Compiling for NGINX without Apache

[infinitnet]

Even though I use --disable-apache2-module to compile the standalone module, configure fails with "configure: error: couldn't find APXS". Now to install APXS I have to install the Apache development packages. The problem is, that with Debian based systems, even if you use something like --no-install-recommends with apt, it forces you to install Apache and not only the development libraries. Is there any way around this? I have NGINX running and don't want to bloat my system with Apache. It would cause other issues too, because I'd always have to keep an eye on Apache after OS updates, so it doesn't start automatically and interferes with NGINX.

[leejsinclair]

I've been working through this for a couple of hours now.. still have not got all the missing libraries but this is where i'm up to (Ubuntu 13 server):

wget https://github.com/SpiderLabs/ModSecurity/archive/master.zip
wget http://nginx.org/download/nginx-1.5.12.tar.gz
wget http://zlib.net/zlib-1.2.8.tar.gz

tar zxvf nginx-1.5.12.tar.gz
unzip master.zip
tar zxvf zlib-1.2.8.tar.gz

sudo apt-get update

# Get missing libraries for mod_security
sudo apt-get install libpcre3 libpcre3-dev lighttpd-dev apache2-prefork-dev
sudo apt-get install apache2-prefork-dev apache2-threaded-dev libxml2-dev libtool autoconf
sudo apt-get install libcurl4-openssl-dev libcurl4-nss-dev libcurl4-gnutls-dev

# install zlib, another missing library
cd zlib-1.2.8
./configure
make && sudo make install

cd ../ModSecurity-master
./autogen.sh
./configure --enable-standalone-module
make

This is where I'm up to, it continues to complain about some curl library. It is a worry that so many libraries need to be installed.

Has anyone got past this point?

[wellumies]

This is how I did it in Debian Wheezy

cd /opt
wget https://www.modsecurity.org/tarball/2.7.7/modsecurity-apache_2.7.7.tar.gz

tar -xvf modsecurity-apache_2.7.7.tar.gz

ln -s modsecurity-apache_2.7.7/ mod_security
cd /mod_security

apt-get install build-essential libxml2 libxml2-dev libxml2-utils apache2-threaded-dev libcurl3-dev

~/mod_security# ./configure --enable-standalone-module
~/mod_security# make
~/mod_security# make install (it will generate the NGINX config file)

cd ..

wget http://nginx.org/download/nginx-1.4.1.tar.gz
tar -xvf nginx-1.4.1.tar.gz
cd nginx-1.4.1/

./configure --add-module=../mod_security/nginx/modsecurity
make
make install

root@debian:/opt/nginx# uname -a
Linux debian 3.2.0-4-amd64 #1 SMP Debian 3.2.54-2 x86_64 GNU/Linux
root@debian:/opt/nginx# lsb_release
No LSB modules are available.
root@debian:/opt/nginx# lsb_release -a
No LSB modules are available.
Distributor ID: Debian
Description: Debian GNU/Linux 7.4 (wheezy)
Release: 7.4
Codename: wheezy
root@debian:/opt/nginx#

[infinitnet]

Well, my problem/concern is that if I install 'apache2-threaded-dev' or 'apache2-prefork-dev' via apt, it forces me to also install the Apache binaries with it, even when using '--no-install-recommends'. We already use NGINX as a web server, so it's rather bad if we're forced to install Apache too in order to compile mod_sec. Furthermore, if we configure mod_sec with '--disable-apache2-module', shouldn't it actually stop insisting on APXS, or is that also a requirement to compile the NGINX module?

[infinitnet]

Anyone?

[zimmerle]

@infinitnet more information on the dependencies are available here: #661.

[infinitnet]

@zimmerle Thanks for pointing that out - sorry I missed that existing report. So is anyone working on this already and if so, is there an ETA? It's great that mod_sec for NGINX is finally out of it's alpha/beta phase, but it's dependency on Apache is really annoying with NGINX-only systems.

[rcbarnett-zz]

You have a valid point, however you need to understand how we were able to port ModSecurity to other platforms. ModSecurity relies heavily on Apache Runtime (APR). It would take a massive recoding to remove those dependencies from the code. What we opted to do was to create a light-weight APR wrapper around ModSecurity to "trick" it into thinking it is always running inside Apache even when it is inside IIS, Nginx, Java, etc... We understand that the dependencies to initially compile it are cumbersome but it is necessary for it to work.

