nginx build requires apache, it shouldn't.

[jvanasco]

it doesn't seem possible to build for nginx without installing apache - the configure script wants/needs to build the DSO with apache's APXS

it would be nice if this could be built without apache, or at least only using the apache source (without having to install apache). the most straightforward way of installing for nginx on an ubuntu machine requires installing the apache2-prefork-dev package, which in turn installs a bunch of unnecessary files and will compete with nginx for control of http services.

I have tried to compile this with both --enable-standalone-module (per Nginx instructions) and --disable-apache2-module and get in error in the apache2/modsecurity.h file. Since the instructions I am following are for Nginx and Nginx does not require Apache, I would expect this to compile without the Apache module in the first case and certainly expect it to forego Apache in the with both options. No Apache2 components are installed on this server. All other libraries are present.

[rcbarnett-zz]

ModSecurity relies upon Apache Runtime (APR) regardless of web server platform. The APR libs are needed in order to build the API wrapper to plug into non-Apache web servers.

Thanks. I am looking for something Apache-independent. This does not appear to meet my needs. You may want to include the libraries required to install this Nginx with your instructions as this was not-at-all clear and would save others time and effort.

What functionality does ModSecurity require from the APR that makes it require APR for nginx?

[zimmerle]

Hi @skeyl,

ModSecurity for nginx depends on ModSecurity standalone library. ModSecurity standalone is just a wrapper to Apache internals. In other words: ModSecurity for nginx depends not only on APR but also Apache. All the memory management is made using APR pools.

We are currently working on the libModSecurity which is a version that does not depends on Apache or APR anymore. You can check more information here:

https://github.com/SpiderLabs/ModSecurity/tree/libmodsecurity/

There is also a "nginx connector" here:

https://github.com/SpiderLabs/ModSecurity-nginx

[zimmerle]

Won't fix in 2.x. libmodsecurity no longer depends on apache or apr.

Further information available here - https://github.com/SpiderLabs/ModSecurity-nginx