How to install nginx-owasp-crs on Debian

OWASP ModSecurity Core Rule Set for NGINX

Vendor: GetPageSpeed https://coreruleset.org/

Availability

Compare package tracks by distribution and architecture. Checkmarks show the architectures available in each repository channel.

Distro	Channel	all	Version
Debian 13 (trixie)	Stable		4.30.0
Debian 12 (bookworm)	Stable		4.30.0

Description

The OWASP ModSecurity Core Rule Set (CRS) is a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls. The CRS aims to protect web applications from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts. This package installs the rule set under /etc/nginx/owasp-modsecurity-crs/ and provides a ready-to-use include manifest at /etc/nginx/modsec_includes.conf for loading with the ModSecurity-nginx connector.

Built for Debian.

Install

Stable Debian 12, 13

nginx-owasp-crs on Debian 12 (bookworm), 13 (trixie)

curl -fsSL https://extras.getpagespeed.com/release-latest.deb -o /tmp/getpagespeed-release.deb
sudo apt-get install -y /tmp/getpagespeed-release.deb
rm /tmp/getpagespeed-release.deb
sudo apt-get update
sudo apt-get install -y nginx-owasp-crs

Frequently asked questions

How do I install nginx-owasp-crs on Debian?

Add the GetPageSpeed repository, then install the nginx-owasp-crs package with your system package manager.

Which Debian versions is nginx-owasp-crs available for?

nginx-owasp-crs is available for Debian 12, 13.