Cómo securizar un sevidor nagios con apache2 mod_security y mod_evasion en Ubuntu

Para habilitar el servidor como https y deshabilitar http, primero hay que borrar certificados anteriores, si existen
rm -vf /etc/ssl/certs/*snakeoil*
rm -vf /etc/ssl/private/*snakeoil*


Generar nuevos certificados
/usr/sbin/make-ssl-cert generate-default-snakeoil --forceoverwrite


Comentar las líneas *:80
nano /etc/apache2/ports.conf

#NameVirtualHost *:80
#Listen 80

<IfModule mod_ssl.c>
    # If you add NameVirtualHost *:443 here, you will also have to change
    # the VirtualHost statement in /etc/apache2/sites-available/default-ssl
    # to <VirtualHost *:443>
    # Server Name Indication for SSL named virtual hosts is currently not
    # supported by MSIE on Windows XP.
    Listen 443
</IfModule>

<IfModule mod_gnutls.c>
    Listen 443
</IfModule>

Deshabilitar http
a2dissite default

Habilitar https
a2enmod ssla2ensite default-ssl

Configurar la seguridad, deshabilitar metodos TRACE y deshabilitar la máxima informacion sobre nuestro servidor.
nano /etc/apache2/conf.d/security

Deshabilitar modulos inseguros
rm -vf /etc/apache2/mods-enabled/status.*
rm -vf /etc/apache2/mods-enabled/autoindex.*

Instalar modulos de seguridad y librerias necesarias
ln -s /usr/lib/x86_64-linux-gnu/libxml2.so.2 /usr/lib/libxml2.so.2
apt-get install libxml2 libxml2-dev libxml2-utils libaprutil1 libaprutil1-dev libapache-mod-security

mkdir /etc/modsecurity/activated_rules
cd /etc/modsecurity/activated_rules
ln -s /usr/share/modsecurity-crs/modsecurity_crs_10_config.conf
for f in $(ls /usr/share/modsecurity-crs/base_rules/); do  ln -s /usr/share/modsecurity-crs/base_rules/$f; done
for f in $(ls /usr/share/modsecurity-crs/optional_rules/); do  ln -s /usr/share/modsecurity-crs/optional_rules/$f; done
rm -v /etc/modsecurity/activated_rules/*_session_hijacking.conf
rm -v /etc/modsecurity/activated_rules/*_protocol_anomalies.conf


Habilitar OWASP_ModSecurity_Core_Rule_Set
mv /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf

Basicamente cambiar DtectionOnly por On para habilitar el módulo

nano /etc/modsecurity/modsecurity.conf

#SecRuleEngine DetectionOnly
SecRuleEngine On

Configurar OWASP_ModSecurity_Core_Rule_Set
nano /etc/apache2/mods-available/mod-security.conf


<IfModule security2_module>
        # Default Debian dir for modsecurity's persistent data
        SecDataDir /var/cache/modsecurity

        # Include all the *.conf files in /etc/modsecurity.
        # Keeping your local configuration in that directory
        # will allow for an easy upgrade of THIS file and
        # make your life easier
        Include "/etc/modsecurity/*.conf"
        Include "/etc/modsecurity/activated_rules/*.conf"
</IfModule>

Un ejemplo para configurar mod_evasive
nano /etc/apache2/mods-enabled/mod-evasive.conf


<ifmodule mod_evasive20.c>
   DOSHashTableSize 30970
   DOSPageCount  20
   DOSSiteCount  500
   DOSPageInterval 1
   DOSSiteInterval  1
   DOSBlockingPeriod  1
   DOSLogDir   /var/log/apache2/mod_evasive
   DOSEmailNotify  email@dominio.com
   DOSWhitelist   127.0.0.1
</ifmodule>

a2enmod headers
a2enmod mod-security
service apache2 restart


Comprobar que sólo este habilitado https(443) y no http(80)
netstat -a | grep ESCUCHAR
o 
netstat -a | grep LISTEN