Did anyone have success in configuring Mod security? I am trying to set up Mod security (the Apache module) for my Drupal site, but it affects basic Drupal functionalities like node submission, module enable/disable and people permission submissions etc.

I am using:


Drupal 7.56 
Mod Security 2.91 
Owasp crs 3.0
Apache 2.4


Did anyone have success in configuring Mod security based on Drupal application?
Using OWASP CRS v3.0.2 (https://github.com/SpiderLabs/owasp-modsecurity-crs/releases/tag/v3.0.2) you should find no major issues here. Drupal has it's own set of exclusions out of the box because it does things that can be considered bad practice (passing tags via parameters, etc). As outlined in the docs you should uncomment rule 900130 and enable the Drupal exceptions. There is even an example of how to do so.

https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.0/master/crs-setup.conf.example#L302

Enjoy!