modsecurity安装HTTP全量审计步骤

2024-04-07 21:58
文章标签 安装 步骤 http 审计 全量 modsecurity

本文主要是介绍modsecurity安装HTTP全量审计步骤，希望对大家解决编程问题提供一定的参考价值，需要的开发者们随着小编来一起学习吧！

1)cd /etc/httpd/modsecurity-crs/rules
2)在该目录创建新文件REQUEST-SELF-100-HTTP-audit.conf
vi REQUEST-SELF-100-HTTP-audit.conf
写入
SecRuleEngine DetectionOnly
SecRequestBodyAccess On
SecResponseBodyAccess On
SecAuditEngine On
SecAuditLogParts ABCIFEHZ
SecAuditLog /usr/local/apache/logs/audit.log
SecAuditLogType Concurrent
SecAuditLogStorageDir /usr/local/apache/audit/logs/audit


注解：
a)SecAuditLogType Concurrent 代表并行
b)/usr/local/apache/logs/audit.log和/usr/local/apache/audit/logs/audit请确保存在，没有需要自己创建。




3)验证配置
a)进入网站，执行操作。登录，修改内容均可以。
b) cat /usr/local/apache/logs/audit.log
看到如下：
 172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:16 +0800] "GET /centreon/include/common/javascript/autologoutXMLresponse.php?sid=g03dvbmv1tpq9plgpqtm7reds3 HTTP/1.1" 200 125 "-" "-" WMn8eKwbzgcAAD9mEUEAAAAG "-" /20170316/20170316-1046/20170316-104616-WMn8eKwbzgcAAD9mEUEAAAAG 0 2622 md5:1a9c3806299bb34f0e11a06252126348 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/main.php?p=60301&o=c&contact_id=56 HTTP/1.1" 200 115953 "-" "-" WMn8e6wbzgcAAD9iEFwAAAAC "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9iEFwAAAAC 0 127236 md5:44effca7ec920eae8a6b1d24aac66c30 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/Themes/Centreon-2/Modalbox/Color/blue_css.php HTTP/1.1" 200 405 "-" "-" WMn8e6wbzgcAAD9gD-QAAAAA "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9gD-QAAAAA 0 1950 md5:e530e4a72eb117f16e91a3d29119cf19 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/Themes/Centreon-2/Color/blue_css.php HTTP/1.1" 200 4959 "-" "-" WMn8e6wbzgcAAD9lEQgAAAAF "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9lEQgAAAAF 0 1944 md5:1ca3ace6eb8d3aa44303f379ba12d2ba 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/include/common/javascript/topCounterStatus/ajaxStatusCounter.js.php HTTP/1.1" 200 9962 "-" "-" WMn8e6wbzgcAAD9hECQAAAAB "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9hECQAAAAB 0 13512 md5:7c612b1feb6ed6bca0db250622682207 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/img/icones/16x16/clipboard.gif HTTP/1.1" 304 0 "-" "-" WMn8e6wbzgcAAD9nEXgAAAAH "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9nEXgAAAAH 0 2093 md5:42bc6cecd69d6dce26645f71f19304e3 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/include/common/javascript/keygen.js HTTP/1.1" 304 0 "-" "-" WMn8e6wbzgcAAD9jEJcAAAAD "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9jEJcAAAAD 0 2078 md5:dfbcf40646a093c8282655e34520f900 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/img/icones/16x16/mailer.gif HTTP/1.1" 304 0 "-" "-" WMn8e6wbzgcAAD9mEUIAAAAG "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9mEUIAAAAG 0 2088 md5:29861a17608eb8e7c4b0f78c2e15c97e 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/include/common/javascript/codebase/dhtmlxtree.php?sid=g03dvbmv1tpq9plgpqtm7reds3 HTTP/1.1" 200 66666 "-" "-" WMn8e6wbzgcAAD9kEM4AAAAE "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9kEM4AAAAE 0 70098 md5:7ded548ffcfabdc08ac682eb8669f85a 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/img/icones/16x16/centreon.gif HTTP/1.1" 200 1031 "-" "-" WMn8e6wbzgcAAD9iEF0AAAAC "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9iEF0AAAAC 0 1994 