Loaded APR do not match with compiled

[ZerooCool]

[:notice] ModSecurity: APR compiled version="1.6.3"; loaded version="1.6.5"
[:warn] ModSecurity: Loaded APR do not match with compiled!

cat /var/log/apache2/error.log | grep ModSecurity
[Mon Jul 29 00:00:52.932188 2019] [:notice] [pid 32144] ModSecurity for Apache/2.9.3 (http://www.modsecurity.org/) configured.
[Mon Jul 29 00:00:52.932290 2019] [:notice] [pid 32144] ModSecurity: APR compiled version="1.6.3"; loaded version="1.6.5"
[Mon Jul 29 00:00:52.932296 2019] [:warn] [pid 32144] ModSecurity: Loaded APR do not match with compiled!
[Mon Jul 29 00:00:52.932309 2019] [:notice] [pid 32144] ModSecurity: PCRE compiled version="8.39 "; loaded version="8.39 2016-06-14"
[Mon Jul 29 00:00:52.932313 2019] [:notice] [pid 32144] ModSecurity: LUA compiled version="Lua 5.1"
[Mon Jul 29 00:00:52.932315 2019] [:notice] [pid 32144] ModSecurity: YAJL compiled version="2.1.0"
[Mon Jul 29 00:00:52.932318 2019] [:notice] [pid 32144] ModSecurity: LIBXML compiled version="2.9.4"
[Mon Jul 29 00:00:52.932321 2019] [:notice] [pid 32144] ModSecurity: Status engine is currently disabled, enable it by set SecStatusEngine to On.
[Mon Jul 29 00:07:16.639181 2019] [:notice] [pid 32704] ModSecurity for Apache/2.9.3 (http://www.modsecurity.org/) configured.
[Mon Jul 29 00:07:16.639373 2019] [:notice] [pid 32704] ModSecurity: APR compiled version="1.6.3"; loaded version="1.6.5"
[Mon Jul 29 00:07:16.639381 2019] [:warn] [pid 32704] ModSecurity: Loaded APR do not match with compiled!
[Mon Jul 29 00:07:16.639383 2019] [:notice] [pid 32704] ModSecurity: PCRE compiled version="8.39 "; loaded version="8.39 2016-06-14"
[Mon Jul 29 00:07:16.639385 2019] [:notice] [pid 32704] ModSecurity: LUA compiled version="Lua 5.1"
[Mon Jul 29 00:07:16.639387 2019] [:notice] [pid 32704] ModSecurity: YAJL compiled version="2.1.0"
[Mon Jul 29 00:07:16.639388 2019] [:notice] [pid 32704] ModSecurity: LIBXML compiled version="2.9.4"
[Mon Jul 29 00:07:16.639430 2019] [:notice] [pid 32704] ModSecurity: StatusEngine call: "2.9.3,Apache/2.4.38,1.6.3/1.6.5,8.39/8.39 2016-06-14,Lua 5.1,2.9.4,46"
[Mon Jul 29 00:07:18.225043 2019] [:notice] [pid 32704] ModSecurity: StatusEngine call successfully sent. For more information visit: http://status.modsecurity.org/

I use Debian Stretch

deb http://debian.proxad.net/debian/ stretch main non-free contrib

deb http://deb.debian.org/debian/ sid main contrib non-free
deb http://deb.debian.org/debian/ testing main contrib non-free

deb http://security.debian.org/ buster/updates main contrib non-free
deb-src http://security.debian.org/ buster/updates main contrib non-free

deb http://deb.debian.org/debian/ buster main non-free contrib
deb-src http://deb.debian.org/debian/ buster main non-free contrib

# buster-updates, previously known as 'volatile'
deb http://deb.debian.org/debian/ buster-updates main contrib non-free
deb-src http://deb.debian.org/debian/ buster-updates main contrib non-free

 # Installer le module mod_security :
 sudo apt install libapache2-modsecurity

 Paquets recommandés :
  modsecurity-crs
 Les NOUVEAUX paquets suivants seront installés :
  libapache2-mod-security2 libapache2-modsecurity liblua5.1-0 libyajl2

 # Vérifier que mod_security soit bien chargé par Apache2 :
 sudo apachectl -M | grep --color sec
 # Le module a été chargé ( OK )
 # security2_module (shared)

 sudo cp /etc/modsecurity/modsecurity.conf{-recommended,}

 # Redémarrer Apache :
 sudo systemctl restart apache2

[airween]

Hi @ZerooCool,

First, I think you're using your repositories from multiple versions of Debian:

I use Debian Stretch

deb http://debian.proxad.net/debian/ stretch main non-free contrib

deb http://deb.debian.org/debian/ sid main contrib non-free
deb http://deb.debian.org/debian/ testing main contrib non-free

deb http://security.debian.org/ buster/updates main contrib non-free
deb-src http://security.debian.org/ buster/updates main contrib non-free

You're listed: stretch, sid, testing, and buster. These are 4 different versions...

