<div dir="ltr">Hi Lukas,<br><br><div><div>You may want to use the ModSecurity's nginx_refactoring branch instead of the master branch. Here is the link to the branch:</div><div><br></div><div><a href="https://github.com/SpiderLabs/ModSecurity/tree/nginx_refactoring">https://github.com/SpiderLabs/ModSecurity/tree/nginx_refactoring</a></div></div><div><br></div><div>Br.,</div><div>Felipe Zimmerle</div><div>Lead dev for ModSecurity<br><div><br></div><div><br><div class="gmail_quote"><div dir="ltr">On Sun, Jan 10, 2016 at 10:39 AM Lukas <<a href="mailto:l@ymx.ch">l@ymx.ch</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Dear all<br>
<br>
Fascinated by nginx, I attempted to integrate it with modsecurity.<br>
<br>
Unfortunately, ever when modsecurity is enabled, nginx reports a<br>
sefault in sysmessages.<br>
<br>
Searching the web did not reveal any solution, i.e. I switched off<br>
SecAudit* and even started modsecurity without rules -- it continued<br>
crashing.<br>
<br>
Thank you for any hint on solving this issue.<br>
<br>
Please find next information related to my setup including some logs.<br>
<br>
wbr, Lukas<br>
<br>
==<br>
<br>
My current setup:<br>
<br>
Platform: Linux/4.3.3 running on Debian/wheezy<br>
<br>
nginx: self-compiled from sources according to<br>
<a href="https://blog.stickleback.dk/nginx-modsec-on-ubuntu-14-04-lts/" rel="noreferrer" target="_blank">https://blog.stickleback.dk/nginx-modsec-on-ubuntu-14-04-lts/</a><br>
<br>
modsecurity: installed and configured according to<br>
<a href="https://www.howtoforge.com/tutorial/install-nginx-with-mod_security-on-ubuntu-15-04/" rel="noreferrer" target="_blank">https://www.howtoforge.com/tutorial/install-nginx-with-mod_security-on-ubuntu-15-04/</a><br>
<br>
Relevant Logs:<br>
<br>
$ /usr/local/nginx/sbin/nginx -V<br>
nginx version: nginx/1.9.9<br>
built by gcc 4.7.2 (Debian 4.7.2-5)<br>
built with OpenSSL 1.0.1e 11 Feb 2013<br>
TLS SNI support enabled<br>
configure arguments: --user=www-data --group=www-data --with-pcre-jit<br>
--with-ipv6 --with-http_ssl_module<br>
--add-module=../modsecurity-2.9.0/nginx/modsecurity<br>
--conf-path=/etc/nginx/nginx.conf --pid-path=/var/run/nginx.pid<br>
--error-log-path=/var/log/nginx/error.log<br>
--http-log-path=/var/log/nginx/access.log<br>
<br>
$ tail error.log<br>
2016/01/10 13:13:34 [notice] 10256#0: ModSecurity: LIBXML compiled version="2.8.0"<br>
2016/01/10 13:13:34 [notice] 10256#0: ModSecurity: Status engine is<br>
currently disabled, enable it by set SecStatusEngine to On.<br>
2016/01/10 13:13:35 [notice] 10260#0: ModSecurity for nginx<br>
(STABLE)/2.9.0 (<a href="http://www.modsecurity.org/" rel="noreferrer" target="_blank">http://www.modsecurity.org/</a>) configured.<br>
2016/01/10 13:13:35 [notice] 10260#0: ModSecurity: APR compiled<br>
version="1.4.6"; loaded version="1.4.6"<br>
2016/01/10 13:13:35 [notice] 10260#0: ModSecurity: PCRE compiled<br>
version="8.30 "; loaded version="8.30 2012-02-04"<br>
2016/01/10 13:13:35 [notice] 10260#0: ModSecurity: LIBXML compiled version="2.8.0"<br>
2016/01/10 13:13:35 [notice] 10260#0: ModSecurity: Status engine is<br>
currently disabled, enable it by set SecStatusEngine to On.<br>
2016/01/10 13:13:38 [alert] 10261#0: worker process 10267 exited on signal 11<br>
2016/01/10 13:13:38 [alert] 10261#0: worker process 10264 exited on signal 11<br>
2016/01/10 13:13:38 [alert] 10261#0: worker process 10265 exited on signal 11<br>
<br>
$ dmesg<br>
[605432.202671] nginx[10267]: segfault at 70 ip 08093ba1 sp bfc9a7c0 error 4 in nginx[8048000+123000]<br>
[605432.385414] nginx[10264]: segfault at 70 ip 08093ba1 sp bfc9a7c0 error 4 in nginx[8048000+123000]<br>
[605432.409089] nginx[10265]: segfault at 70 ip 08093ba1 sp bfc9a7c0 error 4 in nginx[8048000+123000]<br>
<br>
--<br>
Lukas Ruf <<a href="http://www.lpr.ch" rel="noreferrer" target="_blank">http://www.lpr.ch</a>> | Ad Personam<br>
Consecom <<a href="http://www.consecom.com" rel="noreferrer" target="_blank">http://www.consecom.com</a>> | Ad Laborem<br>
<br>
_______________________________________________<br>
nginx mailing list<br>
<a href="mailto:nginx@nginx.org" target="_blank">nginx@nginx.org</a><br>
<a href="http://mailman.nginx.org/mailman/listinfo/nginx" rel="noreferrer" target="_blank">http://mailman.nginx.org/mailman/listinfo/nginx</a><br>
</blockquote></div></div></div></div>