A practical guide to building Apache httpd 2.4 from source, hardening it, adding ModSecurity with the OWASP CRS and banning abusers with Fail2Ban.
Updated on
This is a fresh version, rewritten around what the current documentation says: build the Apache HTTP Server 2.4 from source, harden it, put a web application firewall in front of your apps and let Fail2Ban react to what the logs record. None of these layers is complete alone; together they raise the cost of an attack.
What you need
Apache is released as source code, and the build instructions cover Unix and Unix-like systems. You need a C compiler such as GCC, the Apache Portable Runtime libraries and Perl 5 for some helper scripts; the install page lists the full requirements. If you prefer your distribution's package, expect a different layout and different defaults, as described on the distribution layout page. Ubuntu users can follow Ubuntu's own tutorial.
- Download the latest 2.4 release from the official download page and extract it.
- Configure, compile and install, choosing your own prefix.
- Edit httpd.conf, then start the server and test it.
- Apply the hardening advice from the Apache security tips.
- Add ModSecurity and the OWASP Core Rule Set.
- Install Fail2Ban; its README says it is ready to read standard sshd and Apache logs.
Build and install Apache from source
The official quick sequence is below. Replace NN with the current version number and PREFIX with the installation path; if you omit the prefix, it defaults to /usr/local/apache2.
tar xzf httpd-NN.tar.gz
cd httpd-NN
./configure --prefix=PREFIX
make
make install
vi PREFIX/conf/httpd.conf
PREFIX/bin/apachectl -k startHarden the server
The official Security Tips page is the reliable baseline. It covers keeping up to date, mitigating denial-of-service attacks, permissions on the ServerRoot directories, server side includes, CGI, protecting system settings and server files by default, and watching your logs. It also reminds us that most compromises come from add-on code, CGI scripts or the operating system rather than the server itself, so patch everything.
Add ModSecurity and the OWASP Core Rule Set
ModSecurity is an open source web application firewall engine. Mind the versions: the newer v3 line, libmodsecurity, no longer depends on Apache, while ModSecurity for Apache (v2.x) is still maintained, as the project README explains. Pair the engine with the OWASP Core Rule Set. For installation, follow the official CRS documentation.
Ban repeat offenders with Fail2Ban
The Fail2Ban README says it scans log files and updates firewall rules to reject IP addresses with too many failed login attempts, for a configurable time. It is ready to read standard logs such as those for sshd and Apache, and can be configured for other logs. The README also notes IPv6 support since v0.10 and lists Python 3.5 or newer and setuptools as source-install requirements.
This example preserves values from our original post; they are not Fail2Ban defaults. Adjust them to your traffic. Example jail settings:
[DEFAULT]
ignoreip = 127.0.0.1
banaction = iptables-multiport
bantime = 600
findtime = 600
maxretry = 5With these illustrative values, five failures within 600 seconds trigger a 600-second ban. The Fail2Ban README warns that the software cannot eliminate the risk of weak authentication, so use public-key or two-factor access for services that matter.
Related articles from LaRebelión
Google pauses its open-source bug bounty as AI slop floods maintainers
Open-weight AI as a hacker's toolkit: what the Korean bank breach points to
How to Prepare Your Open Source Project for Anthropic's OSS ScannerOriginal source: Apache HTTP Server Project
Article generated with AI.larebelion