1

I am currently installing ModSecurity on our development servers and the problem that I am running into with the latest version is that we are utilizing RHEL 4 on our servers. They have no intention of updating them further (even after multiple attempts to inform them). Now, with RHEL 4 the latest version of libxml2 is 2.6.16 - Therein lies my problem - With the newer ModSecurity versions it requires a later version of libxml2 (2.6.29??)

My question is, is it possible to port the latest required version of libxml2 to RHEL 4 that way I can use the latest version of ModSecurity?

For now I am using ModSecurity version 2.1.7 and seem to have it working, but I would much rather use the latest version.

Thanks!

1

is it possible to port the latest required version of libxml2 to RHEL 4 that way I can use the latest version of ModSecurity?

Yes. The ideal way to do this is to install it into /usr/local, presumably building from source. After the build and install, you will need (as root) to run ldconfig to update the linker cache. Libraries in /usr/local/lib should by default take precedence; you can check this with ldconfig -p | grep libxml2 which should give you something like:

libxml2.so.2 (libc6,x86-64) => /usr/local/lib/libxml2.so.2

You will need to restart apache.

However, you should first check that libxml2 2.6.29 is backward compatible with 2.6.16. It almost certainly is, but if not, you will need to install it into a custom path, e.g., /opt/libxml2 and start apache with a script including:

export LD_LIBRARY_PATH=/opt/libxml2:$LD_LIBRARY_PATH

In this case the linker cache does not need updating since you don't want the alternate version there. LD_LIBRARY_PATH, if defined, is searched by the linker before it checks its cached links. But do not use this method unless you absolutely have to. Almost certainly 2.6.29 is fine in /usr/local. If not, there should be clear indication of this on their web site and/or in the NEWS file in the source package.

  • So essential if I were to install it in it's own path then I could point apache to use that version of libxml2 - that way if any other processes depend on the old libxml2 then they can use the 2.6.16 version since it will be untouched. Also, I just checked with /sbin/ldconfig -p | grep libxml2 and I get two entries already: libxml2.so.2 (libc6) => /usr/lib/libxml2.so.2 libxml2.so (libc6) => /usr/lib/libxml2.so – Christopher Stanley Oct 16 '14 at 19:07
  • Those both probably amount to the same if you check the links in /usr/lib. Again, only use the custom path if you know you need to, because (perhaps counter-intuitively...) it is the strategy most likely to lead to further headaches and complications. – goldilocks Oct 16 '14 at 19:33
  • You were right, they point to the same file! Thanks again for your help, I am going to test this! Also, when you stated that I need to compile libxml2 2.26.29 do you mean I need to grab the source and configure and make it? – Christopher Stanley Oct 16 '14 at 19:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.