How do I find out if mod_security is installed on my apache server?

How can I find out if mod_security is installed on my apache server? I would also like to learn its version.

I'm having some upload issues and I tried to disable mod_security using .htaccess. But that started producing 500 internal server errors.

I read somewhere that depending on my mod_security version I might not be able to disable it using .htaccess. So I would like to understand if I have mod_security installed and what version it is.

I'm on a centos 5 box.

Thanks!

UPDATE -1 xxxxxxxxxxxxx

Does the below output mean I do not have mod_security installed?

[root@u11 htdocs]# httpd -l

Compiled in modules:
  core.c
  prefork.c
  http_core.c
  mod_so.c

No - the output listed above just describes the pre-compiled in modules.

The presence of the mod_so.c entry however means that Apache is capable of dynamically loading additional modules.

If you have access to the central configuration you could just go look at this and check to see if there's a line like:

LoadModule security_module modules/mod_security.so

If there is then you have mod_security loaded - NOTE: this could be within an included configuration file as well.

Assuming your configuration is located in /etc/httpd - you could run the following to find if the config is present:

grep -ir security_module /etc/httpd

(Replace /etc/httpd with the central configuration directory).

If you don't have access to the server config you could use an <IfModule mod_security.c> statement within your .htaccess to see if it's enabled:

<IfModule mod_security.c>

... Perform some kind of redirect or re-writing in here ...

</IfModule>

Hope this helps.