modsecurity安装HTTP全量审计步骤

2024-04-07 21:58
文章标签 安装 步骤 http 审计 全量 modsecurity

本文主要是介绍modsecurity安装HTTP全量审计步骤，希望对大家解决编程问题提供一定的参考价值，需要的开发者们随着小编来一起学习吧！

1)cd /etc/httpd/modsecurity-crs/rules
2)在该目录创建新文件REQUEST-SELF-100-HTTP-audit.conf
vi REQUEST-SELF-100-HTTP-audit.conf
写入
SecRuleEngine DetectionOnly
SecRequestBodyAccess On
SecResponseBodyAccess On
SecAuditEngine On
SecAuditLogParts ABCIFEHZ
SecAuditLog /usr/local/apache/logs/audit.log
SecAuditLogType Concurrent
SecAuditLogStorageDir /usr/local/apache/audit/logs/audit


注解：
a)SecAuditLogType Concurrent 代表并行
b)/usr/local/apache/logs/audit.log和/usr/local/apache/audit/logs/audit请确保存在，没有需要自己创建。




3)验证配置
a)进入网站，执行操作。登录，修改内容均可以。
b) cat /usr/local/apache/logs/audit.log
看到如下：
 172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:16 +0800] "GET /centreon/include/common/javascript/autologoutXMLresponse.php?sid=g03dvbmv1tpq9plgpqtm7reds3 HTTP/1.1" 200 125 "-" "-" WMn8eKwbzgcAAD9mEUEAAAAG "-" /20170316/20170316-1046/20170316-104616-WMn8eKwbzgcAAD9mEUEAAAAG 0 2622 md5:1a9c3806299bb34f0e11a06252126348 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/main.php?p=60301&o=c&contact_id=56 HTTP/1.1" 200 115953 "-" "-" WMn8e6wbzgcAAD9iEFwAAAAC "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9iEFwAAAAC 0 127236 md5:44effca7ec920eae8a6b1d24aac66c30 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/Themes/Centreon-2/Modalbox/Color/blue_css.php HTTP/1.1" 200 405 "-" "-" WMn8e6wbzgcAAD9gD-QAAAAA "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9gD-QAAAAA 0 1950 md5:e530e4a72eb117f16e91a3d29119cf19 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/Themes/Centreon-2/Color/blue_css.php HTTP/1.1" 200 4959 "-" "-" WMn8e6wbzgcAAD9lEQgAAAAF "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9lEQgAAAAF 0 1944 md5:1ca3ace6eb8d3aa44303f379ba12d2ba 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/include/common/javascript/topCounterStatus/ajaxStatusCounter.js.php HTTP/1.1" 200 9962 "-" "-" WMn8e6wbzgcAAD9hECQAAAAB "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9hECQAAAAB 0 13512 md5:7c612b1feb6ed6bca0db250622682207 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/img/icones/16x16/clipboard.gif HTTP/1.1" 304 0 "-" "-" WMn8e6wbzgcAAD9nEXgAAAAH "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9nEXgAAAAH 0 2093 md5:42bc6cecd69d6dce26645f71f19304e3 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/include/common/javascript/keygen.js HTTP/1.1" 304 0 "-" "-" WMn8e6wbzgcAAD9jEJcAAAAD "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9jEJcAAAAD 0 2078 md5:dfbcf40646a093c8282655e34520f900 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/img/icones/16x16/mailer.gif HTTP/1.1" 304 0 "-" "-" WMn8e6wbzgcAAD9mEUIAAAAG "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9mEUIAAAAG 0 2088 md5:29861a17608eb8e7c4b0f78c2e15c97e 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/include/common/javascript/codebase/dhtmlxtree.php?sid=g03dvbmv1tpq9plgpqtm7reds3 HTTP/1.1" 200 66666 "-" "-" WMn8e6wbzgcAAD9kEM4AAAAE "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9kEM4AAAAE 0 70098 md5:7ded548ffcfabdc08ac682eb8669f85a 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/img/icones/16x16/centreon.gif HTTP/1.1" 200 1031 "-" "-" WMn8e6wbzgcAAD9iEF0AAAAC "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9iEF0AAAAC 0 1994 md5:b9bc5ebeb55a7fcee9684d5a2208e073 