After install ASL on Cpanel all sites backend that uses db get slow, sites in joomla and wordpress,
I did run asl -f -s

and seems to be problems with mod_security of cpanel

Checking for updates: 2 found [CRITICAL]
[Wed Oct 05 12:46:55 2011] [warn] module security2_module is already loaded, skipping
[Wed Oct 05 12:46:55 2011] [warn] module security2_module is already loaded, skipping

any way to fix it???

You can ignore the "module security2_module is already loaded, skipping" as it is harmless and just means that the command to load the security2_module can be found in more than one place (three places from the looks of it, once to load, then in two other places, causing the warnings)

The Checking for updates: 2 found [CRITICAL] means you have two packages on your system that have updates.

On a Centos system you'd just do "yum list updates" and then update the appropriate packages.

As for the slowness....that could be a lot of things I'm afraid. I'll hand over to Mike and Scott who may have some good ideas. I can't think why anything would effect database performance.

Have you tried using "top" to see if there's anything obvious happening?

I think I once read somewhere on this here forum that Cpanel's mod_security is close to useless. You might want to verify that the Cpanel version isn't installed and that the ASL version used.

That means you are loading modsecurity three times, possibly even all of your rules three times - thats going to make your system *very* slow. Thats whats causing your performance issues. I've seen cpanel systems where people have setup the free rules (or real time rules) in some non-standard location, and the OWASP rules, and then installed ASL basically loading rules three times.

So, that error tells me you are loading modsecurity three times, which ASL can not configure itself to do. That means you probably had modsecurity configured manually (or someone set it up for you) and somewhere along the way someone set it up to load itself another time (possibly with more, or duplicate rules). Remove any custom or non-ASL modsecurity configuration, just remove all that stuff and dont use any of cpanels modsecurity stuff or non-ASL addons, you don't need it and you'll just be making more work for yourself.

Once you clean all that out, reinstall ASL so it can do a clean modsecurity install on your system and then just leave the modsec config and rules alone. Let ASL set it all up and manage it for you. You do not need to manual configure modsecurity or add anything for modsecurity when using ASL.

I was always of the opinion that "module ABC is already loaded, skipping" implied that it was NOT being loaded again, and therefore harmless.

I'm going to check my configurations now, as I've been quite happy seeing multiple versions of these listed in apache startups/restarts.

checog0 - sorry for my misleading post about it being harmless.

Apache wont load the module, but it absolutely will load any configuration directives (if any). And its not uncommon for .conf files to load a module inside the configuration file, if you see something being loaded more than once (and in his case its three times) then you may also be loading the configuration too. So always check your apache configs (you also may not be load config directives, so doublecheck, for example sometimes the main apache configuration file may load a module, but no settings - so in that case its harmless)

Consider the classic load logic, most folks put in a directive that says "if this module is loaded, then parse these configuration directives". Not "if this module has NOT already been configured parse these configuration directives". So the only error you see is apache saying "already loaded the module", not "already load and CONFIGURED the module". So it merrily configures itself again and loads yet MORE and potentially identical rules (keep in mind, apache directives are cumulative, you can have two, or three or more identical rules loaded if you keep loading the config).

As I said, in his case he's loading modsecurity three times, so its probably really overloaded with duplicates, misconfigured/reconfigured logic and all sorts of hair balls. And because all the recommended configurations for modsecurity (include the configs for rules only users, our ASL configuration and cpanels modsecurity configuration) all load modsecurity from within the modsecurity configuration file, that means the entire configuration is being loaded three times - and as the configuration also includes the rules - hes loading the rules up three times.

I have definitely seen cases where users have done this, and reported the exact same issue with performance. We found they had setup a duplicate of the Atomicorp rules in /opt/modsecurity, and a second modsecurity configuration they setup manually in addition to the ASL rules. So they loaded all the rules twice in that case, and it crushed the box. This is definitely neither supported nor tested, and is definitely not going to be extremely inefficient.

So, with two already loaded errors, that tells me this system is setup to at least load the module three times, and may also be loading the modsecurity configuration three times and thereby likely loading the rules three times. If the rules are loaded three times, that would definitely crush the systems performance. Its pretty bad ass that it works well at all, but the bottom line is that with two already loaded errors, the system is not in a state ASL configured. One error, that could just be the main apache config loading the module but not config directives, but two - thats like a duplicate modsec setup. In this case, it sounds like someones manually setup modsecurity, perhaps before or after ASL was installed.

Short answer, just let ASL do the work for you. Remove modsecurity and any manual implementations thereof, reinstall ASL and only let ASL make changes to modsecurity. Don't install any rules manually or any third party packages for modsecurity.

Ah. Makes sense. Yes. So in my cases no harm done (won't go into detail -- not my thread) but I understand how checog0 might have been having problems.

I have this problem too, but in special circumstances. So I don't know what to do.

I had noticed that the foo test was not working, so I filed a ticket. I was told that mod_security wasn't running all the rules (which, of course was a major concern, as we had turned to ASL for advanced protection).

I was told that the resolution was to make sure that I had the latest version of mod_security installed. I was told that one way to do this was to install it via EasyApache. (Normally we're told to let ASL handle all things mod_security, but in this case I was told to install the latest version.) The next step was to enable the ASL test repository and install the development version of ASL which would run all the rules under cPanel as long as I was running the latest mod_security. I was told that the posteasyapache script would take care of the duplicate installation of mod_security.

But after I update to the development version, I get the double "[warn] module security2_module is already loaded, skipping" message. I'm told that I shouldn't worry about this, but this thread says otherwise.

So, should I worry? If so, how can I fix the configuration issue?

In your case, you can ignore it. 3.0.21 resolves the issue that required cpanel users (because cpanel has no software management capabilities, and doesnt use any package management) to use easyapache to install a newer version of mod_security, please upgrade to 3.0.21.

Having same problem as mark. Except I didn't install mod_security at all through easy apache. How do you update to 3.0.21?
asl -u says 3.0.20 is latest and is OK. how would get access to the test build of 3.0.21?

Sorry for the dumb questions, but I looked around the main site and I don't see any information on where you get access to test builds.

If I disable 10_asl_rules I don't see any impact on the apache process size. Makes me think it's not running. I haven't seen any attacks using that ruleset for about 3 weeks. Basically since the 3.0.20 release.

From Atomicorp support (in my ticket):



This info is a few days old. I'm assuming that it's still necessary to add the test repo to get 3.0.21.

Mark

Add --enablerepo=asl-3.0-testing to your yum command (or --enablerepo=asl-2.0-testing if you're old skool and your /etc/yum.repos.d/asl.repo file was never updated) for enabling the testing repository for one time only.

Or set enabled=1 in the testing section in /etc/yum.repos.d/asl.repo if you want to enable the testing repository by default.

Thanks

Okay I ran yum update asl --enablerepo=asl-3.0-testing

Is that good enough? Seems to be working now. whew

Just run this command to install 3.0.21:

yum --enablerepo=asl-3.0-testing upgrade asl asl-web

asl -uf

Ah okay. Thanks Completely missed Mark's post haha. Thanks guys

Seems all good now.