Re: capturing user logins

Hi Doug, you definitively need to read the book :) but in the meanwhile if
you are ok with little explanations the best reference ever is the
modsecurity reference manual
https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29
there are rule examples as well as the descriptions of all operators,
variables, actions, etc.

Supposing the argument holding the username is called username something
like the following example should get you started in Apache 2.2 and 2.4.

SecRule ARGS:username "@eq (.*)"
"phase:5,id:1,capture,pass,log,noauditlog,setenv:USER=%{matched_var},msg:'Username
detected'"

LogFormat "%a,%t,%{USER}e,%s" usercapture
CustomLog logs/usercapture_log usercapture env=USER

Output:
10.0.0.1,[26/SMar/2019:19:56:28 -0600],MyUser,302

El mar., 26 mar. 2019 a las 16:01, Doug Erwin (<[email protected]>)
escribió:

> Thanks for the guidance.  I am still lost, but I ordered a book on amazon,
> “ModSecurity Handbook,second editin” because it has a chapter on writing
> rules.  At this point I have nothing to help me understand what
> “phase:5,t:none….” Is and how to configure that stuff and what the various
> options are.  Mine is a system that has modsecurity embedded in it and is
> on a Microsoft IIS platform and writes the log entries into the event
> viewer.  I plan to do a lot of reading as soon as I get it.  I want a real
> log file and not an event viewer and I want the info I need.  I think
> modsecurity can be a powerful asset, especially since it is already there,
> but I have to master it first.  I just want to capture timestamp, username,
> and IP from a login attempt and be able to keep that for posterity.
>
>
>
> Doug
>
>
>
> Doug Erwin
>
> President
>
> TTP Solutions / TheTradingPortal.com
>
> [email protected]
>
> Office:  615-469-0409
>
> Cell:       615-498-4756
>
> [image: Email_Signature_Logo]
>
>
>
> *From:* Joel Williams <[email protected]>
> *Sent:* Tuesday, March 26, 2019 12:46 AM
> *To:* [email protected]
> *Subject:* Re: [mod-security-users] capturing user logins
>
>
>
> Hi Doug,
>
> Just as an example, here's an extract of what I do to detect successful
> WordPress logins.
>
> <Locationmatch ".*wp-login\.php">
>     SecRule RESPONSE_STATUS "302"
> "phase:5,t:none,log,pass,setvar:ip.bf_counter=0,sanitiseArg:pwd,msg:'wordpress-login-success',id:5000136"
> </locationmatch>
>
> Based on my specific knowledge of WordPress, a 302 response from the
> wp-login.php script indicates that a successful login occurred, because it
> redirects users to the correct page (generally - there are some false
> positives that I haven't bothered to filter out).
>
> The POST body is also logged, and the password is sanitised so that I only
> get the user name. I monitor the mod_security logs with Splunk, which
> extracts individual events and generates a report of logins. You can also
> do fancier things like generate alerts based on unusual IP address
> geolocation lookups and time of day.
>
> There might not be a general purpose way to log this information across
> every possible system and not affect performance, but hopefully this is not
> a requirement. I guess you could scan ever POST request's body for
> username/uname/user and hope this catches all cases.
>
> Joel
>
>
> Manuel Spartan wrote on 26/3/19 11:34 am:
>
> Hi Doug, as said before the easiest way is setup a rule to extract the
> info and parse it in elk or whatever you use, alternatively you can create
> an environment variable in the rule to get the info and use a conditional
> apache custom log to save the extracted info if the env var is set in the
> format you need so you have a clean file with the info.
>
>
>
>
> https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#setenv
>
>
>
> Cheers!
>
> Sent from my iPhone
>
>
> On 25 Mar 2019, at 16:31, Doug Erwin <[email protected]> wrote:
>
> I would definitely welcome some help.  If I understand correctly, it
> writes everything to the event viewer -> application log.  Is there a way
> to redirect that just write a log file to the file system, maybe even a
> separate log just for these user logins?