I think this is at the first place on the list of reasons.

You can compare your outputs whit these:

$ dpkg -l "libapache2*" | grep security2
ii  libapache2-mod-security2        2.9.3-1      amd64        Tighten web applications security for Apache
ii  libapache2-mod-security2-dbgsym 2.9.3-1      amd64        debug symbols for libapache2-mod-security2

$ dpkg -l "libapr*" | grep ^ii
ii  libapr1:amd64                 1.6.5-1+b1   amd64        Apache Portable Runtime Library
ii  libapr1-dev                   1.6.5-1+b1   amd64        Apache Portable Runtime Library - Development Headers
ii  libaprutil1:amd64             1.6.1-3+b2   amd64        Apache Portable Runtime Utility Library
ii  libaprutil1-dbd-sqlite3:amd64 1.6.1-3+b2   amd64        Apache Portable Runtime Utility Library - SQLite3 Driver
ii  libaprutil1-dev               1.6.1-3+b2   amd64        Apache Portable Runtime Utility Library - Development Headers
ii  libaprutil1-ldap:amd64        1.6.1-3+b2   amd64        Apache Portable Runtime Utility Library - LDAP Driver

$ dpkg -L libapache2-mod-security2 | grep apache2/modules
/usr/lib/apache2/modules
/usr/lib/apache2/modules/mod_security2.so

$ ldd /usr/lib/apache2/modules/mod_security2.so | grep apr
	libapr-1.so.0 => /usr/lib/x86_64-linux-gnu/libapr-1.so.0 (0x00007f77b6e69000)
	libaprutil-1.so.0 => /usr/lib/x86_64-linux-gnu/libaprutil-1.so.0 (0x00007f77b6e3b000)

$ dpkg -S /usr/lib/x86_64-linux-gnu/libapr-1.so.0
libapr1:amd64: /usr/lib/x86_64-linux-gnu/libapr-1.so.0

Note, that you wrote:

Les NOUVEAUX paquets suivants seront installés :
libapache2-mod-security2 libapache2-modsecurity liblua5.1-0 libyajl2

But there isn't package with name libapache2-modsecurity. Could you show us this output too:

dpkg -l libapache2-modsecurity
dpkg -L libapache2-modsecurity

Regards,

a.

[ZerooCool]

Ok, first, i remove stretch , sid and testing from my sources.list

deb http://deb.debian.org/debian/ stable main contrib non-free
deb-src http://deb.debian.org/debian/ stable main contrib non-free

deb http://deb.debian.org/debian/ stable-updates main contrib non-free
deb-src http://deb.debian.org/debian/ stable-updates main contrib non-free 

deb http://deb.debian.org/debian-security stable/updates main
deb-src http://deb.debian.org/debian-security stable/updates main

deb http://ftp.debian.org/debian buster-backports main
deb-src http://ftp.debian.org/debian buster-backports main

apt update

Subsequently you tell me that there is no package libapache2-modsecurity.
In my tutorial, I noticed that it is this package that allows to install ModSecurity.
I have wrong ?

Thanks for your advices :

dpkg -l "libapache2*" | grep security2
ii  libapache2-mod-security2   2.9.3-1      amd64        Tighten web applications security for Apache

dpkg -l "libapr*" | grep ^ii
ii  libapr1:amd64                 1.6.5-1+b1   amd64        Apache Portable Runtime Library
ii  libapr1-dev                   1.6.5-1+b1   amd64        Apache Portable Runtime Library - Development Headers
ii  libaprutil1:amd64             1.6.1-4      amd64        Apache Portable Runtime Utility Library
ii  libaprutil1-dbd-sqlite3:amd64 1.6.1-4      amd64        Apache Portable Runtime Utility Library - SQLite3 Driver
ii  libaprutil1-dev               1.6.1-4      amd64        Apache Portable Runtime Utility Library - Development Headers
ii  libaprutil1-ldap:amd64        1.6.1-4      amd64        Apache Portable Runtime Utility Library - LDAP Driver