md5:b9bc5ebeb55a7fcee9684d5a2208e073 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/include/common/javascript/autologoutXMLresponse.php?sid=g03dvbmv1tpq9plgpqtm7reds3 HTTP/1.1" 200 125 "-" "-" WMn8e6wbzgcAAD9gD-UAAAAA "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9gD-UAAAAA 0 2659 md5:3e08d8a66d1d1640208c67d9b5ec794f 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "POST /centreon/include/monitoring/status/TopCounter/xml/ndo/statusCounter.php HTTP/1.1" 200 1301 "-" "-" WMn8e6wbzgcAAD9hECUAAAAB "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9hECUAAAAB 0 3572 md5:fb1b33bd7e3542398bc5ecdbaf3900ad 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:25 +0800] "POST /centreon/main.php?p=60301 HTTP/1.1" 200 114973 "-" "-" WMn8gKwbzgcAAD9nEXkAAAAH "-" /20170316/20170316-1046/20170316-104625-WMn8gKwbzgcAAD9nEXkAAAAH 0 125191 md5:d7c896371ed23c41d3a6de60bd8ee665 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:25 +0800] "GET /centreon/Themes/Centreon-2/Modalbox/Color/blue_css.php HTTP/1.1" 200 405 "-" "-" WMn8gawbzgcAAD9jEJgAAAAD "-" /20170316/20170316-1046/20170316-104625-WMn8gawbzgcAAD9jEJgAAAAD 0 1933 md5:a619803952ea0c0d989845cae63b5ee9 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:25 +0800] "GET /centreon/Themes/Centreon-2/Color/blue_css.php HTTP/1.1" 200 4959 "-" "-" WMn8gawbzgcAAD9lEQkAAAAF "-" /20170316/20170316-1046/20170316-104625-WMn8gawbzgcAAD9lEQkAAAAF 0 1928 md5:9741e7abd81da6d974c300e2d7cc7a8e 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:25 +0800] "GET /centreon/include/common/javascript/topCounterStatus/ajaxStatusCounter.js.php HTTP/1.1" 200 9962 "-" "-" WMn8gawbzgcAAD9mEUMAAAAG "-" /20170316/20170316-1046/20170316-104625-WMn8gawbzgcAAD9mEUMAAAAG 0 13495 md5:8bde9c0d7a769cdb013965349b81bc35 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:25 +0800] "GET /centreon/include/common/javascript/codebase/dhtmlxtree.php?sid=g03dvbmv1tpq9plgpqtm7reds3 HTTP/1.1" 200 66666 "-" "-" WMn8gawbzgcAAD9kEM8AAAAE "-" /20170316/20170316-1046/20170316-104625-WMn8gawbzgcAAD9kEM8AAAAE 0 70082 md5:1644ad8fe8b5359e6b68e8cdd3f191e5 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:25 +0800] "GET /centreon/include/common/javascript/autologoutXMLresponse.php?sid=g03dvbmv1tpq9plgpqtm7reds3 HTTP/1.1" 200 125 "-" "-" WMn8gawbzgcAAD9iEF4AAAAC "-" /20170316/20170316-1046/20170316-104625-WMn8gawbzgcAAD9iEF4AAAAC 0 2625 md5:b5b290b88891e8d91e0778eda26531a5 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:25 +0800] "POST /centreon/include/monitoring/status/TopCounter/xml/ndo/statusCounter.php HTTP/1.1" 200 1301 "-" "-" WMn8gawbzgcAAD9gD-YAAAAA "-" /20170316/20170316-1046/20170316-104625-WMn8gawbzgcAAD9gD-YAAAAA 0 3554 md5:a3103e533b037d0e66d393596c37958b 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:48:55 +0800] "POST /centreon/include/monitoring/status/TopCounter/xml/ndo/statusCounter.php HTTP/1.1" 200 1301 "-" "-" WMn9F6wbzgcAAD9hECYAAAAB "-" /20170316/20170316-1048/20170316-104855-WMn9F6wbzgcAAD9hECYAAAAB 0 3554 md5:5f1f86aff6d6b388e6970db4e6308248 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:48:55 +0800] "GET /centreon/include/common/javascript/autologoutXMLresponse.php?sid=g03dvbmv1tpq9plgpqtm7reds3 HTTP/1.1" 200 125 "-" "-" WMn9F6wbzgcAAD9nEXoAAAAH "-" /20170316/20170316-1048/20170316-104855-WMn9F6wbzgcAAD9nEXoAAAAH 0 2623 md5:f7ce6c112f2dc0522f2c37b83f21dfec 


c)cat /usr/local/apache/audit/logs/audit/20170316/20170316-1034/20170316-103453-WMn5zawbzgcAAD9iEFAAAAAC
可以看到具体的执行
--1e2c2150-A--
[16/Mar/2017:10:34:53 +0800] WMn5zawbzgcAAD9iEFAAAAAC 172.26.18.108 49824 172.27.206.7 80
--1e2c2150-B--
GET /centreon/include/common/javascript/jquery/plugins/colorbox/images/border.png HTTP/1.1
Host: 172.27.206.7
Connection: keep-alive
Accept: image/webp,image/*,*/*;q=0.8
If-None-Match: "1c14bd-a3-54aac03e225b9"
If-Modified-Since: Tue, 14 Mar 2017 07:45:43 GMT
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.97 Safari/537.36
Referer: http://172.27.206.7/centreon/main.php
Accept-Encoding: gzip, deflate, sdch
Accept-Language: zh-CN,zh;q=0.8
Cookie: PHPSESSID=g03dvbmv1tpq9plgpqtm7reds3


--1e2c2150-F--
HTTP/1.1 304 Not Modified
Last-Modified: Tue, 14 Mar 2017 07:45:43 GMT
ETag: "1c14bd-a3-54aac03e225b9"
Accept-Ranges: bytes
Content-Length: 0
Connection: close
Content-Type: image/png


--1e2c2150-E--


--1e2c2150-H--
Message: collection_retrieve_ex: Unable to retrieve collection (name "global", key "global"). Use SecDataDir to define data directory first.
Message: collection_retrieve_ex: Unable to retrieve collection (name "ip", key "172.26.18.108_cd85a82133a70fed9906fed8b8960aec0bf92efa"). Use SecDataDir to define data directory first.
Message: Warning. Pattern match "^[\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/httpd/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "793"] [id "920350"] [rev "2"] [msg "Host header is a numeric IP address"] [data "172.27.206.7"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"]
Stopwatch: 1489631693988843 1280 (- - -)
Stopwatch2: 1489631693988843 1280; combined=914, p1=175, p2=637, p3=22, p4=53, p5=27, sr=32, sw=0, l=0, gc=0
Response-Body-Transformed: Dechunked
Producer: ModSecurity for Apache/2.9.1 (http://www.modsecurity.org/); OWASP_CRS/3.0.0.
Server: Apache/2.2.15 (CentOS)
Engine-Mode: "DETECTION_ONLY"


--1e2c2150-Z--

这篇关于modsecurity安装HTTP全量审计步骤的文章就介绍到这儿，希望我们推荐的文章对编程师们有所帮助！


http://www.chinasem.cn/article/883783。

相关文章

Linux系统配置NAT网络模式的详细步骤(附图文)

Linux系统配置NAT网络模式的详细步骤(附图文)

《Linux系统配置NAT网络模式的详细步骤(附图文)》本文详细指导如何在VMware环境下配置NAT网络模式,包括设置主机和虚拟机的IP地址、网关,以及针对Linux和Windows系统的具体步骤,... 目录一、配置NAT网络模式二、设置虚拟机交换机网关2.1 打开虚拟机2.2 管理员授权2.3 设置子
阅读更多...
使用Python实现快速搭建本地HTTP服务器

使用Python实现快速搭建本地HTTP服务器

《使用Python实现快速搭建本地HTTP服务器》：本文主要介绍如何使用Python快速搭建本地HTTP服务器,轻松实现一键HTTP文件共享,同时结合二维码技术,让访问更简单,感兴趣的小伙伴可以了... 目录1. 概述2. 快速搭建 HTTP 文件共享服务2.1 核心思路2.2 代码实现2.3 代码解读3.
阅读更多...
Linux系统中卸载与安装JDK的详细教程

Linux系统中卸载与安装JDK的详细教程

《Linux系统中卸载与安装JDK的详细教程》本文详细介绍了如何在Linux系统中通过Xshell和Xftp工具连接与传输文件,然后进行JDK的安装与卸载,安装步骤包括连接Linux、传输JDK安装包... 目录1、卸载1.1 linux删除自带的JDK1.2 Linux上卸载自己安装的JDK2、安装2.1
阅读更多...
Linux卸载自带jdk并安装新jdk版本的图文教程

Linux卸载自带jdk并安装新jdk版本的图文教程

《Linux卸载自带jdk并安装新jdk版本的图文教程》在Linux系统中,有时需要卸载预装的OpenJDK并安装特定版本的JDK,例如JDK1.8,所以本文给大家详细介绍了Linux卸载自带jdk并... 目录Ⅰ、卸载自带jdkⅡ、安装新版jdkⅠ、卸载自带jdk1、输入命令查看旧jdkrpm -qa
阅读更多...
Spring Boot3虚拟线程的使用步骤详解

Spring Boot3虚拟线程的使用步骤详解

《SpringBoot3虚拟线程的使用步骤详解》虚拟线程是Java19中引入的一个新特性,旨在通过简化线程管理来提升应用程序的并发性能,：本文主要介绍SpringBoot3虚拟线程的使用步骤,... 目录问题根源分析解决方案验证验证实验实验1：未启用keep-alive实验2：启用keep-alive扩展建
阅读更多...
MySQL Workbench 安装教程(保姆级)

MySQL Workbench 安装教程(保姆级)

《MySQLWorkbench安装教程(保姆级)》MySQLWorkbench是一款强大的数据库设计和管理工具,本文主要介绍了MySQLWorkbench安装教程,文中通过图文介绍的非常详细,对大... 目录前言：详细步骤：一、检查安装的数据库版本二、在官网下载对应的mysql Workbench版本，要是
阅读更多...
Python下载Pandas包的步骤

Python下载Pandas包的步骤

《Python下载Pandas包的步骤》：本文主要介绍Python下载Pandas包的步骤,在python中安装pandas库,我采取的方法是用PIP的方法在Python目标位置进行安装,本文给大... 目录安装步骤1、首先找到我们安装python的目录2、使用命令行到Python安装目录下3、我们回到Py
阅读更多...
Linux安装MySQL的教程

Linux安装MySQL的教程

《Linux安装MySQL的教程》：本文主要介绍Linux安装MySQL的教程,具有很好的参考价值,希望对大家有所帮助,如有错误或未考虑完全的地方,望不吝赐教... 目录linux安装mysql1.Mysql官网2.我的存放路径3.解压mysql文件到当前目录4.重命名一下5.创建mysql用户组和用户并修
阅读更多...
pip无法安装osgeo失败的问题解决

pip无法安装osgeo失败的问题解决

《pip无法安装osgeo失败的问题解决》本文主要介绍了pip无法安装osgeo失败的问题解决,文中通过示例代码介绍的非常详细,对大家的学习或者工作具有一定的参考学习价值,需要的朋友们下面随着小编来一... 进入官方提供的扩展包下载网站寻找版本适配的whl文件注意：要选择cp（python版本）和你py
阅读更多...
SpringBoot项目使用MDC给日志增加唯一标识的实现步骤

SpringBoot项目使用MDC给日志增加唯一标识的实现步骤

《SpringBoot项目使用MDC给日志增加唯一标识的实现步骤》本文介绍了如何在SpringBoot项目中使用MDC（MappedDiagnosticContext）为日志增加唯一标识,以便于日... 目录【Java】SpringBoot项目使用MDC给日志增加唯一标识,方便日志追踪1.日志效果2.实现步
阅读更多...

Copyright China编程 23002807@qq.com

沪ICP备2023033072号-2