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "GET /centreon/include/common/javascript/autologoutXMLresponse.php?sid=g03dvbmv1tpq9plgpqtm7reds3 HTTP/1.1" 200 125 "-" "-" WMn8e6wbzgcAAD9gD-UAAAAA "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9gD-UAAAAA 0 2659 md5:3e08d8a66d1d1640208c67d9b5ec794f 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:19 +0800] "POST /centreon/include/monitoring/status/TopCounter/xml/ndo/statusCounter.php HTTP/1.1" 200 1301 "-" "-" WMn8e6wbzgcAAD9hECUAAAAB "-" /20170316/20170316-1046/20170316-104619-WMn8e6wbzgcAAD9hECUAAAAB 0 3572 md5:fb1b33bd7e3542398bc5ecdbaf3900ad 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:25 +0800] "POST /centreon/main.php?p=60301 HTTP/1.1" 200 114973 "-" "-" WMn8gKwbzgcAAD9nEXkAAAAH "-" /20170316/20170316-1046/20170316-104625-WMn8gKwbzgcAAD9nEXkAAAAH 0 125191 md5:d7c896371ed23c41d3a6de60bd8ee665 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:25 +0800] "GET /centreon/Themes/Centreon-2/Modalbox/Color/blue_css.php HTTP/1.1" 200 405 "-" "-" WMn8gawbzgcAAD9jEJgAAAAD "-" /20170316/20170316-1046/20170316-104625-WMn8gawbzgcAAD9jEJgAAAAD 0 1933 md5:a619803952ea0c0d989845cae63b5ee9 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:25 +0800] "GET /centreon/Themes/Centreon-2/Color/blue_css.php HTTP/1.1" 200 4959 "-" "-" WMn8gawbzgcAAD9lEQkAAAAF "-" /20170316/20170316-1046/20170316-104625-WMn8gawbzgcAAD9lEQkAAAAF 0 1928 md5:9741e7abd81da6d974c300e2d7cc7a8e 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:25 +0800] "GET /centreon/include/common/javascript/topCounterStatus/ajaxStatusCounter.js.php HTTP/1.1" 200 9962 "-" "-" WMn8gawbzgcAAD9mEUMAAAAG "-" /20170316/20170316-1046/20170316-104625-WMn8gawbzgcAAD9mEUMAAAAG 0 13495 md5:8bde9c0d7a769cdb013965349b81bc35 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:25 +0800] "GET /centreon/include/common/javascript/codebase/dhtmlxtree.php?sid=g03dvbmv1tpq9plgpqtm7reds3 HTTP/1.1" 200 66666 "-" "-" WMn8gawbzgcAAD9kEM8AAAAE "-" /20170316/20170316-1046/20170316-104625-WMn8gawbzgcAAD9kEM8AAAAE 0 70082 md5:1644ad8fe8b5359e6b68e8cdd3f191e5 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:25 +0800] "GET /centreon/include/common/javascript/autologoutXMLresponse.php?sid=g03dvbmv1tpq9plgpqtm7reds3 HTTP/1.1" 200 125 "-" "-" WMn8gawbzgcAAD9iEF4AAAAC "-" /20170316/20170316-1046/20170316-104625-WMn8gawbzgcAAD9iEF4AAAAC 0 2625 md5:b5b290b88891e8d91e0778eda26531a5 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:46:25 +0800] "POST /centreon/include/monitoring/status/TopCounter/xml/ndo/statusCounter.php HTTP/1.1" 200 1301 "-" "-" WMn8gawbzgcAAD9gD-YAAAAA "-" /20170316/20170316-1046/20170316-104625-WMn8gawbzgcAAD9gD-YAAAAA 0 3554 md5:a3103e533b037d0e66d393596c37958b 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:48:55 +0800] "POST /centreon/include/monitoring/status/TopCounter/xml/ndo/statusCounter.php HTTP/1.1" 200 1301 "-" "-" WMn9F6wbzgcAAD9hECYAAAAB "-" /20170316/20170316-1048/20170316-104855-WMn9F6wbzgcAAD9hECYAAAAB 0 3554 md5:5f1f86aff6d6b388e6970db4e6308248 
172.27.206.7 172.26.18.108 - - [16/Mar/2017:10:48:55 +0800] "GET /centreon/include/common/javascript/autologoutXMLresponse.php?sid=g03dvbmv1tpq9plgpqtm7reds3 HTTP/1.1" 200 125 "-" "-" WMn9F6wbzgcAAD9nEXoAAAAH "-" /20170316/20170316-1048/20170316-104855-WMn9F6wbzgcAAD9nEXoAAAAH 0 2623 md5:f7ce6c112f2dc0522f2c37b83f21dfec 


