How can I find out if mod_security is installed on my apache server? I would also like to learn its version.
I'm having some upload issues and I tried to disable mod_security using .htaccess. But that started producing 500 internal server errors.
I read somewhere that depending on my mod_security version I might not be able to disable it using .htaccess. So I would like to understand if I have mod_security installed and what version it is.
I'm on a centos 5 box.
Thanks!
UPDATE -1 xxxxxxxxxxxxx
Does the below output mean I do not have mod_security installed?
[root@u11 htdocs]# httpd -l
Compiled in modules:
core.c
prefork.c
http_core.c
mod_so.c
Best Answer
No - the output listed above just describes the pre-compiled in modules.
The presence of the
mod_so.c
entry however means that Apache is capable of dynamically loading additional modules.If you have access to the central configuration you could just go look at this and check to see if there's a line like:
If there is then you have mod_security loaded - NOTE: this could be within an included configuration file as well.
Assuming your configuration is located in /etc/httpd - you could run the following to find if the config is present:
grep -ir security_module /etc/httpd
(Replace
/etc/httpd
with the central configuration directory).If you don't have access to the server config you could use an
<IfModule mod_security.c>
statement within your .htaccess to see if it's enabled:Hope this helps.