# Mod\_security and/or firewall for new setup **URL:** \ **Category:** Virtualmin\ **Created:** [January 4, 2023, 5:55pm UTC](https://forum.virtualmin.com/t/mod-security-and-or-firewall-for-new-setup/118467 "2023-01-04T17:55:08Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![changlee13](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/changlee13/32/7669_2.png) [@changlee13](https://forum.virtualmin.com/u/changlee13)\ **Post date:** [January 4, 2023, 5:55pm UTC](https://forum.virtualmin.com/t/mod-security-and-or-firewall-for-new-setup/118467/1 "2023-01-04T17:55:08Z")
Hello virtualminers, I am new to Virtualmin and I come from cPanel and CWP. I was using mod\_security for many years. Now I can not locate such a function but I see many other apps at the Networking area. I am now going to transfer my first wordpress, opencart and Joomla sites. Is there anything that I have to do for security? Or Virtualmin rocks from the scratch of the setup? Please advise. | SYSTEM INFORMATION | | | --- | --- | | CentOS Linux 7.9.2009 | REQUIRED | | 2.001 | REQUIRED | | 7.3 Pro | REQUIRED | | Related packages | SUGGESTED | ---
**Author:** ![Joe](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/joe/32/9_2.png) [@Joe](https://forum.virtualmin.com/u/Joe)\ **Post date:** [January 4, 2023, 6:43pm UTC](https://forum.virtualmin.com/t/mod-security-and-or-firewall-for-new-setup/118467/2 "2023-01-04T18:43:47Z")
mod\_security is not related to network configuration. But, there is no mod\_security GUI in Virtualmin. Nothing stops you from enabling it, though. It’s a one-time thing; just install the package and turn it on (and configure it to use the rule sets you want to use, like the OWASP rules). mod\_security is of marginal utility in a system that is well-maintained, but can be useful if you have old apps. mod\_security is almost entirely a reactive solution; the rules are mostly based on past attacks, which have usually already been fixed in the software the attacks target. But, since most people aren’t very good at staying up to date, I’ve come around to thinking mod\_security is pretty useful, and we’ll be adding it as a Pro feature in Virtualmin 8. ---
**Author:** ![RJM\_Web\_Design](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/rjm_web_design/32/1457_2.png) [@RJM\_Web\_Design](https://forum.virtualmin.com/u/RJM_Web_Design)\ **Post date:** [January 4, 2023, 9:11pm UTC](https://forum.virtualmin.com/t/mod-security-and-or-firewall-for-new-setup/118467/3 "2023-01-04T21:11:17Z")
I personally like CSF with some pretty tight lfd settings; but the default firewall settings in most Linux distros, plus fail2ban (installed by default with Virtualmin), provide decent security. If you decide to install and enable ModSec, be careful with the rule sets as regards your payment gateways. The developer of my invoicing software and I wasted two days after an update trying to figure out what was causing the Stripe payment plugin to error out after every charge was processed. It turned out that cPanel’s default rule set for ModSec was killing the Stripe script _after_ the payments had been processed by Stripe, and dumping the users on an error page rather than the confirmation page. I just disabled ModSec and never bothered with it again. I never had a whole lot of confidence in it anyway. But if you do choose to use it, I suggest testing all your carts and payment gateways to make sure they work, and doing it again after updates. By the way, ModSec is an Apache module, not a network firewall. Richard ---
**Author:** ![Joe](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/joe/32/9_2.png) [@Joe](https://forum.virtualmin.com/u/Joe)\ **Post date:** [January 4, 2023, 9:48pm UTC](https://forum.virtualmin.com/t/mod-security-and-or-firewall-for-new-setup/118467/4 "2023-01-04T21:48:23Z")
Yeah, I think it’s worth being clear that mod\_security is what is often referred to as a “web application firewall”, but it does not operate at the same layer of the network stack as a traditional firewall. You should not group the two concepts together when discussing what you need to address a given threat model, and there is almost no overlap in what a network firewall can prevent vs what a web application firewall can prevent. Firewalls are one thing, and Virtualmin sets up a basic Firewalld firewall for you and provides a GUI for it, so you can add whatever additional rules you like. That is wholly orthogonal to mod\_security, which is a layer 7 rule-based tool for preventing some kinds of web application attacks. Firewalls (like Firewalld or CSF) are of limited utility in a server environment. Tools that actively monitor behavior and add rules (like Fail2ban, which Virtualmin includes and has a GUI for, or sshguard or I think CSF has its own similar thing) based on things that look like attacks are very useful, though. Web application firewalls (like mod\_security) are also of limited utility in an up-to-date well-maintained system. ---