dpkg -L libapache2-mod-security2 | grep apache2/modules
/usr/lib/apache2/modules
/usr/lib/apache2/modules/mod_security2.so

ldd /usr/lib/apache2/modules/mod_security2.so | grep apr
	libapr-1.so.0 => /usr/lib/x86_64-linux-gnu/libapr-1.so.0 (0x00007f7d1bdac000)
	libaprutil-1.so.0 => /usr/lib/x86_64-linux-gnu/libaprutil-1.so.0 (0x00007f7d1bd7e000)

dpkg -S /usr/lib/x86_64-linux-gnu/libapr-1.so.0
libapr1:amd64: /usr/lib/x86_64-linux-gnu/libapr-1.so.0


dpkg -l libapache2-modsecurity
Souhait=inconnU/Installé/suppRimé/Purgé/H=à garder
| État=Non/Installé/fichier-Config/dépaqUeté/échec-conFig/H=semi-installé/W=atte
|/ Err?=(aucune)/besoin Réinstallation (État,Err: majuscule=mauvais)
||/ Nom                    Version      Architecture Description
+++-======================-============-============-===========================
ii  libapache2-modsecurity 2.9.1-2      all          Dummy transitional package
lines 1-6/6 (END)


dpkg -L libapache2-modsecurity
/.
/usr
/usr/share
/usr/share/doc
/usr/share/doc/libapache2-modsecurity
/usr/share/doc/libapache2-modsecurity/changelog.Debian.gz
/usr/share/doc/libapache2-modsecurity/changelog.gz
/usr/share/doc/libapache2-modsecurity/copyright

[airween]

Ok, first, i remove stretch , sid and testing from my sources.list
...
apt update

Does your problem still exist?

Subsequently you tell me that there is no package libapache2-modsecurity.
yes, I don't know about - could you check it at your site?

$ apt-cache search libapache2-modsecurity
[EMPTY OUTPUT]

In my tutorial, I noticed that it is this package that allows to install ModSecurity.

For Apache2, it called libapache2-mod-security2 (in Debian).

I have wrong ?

Don't know - where did you find that tutorial?

[ZerooCool]

# Installer le module mod_security :
sudo apt install libapache2-modsecurity

Paquets recommandés :
 modsecurity-crs
Les NOUVEAUX paquets suivants seront installés :
 libapache2-mod-security2 libapache2-modsecurity liblua5.1-0 libyajl2

We are right both.

This is my tutorial : https://wiki.visionduweb.fr/index.php?title=Installer_Apache2_sur_Debian

[airween]

Hmm...

Take a look to this:
https://packages.debian.org/search?keywords=libapache2-modsecurity&searchon=names&suite=stable&section=all

Note for the line at top of page: Search in all suites - I think it means there isn't a package like this.

The attached wiki had written in French, which is totally strange for me :), but I didn't found any lines which refers to a non-official Debian repository.

Could you show this command's output?

apt-cache show libapache2-modsecurity

Anyway, after the fix of sources.list and the upgrade, your ModSecurity works?

[ZerooCool]

apt-cache show libapache2-modsecurity

Package: libapache2-modsecurity
Status: install ok installed
Priority: extra
Section: oldlibs
Installed-Size: 43
Maintainer: Alberto Gonzalez Iniesta <agi@inittab.org>
Architecture: all
Source: modsecurity-apache
Version: 2.9.1-2
Depends: libapache2-mod-security2
Description: Dummy transitional package
 This package is provided to ease the updating of modsecurity to the new
 package name. You may safely remove it.
Description-md5: 11f32e6c97d8fa0ab85f13202283619c
Homepage: http://www.modsecurity.org/

I do not know if it works.
I read that it probably works, but, that there might be a lack of stability, since the versions do not match for ARP.

I uninstall.

sudo apt autoremove --purge libapache2-modsecurity

I'm reinstalling.

sudo apt install libapache2-modsecurity

sudo apt update
sudo apt upgrade
sudo apt dist-upgrade

Now, i can't install libapache2-modsecurity
What you said, actually !

