Resolving ModSecurity SecDataDir Permission Issues: Debugging and Replacing mod_ruid2 with mod_suexec in WHM

The error collections_remove_stale: Failed to access DBM file ... Permission denied comes from ModSecurity, the web application firewall inside Apache. It means ModSecurity can't read or clean up the files where it keeps data between requests. On a cPanel server this is almost always caused by the old Apache module mod_ruid2. This guide explains what the message means for a website on shared hosting, and, in a clearly marked section, how to fix it on a cPanel server you manage yourself.

1. What SecDataDir is

ModSecurity can remember things across requests: how many requests an IP address has made, a score for a session, or a count for the whole server. These persistent collections are stored as small database (DBM) files in the folder named by the SecDataDir directive. On cPanel servers that folder is usually /var/cpanel/secdatadir.

Apache processes read and write those files, and ModSecurity regularly removes stale entries. That works when every Apache process runs as the same system user. It breaks when different processes run as different users.

2. Why mod_ruid2 causes the error

mod_ruid2 made each Apache process switch to the owner of the website it was serving. A file created while serving one account belonged to that account's user, so the next process, running as a different user, got Permission denied when it tried to read or clean it.

Typical symptoms on the server:

• ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/...": Permission denied repeating in the Apache error log;
• rules that rely on collections, such as rate limits, silently not working;
• the error disappearing after a chown of the folder, then returning within hours.

mod_ruid2 is no longer maintained, cPanel has deprecated it, and current EasyApache 4 builds on AlmaLinux, Rocky Linux and CloudLinux 8 and later don't offer it. If you still run it, you are on an old setup that needs moving anyway.

3. On Domain India shared hosting

If you host with us on cPanel, DirectAdmin or Webuzo shared hosting, this error is not yours to fix and not something you can see. It would appear only in the server's main Apache log, and Apache's modules, ModSecurity and its data folder are configured by us for the whole server. Customers can't change them, and ModSecurity can't be switched off per domain.

What you might notice as a website owner is different: one action on your site, such as saving a post, submitting a form or uploading a file, fails with 403 Forbidden while the rest of the site works. That is usually a ModSecurity rule blocking a request it mistook for an attack.

For the full picture on shared hosting, read configuring ModSecurity in cPanel.

4. On your own cPanel server: confirm the cause

Everything from here on applies only to a cPanel and WHM server where you have root access, for example a server with your own cPanel licence. A Domain India VPS is self-managed and comes without cPanel.

Check the Apache error log for the message and see whether mod_ruid2 is loaded:

grep -c "collections_remove_stale" /etc/apache2/logs/error_log
httpd -M 2>/dev/null | grep -Ei "ruid2|suexec|mpm"
ls -ld /var/cpanel/secdatadir
ls -l /var/cpanel/secdatadir | head

If ruid2_module appears and the files in the folder belong to many different account users, you have found the cause. Don't rely on rpm -qa alone to check modules; httpd -M shows what Apache actually loaded.

5. On your own cPanel server: replace mod_ruid2

The current cPanel model is PHP-FPM for PHP, with each domain's pool running as the account user, and mod_suexec for CGI scripts. Apache itself then runs as one user, so ModSecurity's data folder works again.

After the change, test sites that used to rely on per-user Apache processes, such as scripts that write files. Under PHP-FPM, PHP still runs as the account user, so file ownership inside home folders is unchanged.

6. Prevent it happening again

• Check module compatibility before installing anything in EasyApache 4, especially modules that change which user Apache runs as.
• Keep cPanel and EasyApache 4 updated, and read cPanel's deprecation notices; deprecated modules disappear in later versions.
• Know what your ruleset needs. If your ModSecurity rules don't use persistent collections, you may not need SecDataDir activity at all. Check your ruleset's documentation before changing directives.
• Test on a staging server where you can, and keep the saved EasyApache profile until you are sure.

For ModSecurity logs, directives and tuning on a server you manage, see the comprehensive guide to ModSecurity.

7. Where Domain India fits

Our shared hosting runs ModSecurity server-wide, managed by us, so you get the protection without maintaining modules or data folders. If you need to configure Apache and ModSecurity yourself, a VPS gives you root access; it is self-managed, and you install the software stack you want.

Ready to get a blocked action working? Collect the URL, the time and your IP address and open a support ticket. Running your own server instead? Compare VPS plans.