>
>
>
> Also, is there an online tutorial about writing rules for modsecurity?
> Maybe something on youtube?
>
>
>
> Doug
>
>
>
> Doug Erwin
>
> President
>
> TTP Solutions / TheTradingPortal.com
> <https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fTheTradingPortal.com&c=E,1,vewZQD0OGuuiwKa9LJp0SS6YS9DVWbQTh--SDwuUhAvKmfiOqalh03BKqkA9F_SOv6yshbmUytgRyT6ITVCRnY7KIS8JYW_CoW3Y6yqrtSPo0A,,&typo=1>
>
> [email protected]
>
> Office:  615-469-0409
>
> Cell:       615-498-4756
>
> <image001.png>
>
>
>
> *From:* Chaim Sanders <[email protected]>
> *Sent:* Monday, March 25, 2019 2:54 PM
> *To:* [email protected]
> *Subject:* Re: [mod-security-users] capturing user logins
>
>
>
> Yes,
>
> You can make a rule that checks if the parameter with the username is
> provided and log that. You can then parse the log or use MLogc to move
> things to third party servers like elasticsearch. Let me know if that makes
> sense or you need more help.
>
> Thanks,
>
> - Chaim
>
>
>
> On Mon, Mar 25, 2019 at 3:01 PM Doug Erwin <[email protected]>
> wrote:
>
> Hi all, I am new to modsecurity but I would like to use it to capture user
> logins so that I could build a history of user access over time.  Is there
> a way to do that?  I am pretty sure that this would be a new special or
> custom rule.  Any thoughts on this?
>
>
>
> Thanks in advance.
>
>
>
> Doug
>
>
>
> Doug Erwin
>
> President
>
> TTP Solutions / TheTradingPortal.com
> <https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fTheTradingPortal.com&c=E,1,ka5DZkEMWqh8ZRpkawNoM8yEOYF7wTe8_SbHM6Ci4KO3zPK1al2AMrBmtamgtfF01AErQ0zgVgt5AMqm2O1WKB7jagdZ1d2sOKYhGf_8Yww8o5JY&typo=1>
>
> [email protected]
>
> Office:  615-469-0409
>
> Cell:       615-498-4756
>
> <image001.png>
>
>
>
> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> <https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fwww.modsecurity.org%2fprojects%2fcommercial%2frules%2f&c=E,1,Z5eBJeHTqjyb2RkSUrjldSJNf_cK9nlA2KNrpUHZDM1odJQckie4CgXbTCB_Z-AOEnd5Oza8guZn0sTeuKEFAKKlXpzFI5r28H8SJjgNDr7e5hobpB3oO53BIw,,&typo=1>
> http://www.modsecurity.org/projects/commercial/support/
> <https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fwww.modsecurity.org%2fprojects%2fcommercial%2fsupport%2f&c=E,1,7bdPfnStuhxnevLrrdcYZpwTZ5uugfr5eUwGsQr12t6liM-AWUP9OUAL8PLEMCN6uh9CoaNrgTC7NqJS2UdQvxOHWD3wprk9Ja808XxMSrMD-uCJieoyeoME4Q,,&typo=1>
>
>
>
>
> --
>
> --
> Chaim Sanders
> http://www.ChaimSanders.com
> <https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fwww.ChaimSanders.com&c=E,1,o4c2YgyDsYKkmgTZYufmhje_WcPKxM7a1UGJAKvvBckafhBFoRwY9X8n97NMo0aPLWRLS4jS5VhpStUoBvUl_Y4sysxRAVXzsmsto2l3Hzfj7_NosW8ufu-Yye8,&typo=1>
>
> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> <https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fwww.modsecurity.org%2fprojects%2fcommercial%2frules%2f&c=E,1,PxxyhrUvAktNoJcnFS4ylMms274DBnlqQXD_oi99OhKjNVlIWscFo_2cVnRQ7yQS5wKVxWdmY3LsaoI3-9uDZXG7adORAtZfEyJAChJ0f6VY&typo=1>
> http://www.modsecurity.org/projects/commercial/support/
> <https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fwww.modsecurity.org%2fprojects%2fcommercial%2fsupport%2f&c=E,1,R12OIpGetiO_GTlT9ukCqA-W2DSTk5EnXKsr2ZR2S7UNnB8R5S-SV3N-RYtZP8Ynpm6jAu2abLbdc4jblEPrhvccgGldEH239eOhW75IlcEAyrd50vtkepk,&typo=1>
>
>
>
>
>
>
> _______________________________________________
>
> mod-security-users mailing list
>
> [email protected]
>
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>
> http://www.modsecurity.org/projects/commercial/rules/ <https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fwww.modsecurity.org%2fprojects%2fcommercial%2frules%2f&c=E,1,YdXBwuvFxQle3BFGAo78cBr0DrFBLfSYzsOLiBVFx9sfL2mexVkkcd97EhPLjH0JghrnYp3xm6vXkTfzq89pYVy4MaYQHtzzOS24URSQDmo,&typo=1>
>
> http://www.modsecurity.org/projects/commercial/support/ <https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fwww.modsecurity.org%2fprojects%2fcommercial%2fsupport%2f&c=E,1,J7DJCZf5gGJ1v7tRW7fqVmNqSBKpT8LRcU0o6hx0NUTjCLdEegxZ5JzGePWqCN2WIpjzKGqYbtYUwTisOwtYbhIGNtIGnr5v_R2Mrdh7&typo=1>
>
>
> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/