# Installer le module mod_security :
sudo apt install libapache2-mod-security2

Les paquets supplémentaires suivants seront installés : 
 liblua5.1-0 libyajl2
Paquets recommandés :
 modsecurity-crs
Les NOUVEAUX paquets suivants seront installés :
 libapache2-mod-security2 liblua5.1-0 libyajl2

# Vérifier que mod_security soit bien chargé par Apache2 :
sudo apachectl -M | grep --color sec
# Le module a été chargé :
# security2_module (shared)

cat /var/log/apache2/error.log | grep ModSecurity

[Wed Jul 31 16:30:27.110847 2019] [:notice] [pid 21562] ModSecurity: StatusEngine call successfully sent. For more information visit: http://status.modsecurity.org/
[Wed Jul 31 16:31:39.100226 2019] [:notice] [pid 21685] ModSecurity for Apache/2.9.3 (http://www.modsecurity.org/) configured.
[Wed Jul 31 16:31:39.100357 2019] [:notice] [pid 21685] ModSecurity: APR compiled version="1.6.3"; loaded version="1.6.5"
[Wed Jul 31 16:31:39.100361 2019] [:warn] [pid 21685] ModSecurity: Loaded APR do not match with compiled!
[Wed Jul 31 16:31:39.100365 2019] [:notice] [pid 21685] ModSecurity: PCRE compiled version="8.39 "; loaded version="8.39 2016-06-14"
[Wed Jul 31 16:31:39.100368 2019] [:notice] [pid 21685] ModSecurity: LUA compiled version="Lua 5.1"
[Wed Jul 31 16:31:39.100370 2019] [:notice] [pid 21685] ModSecurity: YAJL compiled version="2.1.0"
[Wed Jul 31 16:31:39.100372 2019] [:notice] [pid 21685] ModSecurity: LIBXML compiled version="2.9.4"
[Wed Jul 31 16:31:39.100439 2019] [:notice] [pid 21685] ModSecurity: StatusEngine call: "2.9.3,Apache/2.4.38,1.6.3/1.6.5,8.39/8.39 2016-06-14,Lua 5.1,2.9.4,46"
[Wed Jul 31 16:31:40.463889 2019] [:notice] [pid 21685] ModSecurity: StatusEngine call successfully sent. For more information visit: http://status.modsecurity.org/

Again,
I do not know if it works.
I read that it probably works, but, that there might be a lack of stability, since the versions do not match for ARP.

I guess it works, because, the logs are filling for modsecurity, sometimes with funny logs that display all the HTML code of my site.

[airween]

hi,

look at this in the output of apt-cache show

Description: Dummy transitional package
 This package is provided to ease the updating of modsecurity to the new
 package name. You may safely remove it.

May be that the ModSecurity runs under Apache2, but the problem still exists:

[Wed Jul 31 16:31:39.100361 2019] [:warn] [pid 21685] ModSecurity: Loaded APR do not match with compiled!

May be you can remove/update the libapr packages:

dpkg -l "libapr1*" | grep ^ii

Remove the installed packages (perhaps only these 2 will affected), and install them again:

dpkg --purge --force-all libapr1:amd64 libapr1-dev
...
apt install libapr1:amd64 libapr1-dev

or you can skip the purge, and run just the apt install - that will upgrade the listed package(s).

If you installed successfully, and there isn't any warning, you have to set up the ModSecurity - just follow this documentation: https://coreruleset.org/installation/.

If you're done, send a HTTP request to the server: curl -v "http://localhost/?test=test%FF1", and see your webserver's error.log and modsec_debug.log.

[ZerooCool]

look at this in the output of apt-cache show
Sorry, i don't anderstand.

Sorry, only 1 version :

> dpkg -l "libapr1*" | grep ^ii
> ii  libapr1:amd64  1.6.5-1+b1   amd64        Apache Portable Runtime Library
> ii  libapr1-dev    1.6.5-1+b1   amd64        Apache Portable Runtime Library - Development Headers

OK
dpkg --purge --force-all libapr1:amd64 libapr1-dev
...
apt install libapr1:amd64 libapr1-dev

Sorry :

sudo apt autoremove --purge libapache2-mod-security2
sudo apt install libapache2-mod-security2
.....
cat /var/log/apache2/error.log | grep ModSecurity
[Wed Jul 31 17:18:21.880437 2019] [:notice] [pid 24644] ModSecurity: APR compiled version="1.6.3"; loaded version="1.6.5"
[Wed Jul 31 17:18:21.880441 2019] [:warn] [pid 24644] ModSecurity: Loaded APR do not match with compiled!

