Package: libapache2-mod-security2
Version: 2.9.1-2~bpo8+1
Severity: important
Tags: patch
Dear Maintainer,
When installing the Jessie-backports version of libapache2-mod-security2 on
Debian Jessie, my apache2 service fails to restart with the following error:
Reloading web server: apache2 failed!
The apache2 configtest failed. Not doing anything. ... (warning).
Output of config test was:
apache2: Syntax error on line 141 of /etc/apache2/apache2.conf: Syntax error
on line 13 of /etc/apache2/mods-enabled/security2.conf:
Could not open configuration file /usr/share/modsecurity-crs/owasp-crs.load:
No such file or directory
Action 'configtest' failed.
If I install the Jessie-backports version of the modsecurity-crs package, the
required owasp-crs.load file is installed, but I do not want to use it.
The /etc/apache2/mods-enabled/security2.conf file contains the line:
IncludeOptional /usr/share/modsecurity-crs/owasp-crs.load
According to the Apache2.4 documentation, the IncludeOptional directive will
only be silently ignored if wildcards do not match.
I propose changing the configuration as follows:
- IncludeOptional /usr/share/modsecurity-crs/owasp-crs.load
+ IncludeOptional /usr/share/modsecurity-crs/*.load
This allows apache2 to reload as required.
-- System Information:
Debian Release: stretch/sid
APT prefers yakkety-updates
APT policy: (500, 'yakkety-updates'), (500, 'yakkety-security'), (500,
'yakkety'), (100, 'yakkety-backports')
Architecture: i386 (i686)
Kernel: Linux 4.8.0-59-generic (SMP w/4 CPU cores)
Locale: LANG=en_ZA.UTF-8, LC_CTYPE=en_ZA.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
--- a/debian/security2.conf
+++ b/debian/security2.conf
@@ -9,5 +9,5 @@
IncludeOptional /etc/modsecurity/*.conf
# Include OWASP ModSecurity CRS rules if installed
- IncludeOptional /usr/share/modsecurity-crs/owasp-crs.load
+ IncludeOptional /usr/share/modsecurity-crs/*.load
</IfModule>
