Hi. I am interested in these rules to be automatic so that both my Apache (web server) and Exim (email server, through ClamAV) are automatically protected without my worrying about tinkering with rules etc.

My biggest question: How do this affect the performance of both the web server and email server? I have heard having too many mod_sec rules will mean a performance hit. I get HUGE traffic so want to be very careful.

Would love to hear experience of actual users.

Thanks@

The way mod_security is built and configured makes a big big difference there. Presumably you're on cpanel? If so they have a very poor default build & configuration for performance. This was one of the first things we had to resolve in the new ASL Cpanel beta.

I run Cpanel, but mod_sec config is entirely mine. You're speaking of "modsec2.user.conf" right? Or some other build?

My understanding is that Cpanel just installs mod_security, but I can configure it as I want...is this incorrect?

Anyway, thanks for this info. I'm interested in what the solution is. Can I install "ASL Cpanel" in a way that I can still control rules as I see fit?

Mod_security is an Apache module, so it won't affect your e-mail server.



As long as a server is not short on RAM we haven't seen any obvious performance problems, but I don't know what you call HUGE traffic, so I guess you just need to go and do some load testing. Or maybe start with just a small number of rule sets and enable more from time to time to and see how it goes.

It can also be effected by the versions of libraries (pcre, apr, lua, etc) it is linked against, and also the way those libraries themselves are built. Ive found that the base Redhat design for those version & libraries offered the best balance for performance & usability so we duplicated that where we could in the ASL Cpanel installer.

In short, no the rules won't make any difference, your performance will be effected by how apache is built and configured, not by the rules.