<IfModule mod_security2.c>
    # Basic configuration options
    SecRuleEngine On
    Include /usr/share/doc/mod-security-common/examples/rules/modsecurity_crs_10_global_config.conf
    Include /usr/share/doc/mod-security-common/examples/rules/optional_rules/*.conf
    Include /usr/share/doc/mod-security-common/examples/rules/base_rules/*.conf

    SecRequestBodyAccess On
    SecResponseBodyAccess Off

    # Handling of file uploads
    # TODO Choose a folder private to Apache.
    # SecUploadDir /opt/apache-frontend/tmp/
    SecUploadKeepFiles Off

    # Debug log
    SecDebugLog /var/log/apache2/modsec_debug.log
    SecDebugLogLevel 3

    # Serial audit log
    SecAuditEngine RelevantOnly
    SecAuditLogRelevantStatus ^5
    SecAuditLogParts ABIFHZ
    SecAuditLogType Serial
    SecAuditLog /var/log/apache2/modsec_audit.log

    # Maximum request body size we will
    # accept for buffering
    SecRequestBodyLimit 131072

    # Store up to 128 KB in memory
    SecRequestBodyInMemoryLimit 131072

    # Buffer response bodies of up to
    # 512 KB in length
    SecResponseBodyLimit 524288

    # Verify that we've correctly processed the request body.
    # As a rule of thumb, when failing to process a request body
    # you should reject the request (when deployed in blocking mode)
    # or log a high-severity alert (when deployed in detection-only mode).
    SecRule REQBODY_PROCESSOR_ERROR "!@eq 0" \
    "phase:2,t:none,log,deny,msg:'Failed to parse request body.',severity:2"

    # By default be strict with what we accept in the multipart/form-data
    # request body. If the rule below proves to be too strict for your
    # environment consider changing it to detection-only. You are encouraged
    # _not_ to remove it altogether.
    SecRule MULTIPART_STRICT_ERROR "!@eq 0" \
    "phase:2,t:none,log,deny,msg:'Multipart request body \
    failed strict validation: \
    PE %{REQBODY_PROCESSOR_ERROR}, \
    BQ %{MULTIPART_BOUNDARY_QUOTED}, \
    BW %{MULTIPART_BOUNDARY_WHITESPACE}, \
    DB %{MULTIPART_DATA_BEFORE}, \
    DA %{MULTIPART_DATA_AFTER}, \
    HF %{MULTIPART_HEADER_FOLDING}, \
    LF %{MULTIPART_LF_LINE}, \
    SM %{MULTIPART_SEMICOLON_MISSING}, \
    IQ %{MULTIPART_INVALID_QUOTING}'"

    # Did we see anything that might be a boundary?
    SecRule MULTIPART_UNMATCHED_BOUNDARY "!@eq 0" \
    "phase:2,t:none,log,deny,msg:'Multipart parser detected a possible unmatched boundary.'"
</IfModule>

# Include the virtual host configurations:
Include /etc/apache2/sites-enabled/

<IfModule mod_security2.c>
    # Basic configuration options
    SecRuleEngine On
    Include /usr/share/doc/mod-security-common/examples/rules/modsecurity_crs_10_global_config.conf
    Include /usr/share/doc/mod-security-common/examples/rules/optional_rules/*.conf
    Include /usr/share/doc/mod-security-common/examples/rules/base_rules/*.conf

    #Rule to exclude phpmyadmin
    <LocationMatch '^/phpmyadmin/'>
    SecRuleRemoveById 981143,981185,981186,981203,981144,981060,981184,981203
    </LocationMatch>

    SecRequestBodyAccess On
    SecResponseBodyAccess Off
....
...
..
.