[airween]

look at this in the output of apt-cache show
Sorry, i don't anderstand.

I just showed a part of the output of your command. It means that the libapache2-modsecurity is just a "metapackage", and you can uninstall it safely.

Nevermind.

Could you show the outputs of these commands? I kept mine:

# cat /etc/apache2/mods-enabled/security2.load 
LoadModule security2_module /usr/lib/apache2/modules/mod_security2.so
# dpkg -S /usr/lib/apache2/modules/mod_security2.so 
libapache2-mod-security2: /usr/lib/apache2/modules/mod_security2.so
# dpkg -l libapache2-mod-security2 | grep ^ii
ii  libapache2-mod-security2 2.9.3-1      amd64        Tighten web applications security for Apache
# ldd /usr/lib/apache2/modules/mod_security2.so | grep apr
	libapr-1.so.0 => /usr/lib/x86_64-linux-gnu/libapr-1.so.0 (0x00007f48ec74d000)
	libaprutil-1.so.0 => /usr/lib/x86_64-linux-gnu/libaprutil-1.so.0 (0x00007f48ec71f000)
# dpkg -S /usr/lib/x86_64-linux-gnu/libapr-1.so.0
libapr1:amd64: /usr/lib/x86_64-linux-gnu/libapr-1.so.0

We have to be sure, that you don't have any other shared object, and have to see, where finds the mod_security module the apr so file.

[ZerooCool]

cat /etc/apache2/mods-enabled/security2.load 
# Depends: unique_id
LoadModule security2_module /usr/lib/apache2/modules/mod_security2.so

dpkg -S /usr/lib/apache2/modules/mod_security2.so
libapache2-mod-security2: /usr/lib/apache2/modules/mod_security2.so

dpkg -l libapache2-mod-security2 | grep ^ii
ii  libapache2-mod-security2 2.9.3-1      amd64        Tighten web applications security for Apache

dpkg -l libapache2-mod-security2 | grep ^ii
ii  libapache2-mod-security2 2.9.3-1      amd64        Tighten web applications security for Apache

dpkg -S /usr/lib/x86_64-linux-gnu/libapr-1.so.0
libapr1:amd64: /usr/lib/x86_64-linux-gnu/libapr-1.so.0

[airween]

This line is missing:

ldd /usr/lib/apache2/modules/mod_security2.so | grep apr

and what you see in the output near the libapr-1.so.0, next to the =>, that's the shared object/library, what you have to check with dpkg -S, and dpkg -l.

[ZerooCool]

ldd /usr/lib/apache2/modules/mod_security2.so | grep apr
	libapr-1.so.0 => /usr/lib/x86_64-linux-gnu/libapr-1.so.0 (0x00007f979c013000)
	libaprutil-1.so.0 => /usr/lib/x86_64-linux-gnu/libaprutil-1.so.0 (0x00007f979bfe5000)

Only that :

dpkg -S /usr/lib/x86_64-linux-gnu/libapr-1.so.0
libapr1:amd64: /usr/lib/x86_64-linux-gnu/libapr-1.so.0

dpkg -l /usr/lib/x86_64-linux-gnu/libapr-1.so.0
dpkg-query: aucun paquet ne correspond à /usr/lib/x86_64-linux-gnu/libapr-1.so.0

[airween]

Thanks - and sorry, I meant the -l ... needs the package name, not the library - that's why the

dpkg -l /usr/lib/x86_64-linux-gnu/libapr-1.so.0

given

dpkg-query: aucun paquet ne correspond à /usr/lib/x86_64-linux-gnu/libapr-1.so.0

The output of your last command can see above:

Sorry, only 1 version :

dpkg -l "libapr1*" | grep ^ii
ii libapr1:amd64 1.6.5-1+b1 amd64 Apache Portable Runtime Library
ii libapr1-dev 1.6.5-1+b1 amd64 Apache Portable Runtime Library - Developm

so I assume that your installed versions of different components are consistent. That's why I don't understand this issue :). Could you restart your system? (If it was not till the last update...)

[ZerooCool]

For the moment, I have not restarted the system. You think that can influence the behavior?

I keep this exchange in the favorites, I come back in the days to come, once the progress of the moment stabilized.

Reboots are scary : D
reboot