Re: capturing user logins

Thanks for the guidance.  I am still lost, but I ordered a book on amazon, “ModSecurity Handbook,second editin” because it has a chapter on writing rules.  At this point I have nothing to help me understand what “phase:5,t:none….” Is and how to configure that stuff and what the various options are.  Mine is a system that has modsecurity embedded in it and is on a Microsoft IIS platform and writes the log entries into the event viewer.  I plan to do a lot of reading as soon as I get it.  I want a real log file and not an event viewer and I want the info I need.  I think modsecurity can be a powerful asset, especially since it is already there, but I have to master it first.  I just want to capture timestamp, username, and IP from a login attempt and be able to keep that for posterity.

Doug

Doug Erwin
President
TTP Solutions / TheTradingPortal.com
[email protected]<mailto:[email protected]>
Office:  615-469-0409
Cell:       615-498-4756
[Email_Signature_Logo]

From: Joel Williams <[email protected]>
Sent: Tuesday, March 26, 2019 12:46 AM
To: [email protected]
Subject: Re: [mod-security-users] capturing user logins

Hi Doug,

Just as an example, here's an extract of what I do to detect successful WordPress logins.

<Locationmatch ".*wp-login\.php">
    SecRule RESPONSE_STATUS "302" "phase:5,t:none,log,pass,setvar:ip.bf_counter=0,sanitiseArg:pwd,msg:'wordpress-login-success',id:5000136"
</locationmatch>

Based on my specific knowledge of WordPress, a 302 response from the wp-login.php script indicates that a successful login occurred, because it redirects users to the correct page (generally - there are some false positives that I haven't bothered to filter out).

The POST body is also logged, and the password is sanitised so that I only get the user name. I monitor the mod_security logs with Splunk, which extracts individual events and generates a report of logins. You can also do fancier things like generate alerts based on unusual IP address geolocation lookups and time of day.

There might not be a general purpose way to log this information across every possible system and not affect performance, but hopefully this is not a requirement. I guess you could scan ever POST request's body for username/uname/user and hope this catches all cases.

Joel


Manuel Spartan wrote on 26/3/19 11:34 am:

Hi Doug, as said before the easiest way is setup a rule to extract the info and parse it in elk or whatever you use, alternatively you can create an environment variable in the rule to get the info and use a conditional apache custom log to save the extracted info if the env var is set in the format you need so you have a clean file with the info.

https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#setenv<https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#setenv>

Cheers!
Sent from my iPhone

On 25 Mar 2019, at 16:31, Doug Erwin <[email protected]<mailto:[email protected]>> wrote:
I would definitely welcome some help.  If I understand correctly, it writes everything to the event viewer -> application log.  Is there a way to redirect that just write a log file to the file system, maybe even a separate log just for these user logins?

Also, is there an online tutorial about writing rules for modsecurity?  Maybe something on youtube?

Doug

Doug Erwin
President
TTP Solutions / TheTradingPortal.com<https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fTheTradingPortal.com&c=E,1,vewZQD0OGuuiwKa9LJp0SS6YS9DVWbQTh--SDwuUhAvKmfiOqalh03BKqkA9F_SOv6yshbmUytgRyT6ITVCRnY7KIS8JYW_CoW3Y6yqrtSPo0A,,&typo=1>
[email protected]<mailto:[email protected]>
Office:  615-469-0409
Cell:       615-498-4756
<image001.png>

From: Chaim Sanders <[email protected]<mailto:[email protected]>>
Sent: Monday, March 25, 2019 2:54 PM
To: [email protected]<mailto:[email protected]>
Subject: Re: [mod-security-users] capturing user logins

Yes,
You can make a rule that checks if the parameter with the username is provided and log that. You can then parse the log or use MLogc to move things to third party servers like elasticsearch. Let me know if that makes sense or you need more help.
Thanks,
- Chaim

On Mon, Mar 25, 2019 at 3:01 PM Doug Erwin <[email protected]<mailto:[email protected]>> wrote:
Hi all, I am new to modsecurity but I would like to use it to capture user logins so that I could build a history of user access over time.  Is there a way to do that?  I am pretty sure that this would be a new special or custom rule.  Any thoughts on this?