c)cat /usr/local/apache/audit/logs/audit/20170316/20170316-1034/20170316-103453-WMn5zawbzgcAAD9iEFAAAAAC
可以看到具体的执行
--1e2c2150-A--
[16/Mar/2017:10:34:53 +0800] WMn5zawbzgcAAD9iEFAAAAAC 172.26.18.108 49824 172.27.206.7 80
--1e2c2150-B--
GET /centreon/include/common/javascript/jquery/plugins/colorbox/images/border.png HTTP/1.1
Host: 172.27.206.7
Connection: keep-alive
Accept: image/webp,image/*,*/*;q=0.8
If-None-Match: "1c14bd-a3-54aac03e225b9"
If-Modified-Since: Tue, 14 Mar 2017 07:45:43 GMT
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.97 Safari/537.36
Referer: http://172.27.206.7/centreon/main.php
Accept-Encoding: gzip, deflate, sdch
Accept-Language: zh-CN,zh;q=0.8
Cookie: PHPSESSID=g03dvbmv1tpq9plgpqtm7reds3


--1e2c2150-F--
HTTP/1.1 304 Not Modified
Last-Modified: Tue, 14 Mar 2017 07:45:43 GMT
ETag: "1c14bd-a3-54aac03e225b9"
Accept-Ranges: bytes
Content-Length: 0
Connection: close
Content-Type: image/png


--1e2c2150-E--


--1e2c2150-H--
Message: collection_retrieve_ex: Unable to retrieve collection (name "global", key "global"). Use SecDataDir to define data directory first.
Message: collection_retrieve_ex: Unable to retrieve collection (name "ip", key "172.26.18.108_cd85a82133a70fed9906fed8b8960aec0bf92efa"). Use SecDataDir to define data directory first.
Message: Warning. Pattern match "^[\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/httpd/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "793"] [id "920350"] [rev "2"] [msg "Host header is a numeric IP address"] [data "172.27.206.7"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"]
Stopwatch: 1489631693988843 1280 (- - -)
Stopwatch2: 1489631693988843 1280; combined=914, p1=175, p2=637, p3=22, p4=53, p5=27, sr=32, sw=0, l=0, gc=0
Response-Body-Transformed: Dechunked
Producer: ModSecurity for Apache/2.9.1 (http://www.modsecurity.org/); OWASP_CRS/3.0.0.
Server: Apache/2.2.15 (CentOS)
Engine-Mode: "DETECTION_ONLY"


--1e2c2150-Z--

这篇关于modsecurity安装HTTP全量审计步骤的文章就介绍到这儿，希望我们推荐的文章对编程师们有所帮助！


http://www.chinasem.cn/article/883783。

相关文章

Python中win32包的安装及常见用途介绍

Python中win32包的安装及常见用途介绍

《Python中win32包的安装及常见用途介绍》在Windows环境下,PythonWin32模块通常随Python安装包一起安装,：本文主要介绍Python中win32包的安装及常见用途的相关... 目录前言主要组件安装方法常见用途1. 操作Windows注册表2. 操作Windows服务3. 窗口操作
阅读更多...
Visual Studio 2022 编译C++20代码的图文步骤

Visual Studio 2022 编译C++20代码的图文步骤

《VisualStudio2022编译C++20代码的图文步骤》在VisualStudio中启用C++20import功能,需设置语言标准为ISOC++20,开启扫描源查找模块依赖及实验性标... 默认创建Visual Studio桌面控制台项目代码包含C++20的import方法。右键项目的属性：
阅读更多...
python删除xml中的w:ascii属性的步骤

python删除xml中的w:ascii属性的步骤

《python删除xml中的w:ascii属性的步骤》使用xml.etree.ElementTree删除WordXML中w:ascii属性,需注册命名空间并定位rFonts元素,通过del操作删除属... 可以使用python的XML.etree.ElementTree模块通过以下步骤删除XML中的w:as
阅读更多...
java向微信服务号发送消息的完整步骤实例

java向微信服务号发送消息的完整步骤实例

《java向微信服务号发送消息的完整步骤实例》：本文主要介绍java向微信服务号发送消息的相关资料,包括申请测试号获取appID/appsecret、关注公众号获取openID、配置消息模板及代码... 目录步骤1. 申请测试系统2. 公众号账号信息3. 关注测试号二维码4. 消息模板接口5. Java测试
阅读更多...
springboot如何通过http动态操作xxl-job任务

springboot如何通过http动态操作xxl-job任务

《springboot如何通过http动态操作xxl-job任务》：本文主要介绍springboot如何通过http动态操作xxl-job任务的问题,具有很好的参考价值,希望对大家有所帮助,如有错... 目录springboot通过http动态操作xxl-job任务一、maven依赖二、配置文件三、xxl-
阅读更多...
Mac系统下卸载JAVA和JDK的步骤

Mac系统下卸载JAVA和JDK的步骤

《Mac系统下卸载JAVA和JDK的步骤》JDK是Java语言的软件开发工具包,它提供了开发和运行Java应用程序所需的工具、库和资源,：本文主要介绍Mac系统下卸载JAVA和JDK的相关资料,需... 目录1. 卸载系统自带的 Java 版本检查当前 Java 版本通过命令卸载系统 Java2. 卸载自定
阅读更多...
gitlab安装及邮箱配置和常用使用方式

gitlab安装及邮箱配置和常用使用方式

《gitlab安装及邮箱配置和常用使用方式》：本文主要介绍gitlab安装及邮箱配置和常用使用方式,具有很好的参考价值,希望对大家有所帮助,如有错误或未考虑完全的地方,望不吝赐教... 目录1.安装GitLab2.配置GitLab邮件服务3.GitLab的账号注册邮箱验证及其分组4.gitlab分支和标签的
阅读更多...
MySQL MCP 服务器安装配置最佳实践

MySQL MCP 服务器安装配置最佳实践

《MySQLMCP服务器安装配置最佳实践》本文介绍MySQLMCP服务器的安装配置方法,本文结合实例代码给大家介绍的非常详细,对大家的学习或工作具有一定的参考借鉴价值,需要的朋友参考下... 目录mysql MCP 服务器安装配置指南简介功能特点安装方法数据库配置使用MCP Inspector进行调试开发指
阅读更多...
在Windows上使用qemu安装ubuntu24.04服务器的详细指南

在Windows上使用qemu安装ubuntu24.04服务器的详细指南

《在Windows上使用qemu安装ubuntu24.04服务器的详细指南》本文介绍了在Windows上使用QEMU安装Ubuntu24.04的全流程：安装QEMU、准备ISO镜像、创建虚拟磁盘、配置... 目录1. 安装QEMU环境2. 准备Ubuntu 24.04镜像3. 启动QEMU安装Ubuntu4
阅读更多...
Python UV安装、升级、卸载详细步骤记录

Python UV安装、升级、卸载详细步骤记录

《PythonUV安装、升级、卸载详细步骤记录》：本文主要介绍PythonUV安装、升级、卸载的详细步骤,uv是Astral推出的下一代Python包与项目管理器,主打单一可执行文件、极致性能... 目录安装检查升级设置自动补全卸载UV 命令总结 官方文档详见：https://docs.astral.sh/
阅读更多...

Copyright China编程 23002807@qq.com

沪ICP备2023033072号-2