail=dynamic --with-mail_ssl_module  --add-dynamic-module=/opt/ModSecurity-nginx
# Generate the module
make modules
# Copy the module to the Nginx module directory
cp objs/ngx_http_modsecurity_module.so /usr/share/nginx/modules

# Create the modsec folder in the Nginx configuration folder. It will contain the ModSec rules
mkdir /etc/cloudpanel/services/clp-nginx/modsec
# Change directory
cd /etc/cloudpanel/services/clp-nginx/modsec
# Download the rules
git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git
# Rename the default ModSecurity rules configuration file
mv /etc/cloudpanel/services/clp-nginx/modsec/owasp-modsecurity-crs/crs-setup.conf.example /etc/cloudpanel/services/clp-nginx/modsec/owasp-modsecurity-crs/crs-setup.conf

# Copy the default ModSecurity configuration file to the modesec folder
cp /opt/ModSecurity/modsecurity.conf-recommended /etc/cloudpanel/services/clp-nginx/modsec/modsecurity.conf
# Create a configuration file that will be loaded by Nginx. This file will load the ModSec rules configuration file and the ModSec configuration file
nano /etc/cloudpanel/services/clp-nginx/modsec/main.conf
# Add following lines to the file
Include /etc/cloudpanel/services/clp-nginx/modsec/modsecurity.conf
Include /etc/cloudpanel/services/clp-nginx/modsec/owasp-modsecurity-crs/crs-setup.conf
SecRuleRemoveById 933100
SecRuleRemoveById 933120
Include /etc/cloudpanel/services/clp-nginx/modsec/owasp-modsecurity-crs/rules/*.conf

nano /etc/cloudpanel/services/clp-nginx/modules-enabled/50-mod-http-modsecurity.conf
# Add the following lin
load_module modules/ngx_http_modsecurity_module.so;
# Edit next file
nano /etc/cloudpanel/services/clp-nginx/nginx.conf
# Add the following line to the file, after: worker_rlimit_nofile 8192 - should be Line 5
include /etc/cloudpanel/services/clp-nginx/modules-enabled/*.conf;
## Enable for the CloudPanel
nano /etc/cloudpanel/services/clp-nginx/sites-enabled/cloudpanel.conf
# Add following lines to the file, after:   server_name _ - should be Line 3&4
modsecurity on;
modsecurity_rules_file /etc/cloudpanel/services/clp-nginx/modsec/main.conf;

chown -R clp-admin /etc/cloudpanel/services/clp-nginx/modsec/
chgrp -R clp /etc/cloudpanel/services/clp-nginx/modsec/
chown clp-admin /etc/cloudpanel/services/clp-nginx/nginx.conf
chgrp clp /etc/cloudpanel/services/clp-nginx/nginx.conf
# Restart Nginx
systemctl restart clp-nginx
# If you see an error that mentions missing **unicode.mapping** file, then copy the file to the mod sec folder
cp /opt/ModSecurity/unicode.mapping /etc/cloudpanel/services/clp-nginx/modsec/
# Check Process with
systemctl status clp-nginx
# If the process did not start check:
cat /var/log/syslog

nano /etc/cloudpanel/services/clp-nginx/modsec/modsecurity.conf
## Change DetectionOnly to On
#SecRuleEngine DetectionOnly
SecRuleEngine On

curl https://YOURIP:8443/login --insecure -H "custom:() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd"

<head><title>403 Forbidden</title></head>