We will still investigate ways to make this easier. Hope you understand.

[infinitnet]

Wouldn't it be possible to simply include all Apache libs/files needed into the ModSecurity bundle and pull everything that's required for compilation from there instead of from the system environment?

[infinitnet]

To come back to this again - for example ngx_pagespeed bundles the APR libraries with PSOL, so it's not required to install the system packages, even though it also relies on APR and this solution works nicely. It would be nice if ModSecurity for NGINX could offer a similar solution.

[infinitnet]

It works fine now with a pull from the latest nginx_refacturing branch, but only if you compile ngx_pagespeed before ModSec.

[msva]

@infinitnet can you paste an example how do you compiling it with pagespeed? ;)

[infinitnet]

@msva Do you mean the configure options or the whole process or anything other specific?

[msva]

It would be nice to look on the whole build.log, since I'm unable to build modsecurity without apache installed even from nginx_refactoring branch :(

make CFLAGS="-I/usr/include/apr-1 -I../psol/include/third_party/httpd24/src/include -I../psol/include/third_party/httpd24/src/os/unix -I../psol/include/third_party/httpd24/gen/arch/linux/x64/include -I/usr/include/libxml2"
make -f objs/Makefile
make[1]: Entering directory `/var/tmp/portage/www-servers/nginx-1.7.4/work/nginx-1.7.4'
x86_64-pc-linux-gnu-gcc -c -I/usr/include/apr-1 -I../psol/include/third_party/httpd24/src/include -I../psol/include/third_party/httpd24/src/os/unix -I../psol/include/third_party/httpd24/gen/arch/linux/x64/include -I/usr/include/libxml2  -I src/core -I src/event -I src/event/modules -I src/os/unix -I ../ngx_pagespeed-1.8.31.4-beta/psol/include -I ../ngx_pagespeed-1.8.31.4-beta/psol/include/third_party/chromium/src -I ../ngx_pagespeed-1.8.31.4-beta/psol/include/third_party/google-sparsehash/src -I ../ngx_pagespeed-1.8.31.4-beta/psol/include/third_party/google-sparsehash/gen/arch/linux/x64/include -I ../ngx_pagespeed-1.8.31.4-beta/psol/include/third_party/protobuf/src -I ../ngx_pagespeed-1.8.31.4-beta/psol/include/third_party/re2/src -I ../ngx_pagespeed-1.8.31.4-beta/psol/include/out/Release/obj/gen -I ../ngx_pagespeed-1.8.31.4-beta/psol/include/out/Release/obj/gen/protoc_out/instaweb -I ../ngx_pagespeed-1.8.31.4-beta/psol/include/third_party/apr/src/include -I ../ngx_pagespeed-1.8.31.4-beta/psol/include/third_party/aprutil/src/include -I ../ngx_pagespeed-1.8.31.4-beta/psol/include/third_party/apr/gen/arch/linux/x64/include -I ../ngx_pagespeed-1.8.31.4-beta/psol/include/third_party/aprutil/gen/arch/linux/x64/include -I ../ModSecurity-33b8760e87b7441142a431175d5b459245551314/nginx/modsecurity -I ../ModSecurity-33b8760e87b7441142a431175d5b459245551314/nginx/modsecurity/../../standalone -I ../ModSecurity-33b8760e87b7441142a431175d5b459245551314/nginx/modsecurity/../../apache2 -I objs -I src/http -I src/http/modules -I src/mail \
        -o objs/addon/modsecurity/ngx_http_modsecurity.o \
        ../ModSecurity-33b8760e87b7441142a431175d5b459245551314/nginx/modsecurity/ngx_http_modsecurity.c
In file included from ../ModSecurity-33b8760e87b7441142a431175d5b459245551314/nginx/modsecurity/ngx_http_modsecurity.c:28:0:
../ModSecurity-33b8760e87b7441142a431175d5b459245551314/nginx/modsecurity/../../standalone/api.h:29:28: fatal error: mod_log_config.h: No such file or directory
compilation terminated.
make[1]: *** [objs/addon/modsecurity/ngx_http_modsecurity.o] Error 1
make[1]: Leaving directory `/var/tmp/portage/www-servers/nginx-1.7.4/work/nginx-1.7.4'
make: *** [build] Error 2

[msva]

@infinitnet can you reopen issue, since it is still impossible to build ModSecurity without apache headers and, probably, apsx too?