Thanks in advance.

Doug

Doug Erwin
President
TTP Solutions / TheTradingPortal.com<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fTheTradingPortal.com&c=E,1,ka5DZkEMWqh8ZRpkawNoM8yEOYF7wTe8_SbHM6Ci4KO3zPK1al2AMrBmtamgtfF01AErQ0zgVgt5AMqm2O1WKB7jagdZ1d2sOKYhGf_8Yww8o5JY&typo=1>
[email protected]<mailto:[email protected]>
Office:  615-469-0409
Cell:       615-498-4756
<image001.png>

_______________________________________________
mod-security-users mailing list
[email protected]<mailto:[email protected]>
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/<https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fwww.modsecurity.org%2fprojects%2fcommercial%2frules%2f&c=E,1,Z5eBJeHTqjyb2RkSUrjldSJNf_cK9nlA2KNrpUHZDM1odJQckie4CgXbTCB_Z-AOEnd5Oza8guZn0sTeuKEFAKKlXpzFI5r28H8SJjgNDr7e5hobpB3oO53BIw,,&typo=1>
http://www.modsecurity.org/projects/commercial/support/<https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fwww.modsecurity.org%2fprojects%2fcommercial%2fsupport%2f&c=E,1,7bdPfnStuhxnevLrrdcYZpwTZ5uugfr5eUwGsQr12t6liM-AWUP9OUAL8PLEMCN6uh9CoaNrgTC7NqJS2UdQvxOHWD3wprk9Ja808XxMSrMD-uCJieoyeoME4Q,,&typo=1>


--
--
Chaim Sanders
http://www.ChaimSanders.com<https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fwww.ChaimSanders.com&c=E,1,o4c2YgyDsYKkmgTZYufmhje_WcPKxM7a1UGJAKvvBckafhBFoRwY9X8n97NMo0aPLWRLS4jS5VhpStUoBvUl_Y4sysxRAVXzsmsto2l3Hzfj7_NosW8ufu-Yye8,&typo=1>
_______________________________________________
mod-security-users mailing list
[email protected]<mailto:[email protected]>
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/<https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fwww.modsecurity.org%2fprojects%2fcommercial%2frules%2f&c=E,1,PxxyhrUvAktNoJcnFS4ylMms274DBnlqQXD_oi99OhKjNVlIWscFo_2cVnRQ7yQS5wKVxWdmY3LsaoI3-9uDZXG7adORAtZfEyJAChJ0f6VY&typo=1>
http://www.modsecurity.org/projects/commercial/support/<https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fwww.modsecurity.org%2fprojects%2fcommercial%2fsupport%2f&c=E,1,R12OIpGetiO_GTlT9ukCqA-W2DSTk5EnXKsr2ZR2S7UNnB8R5S-SV3N-RYtZP8Ynpm6jAu2abLbdc4jblEPrhvccgGldEH239eOhW75IlcEAyrd50vtkepk,&typo=1>






_______________________________________________

mod-security-users mailing list

[email protected]<mailto:[email protected]>

https://lists.sourceforge.net/lists/listinfo/mod-security-users

Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:

http://www.modsecurity.org/projects/commercial/rules/<https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fwww.modsecurity.org%2fprojects%2fcommercial%2frules%2f&c=E,1,YdXBwuvFxQle3BFGAo78cBr0DrFBLfSYzsOLiBVFx9sfL2mexVkkcd97EhPLjH0JghrnYp3xm6vXkTfzq89pYVy4MaYQHtzzOS24URSQDmo,&typo=1>

http://www.modsecurity.org/projects/commercial/support/<https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fwww.modsecurity.org%2fprojects%2fcommercial%2fsupport%2f&c=E,1,J7DJCZf5gGJ1v7tRW7fqVmNqSBKpT8LRcU0o6hx0NUTjCLdEegxZ5JzGePWqCN2WIpjzKGqYbtYUwTisOwtYbhIGNtIGnr5v_R2Mrdh7&typo=1>

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/