libapache-mod-security2 ships /etc/modsecurity/modsecurity.conf.recommended not
as modsecurity.conf. So, the user needs to cp that .recommnded file to
/etc/modsecurity/modsecurity.conf to get a starting point. It is then not a
conffile for dpkg.

If it is possible that a package delivers a working default configuration, it
should do so (and that configuration should be active.) modsecurity.conf.recommended
sounds to me that this should be the case here.

The downside of the current sitation means that the conf file will not be
updated when a package update happens and the user didn't change the recommendations.
changes to their modsecurity.conf (IOW the user had modsecurity.conf ==
modsecurity.conf.recommended when they copied it).

This might also keep people exposed to fixed vulnerabilties, when those fixes
require to update the configuration.

(A step further would be to think about something like
/etc/modsecurity/site-conf.d/, where users can put in their modifications and
this diectory is included in the modsecurity configuration… That would decrease
the probability that users get confile prompts even more)

Hi Tobias,

thanks for your report and other notes.

The mentioned configuration file (modsecurity.conf(.recommended))
is part of ModSecurity2. But the package itself
(modsecurity-apache) depends on modsecurity-crs, and this package
uses the same directory (/etc/modsecurity), so there is a strong
connection between these packages.

As I explained in bug #1029836[1], we have to review the package
modsecurity-crs, but I think based on your report (this issue) we
*MUST* review the whole structure in the future.


Thank you again.


a.


1: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1029836