Errors appear when attempting to use Comodo ruleset in Plesk Web Application Firewall (ModSecurity)

Symptoms

• All websites show a 502 Bad Gateway error when the Comodo ModSecurity ruleset is used in Plesk

• The Plesk Web Application Firewall (ModSecurity) shows an error that is similar to the following when you attempt to use the Comodo (free) ruleset in combination with Apache (ModSecurity 2.9):

  PLESK_ERROR: modsecurity_ctl failed: START httpd_modules_ctl --enable security2,unique_id
  apache_control_adapter[1101708]: apache_action(restart): invoke_httpd_action failed, trying second time
  INFO: [Tue Oct  7 12:25:09 WEST 2025]: Service: apache, Action: start
  Trying to start service httpd... activating
  
  *****  problem report *****
  Warning: start service httpd failed
  
  /usr/local/psa/admin/sbin/pleskrc execution failed:
  Job for httpd.service failed because the control process exited with error code.
  See "systemctl status httpd.service" and "journalctl -xe" for details.
  /usr/local/psa/admin/sbin/pleskrc execution failed:
  Job for httpd.service failed because the control process exited with error code.
  See "systemctl status httpd.service" and "journalctl -xe" for details

• Switching to the Atomic Standard ruleset may resolve the issue

• The Plesk UI may display the following error message:

  PLESK_ERROR: AH00526: Syntax error on line 6035 of /etc/httpd/conf/modsecurity.d/rules/comodo_free/30_Apps_OtherApps.conf: Error creating rule: Error compiling pattern (offset 4): invalid range in character class

Cause

The mod_security package that is installed on your server is from the Atomic repository instead of from the Plesk repository and it is therefore not fully compatible with the current Comodo rule set.

Resolution

In order to replace the currently installed mod_security package with a package that is provided by Plesk and is compatible with the current Comodo rule set, you must execute the following steps:

1. Connect to the Plesk server via SSH

2. Execute the following command:

   Note: Replace PLESK_18_0_70 in the command below with the exact major version of Plesk that you are using

   # dnf swap mod_security mod_security --enablerepo=PLESK_18_0_70-extras --disablerepo=atomic --skip-broken