Modsecurity & ModSecurity-nginx Debian 11 help needed.

[Xerud]

Hi Guys, i have a VPS from Hetzner and recently i installed on it HestiaCP and because past week i got a site infected with javascript ads, on a website, i decided to buy and install Imunify360 license for self-hosted, because the panel is not supported by CloudLinux and the other guys from HestiaCP... All good until i got a bit stuck because the docs from imunify site are only for CentOS or AlmaLinux, and the panel has support for debian or ubuntu systems. I tried to find another tut on the internet on how to install and configure modsecurity and modsecurity-nginx module from external source... a black ball for cloudlinux... I might cloned a bad repo from git, or something configured wrong because after i installed Imunify360 i got some nginx segfault errors related to glibc2.31. I tried alot of methods found on the internet to solve the issues and lately i found that the issue is caused by wrong or defective settings or modules of ModSecurity... but on an older version...

Issues · owasp-modsecurity/ModSecurity-nginx

ModSecurity v3 Nginx Connector. Contribute to owasp-modsecurity/ModSecurity-nginx development by creating an account on GitHub.

github.com

Anyone can help me fix it ?

I can`t afford to pay too much for the service, but it will not be totally for free.

 

[Hzura]

well so what you want exactly for this?
if you only need to get rid of the javascript injection
you should check where it come from
and patch it....

rather than doing something else which is "too advance"
me personally normally i using Aapanel or cyberpanel since i only using Openlitespeed.
on past i also had this shitty viruses... the solution for me is replace old code to new code one by ones.... so no more backdoor etc...

it's seems that my "cheap" hosting in the past insert "little" backdoor on every sites that scanned as "Wordpress" that's why i moving to my own vps + using brand new theme
so i can install any of that by myself... yeah it's will take a long time but the result will be good....

i think if the virus come from internal script... they most likely not solved even if you using things that you mentioned above

 

[Raccoon]

Hi Guys, i have a VPS from Hetzner and recently i installed on it HestiaCP and because past week i got a site infected with javascript ads, on a website, i decided to buy and install Imunify360 license for self-hosted, because the panel is not supported by CloudLinux and the other guys from HestiaCP... All good until i got a bit stuck because the docs from imunify site are only for CentOS or AlmaLinux, and the panel has support for debian or ubuntu systems. I tried to find another tut on the internet on how to install and configure modsecurity and modsecurity-nginx module from external source... a black ball for cloudlinux... I might cloned a bad repo from git, or something configured wrong because after i installed Imunify360 i got some nginx segfault errors related to glibc2.31. I tried alot of methods found on the internet to solve the issues and lately i found that the issue is caused by wrong or defective settings or modules of ModSecurity... but on an older version...

Issues · owasp-modsecurity/ModSecurity-nginx

ModSecurity v3 Nginx Connector. Contribute to owasp-modsecurity/ModSecurity-nginx development by creating an account on GitHub.

github.com

Anyone can help me fix it ?

I can`t afford to pay too much for the service, but it will not be totally for free.

my biggest piece of advice to you. It would be to install and use imunify + litespeed + cloudlinux with Plesk panel. very easy to install. it is installed with a single command. here is the link .

Installing Plesk for Linux in One Click

One-click installation is a fast and hassle-free way of getting a Plesk server with default configuration up and runn...

docs.plesk.com

 

[Xerud]

Yes, but plesk license is a bit expensive and cloudlinux it`s also an extra cost per license... if i can find someone that sell it cheaper than the original price, in here maybe i will consider to switch to it...