Re: capturing user logins
Joel Williams <[email protected]>
| Newsgroups | gmane.comp.apache.mod-security.user |
|---|---|
| Message-ID | <[email protected]> |
Hi Doug, Just as an example, here's an extract of what I do to detect successful WordPress logins. <Locationmatch ".*wp-login\.php"> SecRule RESPONSE_STATUS "302" "phase:5,t:none,log,pass,setvar:ip.bf_counter=0,sanitiseArg:pwd,msg:'wordpress-login-success',id:5000136" </locationmatch> Based on my specific knowledge of WordPress, a 302 response from the wp-login.php script indicates that a successful login occurred, because it redirects users to the correct page (generally - there are some false positives that I haven't bothered to filter out). The POST body is also logged, and the password is sanitised so that I only get the user name. I monitor the mod_security logs with Splunk, which extracts individual events and generates a report of logins. You can also do fancier things like generate alerts based on unusual IP address geolocation lookups and time of day. There might not be a general purpose way to log this information across every possible system and not affect performance, but hopefully this is not a requirement. I guess you could scan ever POST request's body for username/uname/user and hope this catches all cases. Joel Manuel Spartan wrote on 26/3/19 11:34 am: > Hi Doug, as said before the easiest way is setup a rule to extract the > info and parse it in elk or whatever you use, alternatively you can > create an environment variable in the rule to get the info and use a > conditional apache custom log to save the extracted info if the env > var is set in the format you need so you have a clean file with the info. > > https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#setenv > <https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#setenv> > > Cheers! > > Sent from my iPhone > > On 25 Mar 2019, at 16:31, Doug Erwin <[email protected] > <mailto:[email protected]>> wrote: > >> I would definitely welcome some help. If I understand correctly, it >> writes everything to the event viewer -> application log. Is there a >> way to redirect that just write a log file to the file system, maybe >> even a separate log just for these user logins? >> >> Also, is there an online tutorial about writing rules for >> modsecurity? Maybe something on youtube? >> >> Doug >> >> Doug Erwin >> >> President >> >> TTP Solutions / TheTradingPortal.com <http://TheTradingPortal.com> >> >> [email protected] <mailto:[email protected]> >> >> Office: 615-469-0409 >> >> Cell: 615-498-4756 >> >> <image001.png> >> >> *From:* Chaim Sanders <[email protected] >> <mailto:[email protected]>> >> *Sent:* Monday, March 25, 2019 2:54 PM >> *To:* [email protected] >> <mailto:[email protected]> >> *Subject:* Re: [mod-security-users] capturing user logins >> >> Yes, >> >> You can make a rule that checks if the parameter with the username is >> provided and log that. You can then parse the log or use MLogc to >> move things to third party servers like elasticsearch. Let me know if >> that makes sense or you need more help. >> >> Thanks, >> >> - Chaim >> >> On Mon, Mar 25, 2019 at 3:01 PM Doug Erwin <[email protected] >> <mailto:[email protected]>> wrote: >> >> Hi all, I am new to modsecurity but I would like to use it to >> capture user logins so that I could build a history of user >> access over time. Is there a way to do that? I am pretty sure >> that this would be a new special or custom rule. Any thoughts on >> this? >> >> Thanks in advance. >> >> Doug >> >> Doug Erwin >> >> President >> >> TTP Solutions / TheTradingPortal.com >> <https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fTheTradingPortal.com&c=E,1,ka5DZkEMWqh8ZRpkawNoM8yEOYF7wTe8_SbHM6Ci4KO3zPK1al2AMrBmtamgtfF01AErQ0zgVgt5AMqm2O1WKB7jagdZ1d2sOKYhGf_8Yww8o5JY&typo=1> >> >> [email protected] <mailto:[email protected]> >> >> Office: 615-469-0409 >> >> Cell: 615-498-4756 >> >> <image001.png> >> >> _______________________________________________ >> mod-security-users mailing list >> [email protected] >> <mailto:[email protected]> >> https://lists.sourceforge.net/lists/listinfo/mod-security-users >> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: >> http://www.modsecurity.org/projects/commercial/rules/ >> <https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fwww.modsecurity.org%2fprojects%2fcommercial%2frules%2f&c=E,1,Z5eBJeHTqjyb2RkSUrjldSJNf_cK9nlA2KNrpUHZDM1odJQckie4CgXbTCB_Z-AOEnd5Oza8guZn0sTeuKEFAKKlXpzFI5r28H8SJjgNDr7e5hobpB3oO53BIw,,&typo=1> >> http://www.modsecurity.org/projects/commercial/support/ >> <https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fwww.modsecurity.org%2fprojects%2fcommercial%2fsupport%2f&c=E,1,7bdPfnStuhxnevLrrdcYZpwTZ5uugfr5eUwGsQr12t6liM-AWUP9OUAL8PLEMCN6uh9CoaNrgTC7NqJS2UdQvxOHWD3wprk9Ja808XxMSrMD-uCJieoyeoME4Q,,&typo=1> >> >> >> -- >> >> -- >> Chaim Sanders >> http://www.ChaimSanders.com >> <https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fwww.ChaimSanders.com&c=E,1,o4c2YgyDsYKkmgTZYufmhje_WcPKxM7a1UGJAKvvBckafhBFoRwY9X8n97NMo0aPLWRLS4jS5VhpStUoBvUl_Y4sysxRAVXzsmsto2l3Hzfj7_NosW8ufu-Yye8,&typo=1> >> >> _______________________________________________ >> mod-security-users mailing list >> [email protected] >> <mailto:[email protected]> >> https://lists.sourceforge.net/lists/listinfo/mod-security-users >> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: >> http://www.modsecurity.org/projects/commercial/rules/ >> http://www.modsecurity.org/projects/commercial/support/ > > > > > _______________________________________________ > mod-security-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/mod-security-users > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > http://www.modsecurity.org/projects/commercial/rules/ > http://www.modsecurity.org/projects/commercial/support/ _______________________________________________ mod-security-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/mod-security-users Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: http://www.modsecurity.org/projects/commercial/rules/ http://www.modsecurity.org/projects/commercial/support/