NGINX / Security

How to install the ModSecurity NGINX module in CentOS/RHEL 8

by , , revisited on

We have by far the largest RPM repository with NGINX module packages and VMODs for Varnish. If you want to install NGINX, Varnish, and lots of useful performance/security software with smooth yum upgrades for production use, this is the repository for you.
Active subscription is required.

NGINX is an open-source web server well known for its high performance and the vast array of features available through modules.

ModSecurity is an open-source web application firewall. It is available as a library and can be added to NGINX using a connector module.

Follow these instructions to easily install the RPM package of the ModSecurity module for NGINX.

Install nginx-module-security in CentOS/RHEL 8

The ModSecurity module is compatible with the latest stable and mainline NGINX versions.

Step 1. Set up GetPageSpeed RPM respotiroy

sudo dnf -y install

Step 2. Install NGINX

If you already have NGINX set up, you can skip this step.

Otherwise, run the following command to install NGINX:

sudo dnf -y install nginx 

Step 3. Install ModSecurity NGINX module

Install ModSecurity module itself:

sudo dnf -y install nginx-module-security

Follow the installation prompt to import GPG public key that is used for verifying packages.

The libmodsecurity library dependency will be installed for you.

Step 4. Enable the module

Next, enable your NGINX to load the ModSecurity dynamic module by editing the NGINX configuration. Simply follow the installer’s suggestion:


The security dynamic module for nginx has been installed.
To enable this module, add the following to /etc/nginx/nginx.conf
and reload nginx:

    load_module modules/;

Please refer to the module documentation for further details:



ModSecurity needs some detection rules to work with.
A popular ruleset for ModSecurity is OWASP ModSecurity Core Rule Set (CRS).

You can set up OWASP Core Rule Set now with:

sudo dnf -y install nginx-owasp-crs


To enable the installed rule set (and thus put ModSecurity to action), you can add the following to a site configuration:

server {
    modsecurity on;
    location / {
        modsecurity_rules_file /etc/nginx/modsec_includes.conf;


Now you have it installed and configured. How to see it is actually protecting your website?

Navigate to a URL like this:

It should trigger a 403 Forbidden error, similar to the screenshot below:

NGINX ModSecurity Protection
NGINX ModSecurity Protection

Monitor False Positives

As with all-things-ModSecurity, you should tune things specifically for your web app. Monitor the main log file /var/log/nginx/modsec_audit.log for false positives. You can see details of each denied request in /var/log/nginx/modsec directory.

ModSecurity, built for production

Our package of ModSecurity for NGINX fixes several upstream issues and supports the complete set of features.
Even more than that, it comes with:

SELinux compatibility

The package is fully compatible with SELinux.

luajit2 compatibility

The package makes use of high-performance Lua implementation, luajit2.

  1. Giedrius Tuminauskas

    Paid repo subscription? It does not mention anything on subscription page, nor in the terms and conditions – UPDATE IT
    Also website still has 2014 copyright, so anything newer than 2014 is not copyrighted?

    • Danila Vershinin

      It all makes sense. Updated the terms and conditions.
      For the subscription page, the button logo with cards should make it more obvious ­čÖé
      Thank you.


    Hi I’m testing in a temp VPS Host, next week will be over a Production Server Dedicated host, if purv┬┐chase the suscription with the temp IP can I ask for an IP change later?


    • Danila Vershinin

      We allow a one-time change of IP address (per subscription lifecycle). So the answer is yes.

  3. Mark Smith

    Hello Danila, do you know if your modsec module for NGINX supports SecAuditLogType HTTPS? I tried to use this audit logging option without any luck.

    • Danila Vershinin

      Hi Mark,

      It should work without issue using the packages.

      Looking at this thread, the essential for SecAuditLogType HTTPS to function is linking with YAJL library, for JSON support.

      The packages by GetPageSpeed have all that, and link with all the dependency libraries, so they support the complete feature set that ModSecurity has to offer.

      Example on a RHEL 8 system:

      ldd /usr/lib64/ 
 => /lib64/ (0x00007fdb91426000)
 => /lib64/ (0x00007fdb911e9000)
 => /lib64/ (0x00007fdb90fe0000)
 => /lib64/ (0x00007fdb90c78000)
 => /usr/lib64/intel-zlib/ (0x00007fdb90a5e000)
 => /lib64/ (0x00007fdb90837000)
 => /lib64/ (0x00007fdb90633000)
 => /lib64/ (0x00007fdb9041d000)
 => /lib64/ (0x00007fdb9019d000)
 => /lib64/ (0x00007fdb8ff2c000)
 => /lib64/ (0x00007fdb8fd26000)
 => /lib64/ (0x00007fdb8fb20000)
 => /lib64/ (0x00007fdb8f916000)
 => /lib64/ (0x00007fdb8f581000)
 => /lib64/ (0x00007fdb8f1ff000)
 => /lib64/ (0x00007fdb8ee3d000)
          /lib64/ (0x00007fdb91b20000)
 => /lib64/ (0x00007fdb8ec25000)
 => /lib64/ (0x00007fdb8e9fe000)
 => /lib64/ (0x00007fdb8e7e0000)
 => /lib64/ (0x00007fdb8e555000)
 => /lib64/ (0x00007fdb8e344000)
 => /lib64/ (0x00007fdb8e0b0000)
 => /lib64/ (0x00007fdb8dbcd000)
 => /lib64/ (0x00007fdb8d97d000)
 => /lib64/ (0x00007fdb8d68d000)
 => /lib64/ (0x00007fdb8d471000)
 => /lib64/ (0x00007fdb8d26d000)
 => /lib64/ (0x00007fdb8d020000)
 => /lib64/ (0x00007fdb8ce10000)
 => /lib64/ (0x00007fdb8cc04000)
 => /lib64/ (0x00007fdb8c9e4000)
 => /lib64/ (0x00007fdb8c663000)
 => /lib64/ (0x00007fdb8c452000)
 => /lib64/ (0x00007fdb8c24e000)
 => /lib64/ (0x00007fdb8c037000)
 => /lib64/ (0x00007fdb8be19000)
 => /lib64/ (0x00007fdb8bbf9000)
 => /lib64/ (0x00007fdb8b9ce000)
 => /lib64/ (0x00007fdb8b7a5000)
 => /lib64/ (0x00007fdb8b521000)

      Note the in the output so SecAuditLogType HTTPS is supported.


Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: