modsecurity安装HTTP全量审计步骤

2024-04-07 21:58
文章标签 安装 步骤 http 审计 全量 modsecurity

本文主要是介绍modsecurity安装HTTP全量审计步骤，希望对大家解决编程问题提供一定的参考价值，需要的开发者们随着小编来一起学习吧！

1)cd /etc/httpd/modsecurity-crs/rules
2)在该目录创建新文件REQUEST-SELF-100-HTTP-audit.conf
vi REQUEST-SELF-100-HTTP-audit.conf
写入
SecRuleEngine DetectionOnly
SecRequestBodyAccess On
SecResponseBodyAccess On
SecAuditEngine On
SecAuditLogParts ABCIFEHZ
SecAuditLog /usr/local/apache/logs/audit.log
SecAuditLogType Concurrent
SecAuditLogStorageDir /usr/local/apache/audit/logs/audit


注解：
a)SecAuditLogType Concurrent 代表并行
b)/usr/local/apache/logs/audit.log和/usr/local/apache/audit/logs/audit请确保存在，没有需要自己创建。




3)验证配置
a)进入网站，执行操作。登录，修改内容均可以。
b) cat /usr/local/apache/logs/audit.log
看到如下：
 172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:16 +0800] "GET /centreon/include/common/javascript/autologoutXMLresponse.php?sid=g03dvbmv1tpq9plgpqtm7reds3 HTTP/1.1" 200 125 "-" "-" WMn8eKwbzgcAAD9mEUEAAAAG "-" /20170316/20170316-1046/20170316-104616-WMn8eKwbzgcAAD9mEUEAAAAG 0 2622 md5:1a9c3806299bb34f0e11a06252126348 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/main.php?p=60301&o=c&contact_id=56 HTTP/1.1" 200 115953 "-" "-" WMn8e6wbzgcAAD9iEFwAAAAC "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9iEFwAAAAC 0 127236 md5:44effca7ec920eae8a6b1d24aac66c30 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/Themes/Centreon-2/Modalbox/Color/blue_css.php HTTP/1.1" 200 405 "-" "-" WMn8e6wbzgcAAD9gD-QAAAAA "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9gD-QAAAAA 0 1950 md5:e530e4a72eb117f16e91a3d29119cf19 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/Themes/Centreon-2/Color/blue_css.php HTTP/1.1" 200 4959 "-" "-" WMn8e6wbzgcAAD9lEQgAAAAF "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9lEQgAAAAF 0 1944 md5:1ca3ace6eb8d3aa44303f379ba12d2ba 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/include/common/javascript/topCounterStatus/ajaxStatusCounter.js.php HTTP/1.1" 200 9962 "-" "-" WMn8e6wbzgcAAD9hECQAAAAB "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9hECQAAAAB 0 13512 md5:7c612b1feb6ed6bca0db250622682207 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/img/icones/16x16/clipboard.gif HTTP/1.1" 304 0 "-" "-" WMn8e6wbzgcAAD9nEXgAAAAH "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9nEXgAAAAH 0 2093 md5:42bc6cecd69d6dce26645f71f19304e3 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/include/common/javascript/keygen.js HTTP/1.1" 304 0 "-" "-" WMn8e6wbzgcAAD9jEJcAAAAD "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9jEJcAAAAD 0 2078 md5:dfbcf40646a093c8282655e34520f900 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/img/icones/16x16/mailer.gif HTTP/1.1" 304 0 "-" "-" WMn8e6wbzgcAAD9mEUIAAAAG "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9mEUIAAAAG 0 2088 md5:29861a17608eb8e7c4b0f78c2e15c97e 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/include/common/javascript/codebase/dhtmlxtree.php?sid=g03dvbmv1tpq9plgpqtm7reds3 HTTP/1.1" 200 66666 "-" "-" WMn8e6wbzgcAAD9kEM4AAAAE "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9kEM4AAAAE 0 70098 md5:7ded548ffcfabdc08ac682eb8669f85a 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/img/icones/16x16/centreon.gif HTTP/1.1" 200 1031 "-" "-" WMn8e6wbzgcAAD9iEF0AAAAC "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9iEF0AAAAC 0 1994 md5:b9bc5ebeb55a7fcee9684d5a2208e073 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/include/common/javascript/autologoutXMLresponse.php?sid=g03dvbmv1tpq9plgpqtm7reds3 HTTP/1.1" 200 125 "-" "-" WMn8e6wbzgcAAD9gD-UAAAAA "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9gD-UAAAAA 0 2659 md5:3e08d8a66d1d1640208c67d9b5ec794f 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "POST /centreon/include/monitoring/status/TopCounter/xml/ndo/statusCounter.php HTTP/1.1" 200 1301 "-" "-" WMn8e6wbzgcAAD9hECUAAAAB "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9hECUAAAAB 0 3572 md5:fb1b33bd7e3542398bc5ecdbaf3900ad 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:25 +0800] "POST /centreon/main.php?p=60301 HTTP/1.1" 200 114973 "-" "-" WMn8gKwbzgcAAD9nEXkAAAAH "-" /20170316/20170316-1046/20170316-104625-WMn8gKwbzgcAAD9nEXkAAAAH 0 125191 md5:d7c896371ed23c41d3a6de60bd8ee665 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:25 +0800] "GET /centreon/Themes/Centreon-2/Modalbox/Color/blue_css.php HTTP/1.1" 200 405 "-" "-" WMn8gawbzgcAAD9jEJgAAAAD "-" /20170316/20170316-1046/20170316-104625-WMn8gawbzgcAAD9jEJgAAAAD 0 1933 md5:a619803952ea0c0d989845cae63b5ee9 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:25 +0800] "GET /centreon/Themes/Centreon-2/Color/blue_css.php HTTP/1.1" 200 4959 "-" "-" WMn8gawbzgcAAD9lEQkAAAAF "-" /20170316/20170316-1046/20170316-104625-WMn8gawbzgcAAD9lEQkAAAAF 0 1928 md5:9741e7abd81da6d974c300e2d7cc7a8e 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:25 +0800] "GET /centreon/include/common/javascript/topCounterStatus/ajaxStatusCounter.js.php HTTP/1.1" 200 9962 "-" "-" WMn8gawbzgcAAD9mEUMAAAAG "-" /20170316/20170316-1046/20170316-104625-WMn8gawbzgcAAD9mEUMAAAAG 0 13495 md5:8bde9c0d7a769cdb013965349b81bc35 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:25 +0800] "GET /centreon/include/common/javascript/codebase/dhtmlxtree.php?sid=g03dvbmv1tpq9plgpqtm7reds3 HTTP/1.1" 200 66666 "-" "-" WMn8gawbzgcAAD9kEM8AAAAE "-" /20170316/20170316-1046/20170316-104625-WMn8gawbzgcAAD9kEM8AAAAE 0 70082 md5:1644ad8fe8b5359e6b68e8cdd3f191e5 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:25 +0800] "GET /centreon/include/common/javascript/autologoutXMLresponse.php?sid=g03dvbmv1tpq9plgpqtm7reds3 HTTP/1.1" 200 125 "-" "-" WMn8gawbzgcAAD9iEF4AAAAC "-" /20170316/20170316-1046/20170316-104625-WMn8gawbzgcAAD9iEF4AAAAC 0 2625 md5:b5b290b88891e8d91e0778eda26531a5 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:25 +0800] "POST /centreon/include/monitoring/status/TopCounter/xml/ndo/statusCounter.php HTTP/1.1" 200 1301 "-" "-" WMn8gawbzgcAAD9gD-YAAAAA "-" /20170316/20170316-1046/20170316-104625-WMn8gawbzgcAAD9gD-YAAAAA 0 3554 md5:a3103e533b037d0e66d393596c37958b 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:48:55 +0800] "POST /centreon/include/monitoring/status/TopCounter/xml/ndo/statusCounter.php HTTP/1.1" 200 1301 "-" "-" WMn9F6wbzgcAAD9hECYAAAAB "-" /20170316/20170316-1048/20170316-104855-WMn9F6wbzgcAAD9hECYAAAAB 0 3554 md5:5f1f86aff6d6b388e6970db4e6308248 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:48:55 +0800] "GET /centreon/include/common/javascript/autologoutXMLresponse.php?sid=g03dvbmv1tpq9plgpqtm7reds3 HTTP/1.1" 200 125 "-" "-" WMn9F6wbzgcAAD9nEXoAAAAH "-" /20170316/20170316-1048/20170316-104855-WMn9F6wbzgcAAD9nEXoAAAAH 0 2623 md5:f7ce6c112f2dc0522f2c37b83f21dfec 


c)cat /usr/local/apache/audit/logs/audit/20170316/20170316-1034/20170316-103453-WMn5zawbzgcAAD9iEFAAAAAC
可以看到具体的执行
--1e2c2150-A--
[16/Mar/2017:10:34:53 +0800] WMn5zawbzgcAAD9iEFAAAAAC 172.26.18.108 49824 172.27.206.7 80
--1e2c2150-B--
GET /centreon/include/common/javascript/jquery/plugins/colorbox/images/border.png HTTP/1.1
Host: 172.27.206.7
Connection: keep-alive
Accept: image/webp,image/*,*/*;q=0.8
If-None-Match: "1c14bd-a3-54aac03e225b9"
If-Modified-Since: Tue, 14 Mar 2017 07:45:43 GMT
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.97 Safari/537.36
Referer: http://172.27.206.7/centreon/main.php
Accept-Encoding: gzip, deflate, sdch
Accept-Language: zh-CN,zh;q=0.8
Cookie: PHPSESSID=g03dvbmv1tpq9plgpqtm7reds3


--1e2c2150-F--
HTTP/1.1 304 Not Modified
Last-Modified: Tue, 14 Mar 2017 07:45:43 GMT
ETag: "1c14bd-a3-54aac03e225b9"
Accept-Ranges: bytes
Content-Length: 0
Connection: close
Content-Type: image/png


--1e2c2150-E--


--1e2c2150-H--
Message: collection_retrieve_ex: Unable to retrieve collection (name "global", key "global"). Use SecDataDir to define data directory first.
Message: collection_retrieve_ex: Unable to retrieve collection (name "ip", key "172.26.18.108_cd85a82133a70fed9906fed8b8960aec0bf92efa"). Use SecDataDir to define data directory first.
Message: Warning. Pattern match "^[\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/httpd/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "793"] [id "920350"] [rev "2"] [msg "Host header is a numeric IP address"] [data "172.27.206.7"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"]
Stopwatch: 1489631693988843 1280 (- - -)
Stopwatch2: 1489631693988843 1280; combined=914, p1=175, p2=637, p3=22, p4=53, p5=27, sr=32, sw=0, l=0, gc=0
Response-Body-Transformed: Dechunked
Producer: ModSecurity for Apache/2.9.1 (http://www.modsecurity.org/); OWASP_CRS/3.0.0.
Server: Apache/2.2.15 (CentOS)
Engine-Mode: "DETECTION_ONLY"


--1e2c2150-Z--

这篇关于modsecurity安装HTTP全量审计步骤的文章就介绍到这儿，希望我们推荐的文章对编程师们有所帮助！


http://www.chinasem.cn/article/883783。

相关文章

JSON字符串转成java的Map对象详细步骤

JSON字符串转成java的Map对象详细步骤

《JSON字符串转成java的Map对象详细步骤》：本文主要介绍如何将JSON字符串转换为Java对象的步骤,包括定义Element类、使用Jackson库解析JSON和添加依赖,文中通过代码介绍... 目录步骤 1: 定义 Element 类步骤 2: 使用 Jackson 库解析 jsON步骤 3: 添
阅读更多...
将sqlserver数据迁移到mysql的详细步骤记录

将sqlserver数据迁移到mysql的详细步骤记录

《将sqlserver数据迁移到mysql的详细步骤记录》：本文主要介绍将SQLServer数据迁移到MySQL的步骤,包括导出数据、转换数据格式和导入数据,通过示例和工具说明,帮助大家顺利完成... 目录前言一、导出SQL Server 数据二、转换数据格式为mysql兼容格式三、导入数据到MySQL数据
阅读更多...
C++中使用vector存储并遍历数据的基本步骤

C++中使用vector存储并遍历数据的基本步骤

《C++中使用vector存储并遍历数据的基本步骤》C++标准模板库（STL）提供了多种容器类型,包括顺序容器、关联容器、无序关联容器和容器适配器,每种容器都有其特定的用途和特性,：本文主要介绍C... 目录（1）容器及简要描述‌php顺序容器‌‌关联容器‌‌无序关联容器‌（基于哈希表）：‌容器适配器‌：（
阅读更多...
python管理工具之conda安装部署及使用详解

python管理工具之conda安装部署及使用详解

《python管理工具之conda安装部署及使用详解》这篇文章详细介绍了如何安装和使用conda来管理Python环境,它涵盖了从安装部署、镜像源配置到具体的conda使用方法,包括创建、激活、安装包... 目录pytpshheraerUhon管理工具：conda部署+使用一、安装部署1、 下载2、 安装3
阅读更多...
详解Java如何向http/https接口发出请求

详解Java如何向http/https接口发出请求

《详解Java如何向http/https接口发出请求》这篇文章主要为大家详细介绍了Java如何实现向http/https接口发出请求,文中的示例代码讲解详细,感兴趣的小伙伴可以跟随小编一起学习一下... 用Java发送web请求所用到的包都在java.net下，在具体使用时可以用如下代码，你可以把它封装成一
阅读更多...
Window Server2016加入AD域的方法步骤

Window Server2016加入AD域的方法步骤

《WindowServer2016加入AD域的方法步骤》：本文主要介绍WindowServer2016加入AD域的方法步骤,包括配置DNS、检测ping通、更改计算机域、输入账号密码、重启服务... 目录一、 准备条件二、配置ServerB加入ServerA的AD域（test.ly）三、查看加入AD域后的变
阅读更多...
Window Server2016 AD域的创建的方法步骤

Window Server2016 AD域的创建的方法步骤

《WindowServer2016AD域的创建的方法步骤》本文主要介绍了WindowServer2016AD域的创建的方法步骤,文中通过图文介绍的非常详细,对大家的学习或者工作具有一定的参考学习价... 目录一、准备条件二、在ServerA服务器中常见AD域管理器：三、创建AD域，域地址为“test.ly”
阅读更多...
NFS实现多服务器文件的共享的方法步骤

NFS实现多服务器文件的共享的方法步骤

《NFS实现多服务器文件的共享的方法步骤》NFS允许网络中的计算机之间共享资源,客户端可以透明地读写远端NFS服务器上的文件,本文就来介绍一下NFS实现多服务器文件的共享的方法步骤,感兴趣的可以了解一... 目录一、简介二、部署1、准备1、服务端和客户端：安装nfs-utils2、服务端：创建共享目录3、服
阅读更多...
龙蜥操作系统Anolis OS-23.x安装配置图解教程(保姆级)

龙蜥操作系统Anolis OS-23.x安装配置图解教程(保姆级)

《龙蜥操作系统AnolisOS-23.x安装配置图解教程(保姆级)》：本文主要介绍了安装和配置AnolisOS23.2系统，包括分区、软件选择、设置root密码、网络配置、主机名设置和禁用SELinux的步骤，详细内容请阅读本文，希望能对你有所帮助... ‌AnolisOS‌是由阿里云推出的开源操作系统，旨
阅读更多...
Ubuntu系统怎么安装Warp? 新一代AI 终端神器安装使用方法

Ubuntu系统怎么安装Warp? 新一代AI 终端神器安装使用方法

《Ubuntu系统怎么安装Warp?新一代AI终端神器安装使用方法》Warp是一款使用Rust开发的现代化AI终端工具，该怎么再Ubuntu系统中安装使用呢？下面我们就来看看详细教程... Warp Terminal 是一款使用 Rust 开发的现代化「AI 终端」工具。最初它只支持 MACOS，但在 20
阅读更多...

Copyright China编程 23002807@qq.com

沪ICP备2023033072号-2