**Author:** ![RJM\_Web\_Design](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/rjm_web_design/32/1457_2.png) [@RJM\_Web\_Design](https://forum.virtualmin.com/u/RJM_Web_Design)\ **Post date:** [January 4, 2023, 10:26pm UTC](https://forum.virtualmin.com/t/mod-security-and-or-firewall-for-new-setup/118467/5 "2023-01-04T22:26:20Z")
> [@Joe](#): > > I think CSF has its own similar thing) based on things that look like attacks are very useful, though. Yep. In CSF it’s called `lfd`, for **l** ogin **f** ailure **d** aemon. It’s pretty similar in function to `fail2ban`, which is why I don’t bother enabling both on the same server. `lfd` can block individual IP’s or ranges based on user-determined criteria, for user-specified lengths of time. It can also convert persistent offenders from tempblock to permblock; execute external scripts to create block reports or unblock reports; notify the admin of failed and/or successful SSH logins, Webmin logins, and `sudo` elevations; and perform many, many other security functions. All of those are in addition to the basic security provided by the main `csf` application, which includes functions like process tracking, system file integrity checking, mail volume monitoring, blocking based on public RBL’s, and a bazillion other user-configurable security functions. It’s a firewall, but it’s also much more. I updated PHP 8.1 on six servers today (five production and one dev); and within a few minutes I received six emails and six text messages from CSF warning me that the files had changed. It also can inform root when users upload root-defined kinds of scripts, such as any script that sends mail; or when a user is sending out more mail in a given time period than some number specified by root. It really is comprehensive. It does take some time to learn if you want to maximize its usefulness. It also requires some version of `syslog`. I usually use `rsyslog`, but `syslog-ng` will also work. Richard ---
**Author:** ![changlee13](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/changlee13/32/7669_2.png) [@changlee13](https://forum.virtualmin.com/u/changlee13)\ **Post date:** [January 5, 2023, 11:07am UTC](https://forum.virtualmin.com/t/mod-security-and-or-firewall-for-new-setup/118467/6 "2023-01-05T11:07:54Z")
Thank you so much for your replies. So, if I got it, lets say that I am publishing only new and frequently updated website/eshops like wordpress, opencart and prestashop. I am asking especially the old masters of Virtualmin: At my fresh installation of Virtualmin/Networking **a)** is there any custom or other installation of security module/application that I have to accomplish? OR **b)** a I am secure with that initial setup? Thanks again. ---
**Author:** ![calport](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/calport/32/44_2.png) [@calport](https://forum.virtualmin.com/u/calport)\ **Post date:** [January 5, 2023, 5:48pm UTC](https://forum.virtualmin.com/t/mod-security-and-or-firewall-for-new-setup/118467/7 "2023-01-05T17:48:45Z")
> [@changlee13](#): > > is there any custom or other installation of security On a new Virtualmin system: 1. configure mail rate limiting to limit damage that can be done by spammers who gain unauthorised access to user accounts 2. configure fail2ban to thwart brute force attacks 3. use only php-fpm as execution mode on all virtual servers to keep the system isolated from virtual servers that will be compromised That’s about it. Edit: Virtualmin 7 offers several security enhancements. Someone should highlight these. ---
**Author:** ![Joe](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/joe/32/9_2.png) [@Joe](https://forum.virtualmin.com/u/Joe)\ **Post date:** [January 5, 2023, 6:08pm UTC](https://forum.virtualmin.com/t/mod-security-and-or-firewall-for-new-setup/118467/8 "2023-01-05T18:08:57Z")
> [@changlee13](#): > > a I am secure with that initial setup? Thanks again. Nobody is ever secure. The internet is an evolving threat. ---
**Author:** ![stefan1959](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/s/49beb7/32.png) [@stefan1959](https://forum.virtualmin.com/u/stefan1959)\ **Post date:** [January 5, 2023, 9:36pm UTC](https://forum.virtualmin.com/t/mod-security-and-or-firewall-for-new-setup/118467/9 "2023-01-05T21:36:42Z")
are you using key based logins (only) for SSH? First things I do when I create a VM. ---
**Author:** ![changlee13](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/changlee13/32/7669_2.png) [@changlee13](https://forum.virtualmin.com/u/changlee13)\ **Post date:** [January 6, 2023, 1:30pm UTC](https://forum.virtualmin.com/t/mod-security-and-or-firewall-for-new-setup/118467/10 "2023-01-06T13:30:07Z")
Thanks for that. Do you have tutorials for each one please how to accomplish? ---
**Author:** ![changlee13](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/changlee13/32/7669_2.png) [@changlee13](https://forum.virtualmin.com/u/changlee13)\ **Post date:** [January 6, 2023, 1:32pm UTC](https://forum.virtualmin.com/t/mod-security-and-or-firewall-for-new-setup/118467/11 "2023-01-06T13:32:25Z")
Life is also insecure. I mentioned that I come from cPanel, CWP and they offer some presetup with firewall and/or mod\_security For example CWP PRO offers mod\_security with automated updates and automatic rules for wordpress, joomla etc I now have installed Virtualmin Pro. And I ask **do I have to make some security essentials before publish an updated wordpress website**? ---
**Author:** ![system](https://cdn.forum.virtualmin.com/uploads/default/original/2X/c/cd96d761e326db4b2bef94886a639109bd7a8e76.svg) [@system](https://forum.virtualmin.com/u/system)\ **Post date:** [March 7, 2023, 1:32pm UTC](https://forum.virtualmin.com/t/mod-security-and-or-firewall-for-new-setup/118467/12 "2023-03-07T13:32:32Z")
Closed on March 7, 2023, 1:32pm UTC This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.