Re: capturing user logins
Robert Paprocki <[email protected]>
| Newsgroups | gmane.comp.apache.mod-security.user |
|---|---|
| Message-ID | <[email protected]> |
If the goal here is only to capture logic data, and not mutate or block the request, is modsecurity the right tool? Might it be saner to use a simpler proxy that sits in front of the web service and writes the audit trail as its sole function? > On Mar 26, 2019, at 17:03, Manuel Spartan <[email protected]> wrote: > > Hi Doug, you definitively need to read the book :) but in the meanwhile if you are ok with little explanations the best reference ever is the modsecurity reference manual https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29 there are rule examples as well as the descriptions of all operators, variables, actions, etc. > > Supposing the argument holding the username is called username something like the following example should get you started in Apache 2.2 and 2.4. > > SecRule ARGS:username "@eq (.*)" "phase:5,id:1,capture,pass,log,noauditlog,setenv:USER=%{matched_var},msg:'Username detected'" > LogFormat "%a,%t,%{USER}e,%s" usercapture > CustomLog logs/usercapture_log usercapture env=USER > Output: > 10.0.0.1,[26/SMar/2019:19:56:28 -0600],MyUser,302 > >> El mar., 26 mar. 2019 a las 16:01, Doug Erwin (<[email protected]>) escribió: >> Thanks for the guidance. I am still lost, but I ordered a book on amazon, “ModSecurity Handbook,second editin” because it has a chapter on writing rules. At this point I have nothing to help me understand what “phase:5,t:none….” Is and how to configure that stuff and what the various options are. Mine is a system that has modsecurity embedded in it and is on a Microsoft IIS platform and writes the log entries into the event viewer. I plan to do a lot of reading as soon as I get it. I want a real log file and not an event viewer and I want the info I need. I think modsecurity can be a powerful asset, especially since it is already there, but I have to master it first. I just want to capture timestamp, username, and IP from a login attempt and be able to keep that for posterity. >> >> >> >> Doug >> >> >> >> Doug Erwin >> >> President >> >> TTP Solutions / TheTradingPortal.com >> >> [email protected] >> >> Office: 615-469-0409 >> >> Cell: 615-498-4756 >> >> <image001.png> >> >> >> >> From: Joel Williams <[email protected]> >> Sent: Tuesday, March 26, 2019 12:46 AM >> To: [email protected] >> Subject: Re: [mod-security-users] capturing user logins >> >> >> >> Hi Doug, >> >> Just as an example, here's an extract of what I do to detect successful WordPress logins. >> >> <Locationmatch ".*wp-login\.php"> >> SecRule RESPONSE_STATUS "302" "phase:5,t:none,log,pass,setvar:ip.bf_counter=0,sanitiseArg:pwd,msg:'wordpress-login-success',id:5000136" >> </locationmatch> >> >> Based on my specific knowledge of WordPress, a 302 response from the wp-login.php script indicates that a successful login occurred, because it redirects users to the correct page (generally - there are some false positives that I haven't bothered to filter out). >> >> The POST body is also logged, and the password is sanitised so that I only get the user name. I monitor the mod_security logs with Splunk, which extracts individual events and generates a report of logins. You can also do fancier things like generate alerts based on unusual IP address geolocation lookups and time of day. >> >> There might not be a general purpose way to log this information across every possible system and not affect performance, but hopefully this is not a requirement. I guess you could scan ever POST request's body for username/uname/user and hope this catches all cases. >> >> Joel >> >> >> Manuel Spartan wrote on 26/3/19 11:34 am: >> >> >> Hi Doug, as said before the easiest way is setup a rule to extract the info and parse it in elk or whatever you use, alternatively you can create an environment variable in the rule to get the info and use a conditional apache custom log to save the extracted info if the env var is set in the format you need so you have a clean file with the info. >> >> >> >> https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#setenv >> >> >> >> Cheers! >> >> Sent from my iPhone >> >> >> On 25 Mar 2019, at 16:31, Doug Erwin <[email protected]> wrote: >> >> I would definitely welcome some help. If I understand correctly, it writes everything to the event viewer -> application log. Is there a way to redirect that just write a log file to the file system, maybe even a separate log just for these user logins? >> >> >> >> Also, is there an online tutorial about writing rules for modsecurity? Maybe something on youtube? >> >> >> >> Doug >> >> >> >> Doug Erwin >> >> President >> >> TTP Solutions / TheTradingPortal.com >> >> [email protected] >> >> Office: 615-469-0409 >> >> Cell: 615-498-4756 >> >> <image001.png> >> >> >> >> From: Chaim Sanders <[email protected]> >> Sent: Monday, March 25, 2019 2:54 PM >> To: [email protected] >> Subject: Re: [mod-security-users] capturing user logins >> >> >> >> Yes, >> >> You can make a rule that checks if the parameter with the username is provided and log that. You can then parse the log or use MLogc to move things to third party servers like elasticsearch. Let me know if that makes sense or you need more help. >> >> Thanks, >> >> - Chaim >> >> >> >> On Mon, Mar 25, 2019 at 3:01 PM Doug Erwin <[email protected]> wrote: >> >> Hi all, I am new to modsecurity but I would like to use it to capture user logins so that I could build a history of user access over time. Is there a way to do that? I am pretty sure that this would be a new special or custom rule. Any thoughts on this? >> >> >> >> Thanks in advance. >> >> >> >> Doug >> >> >> >> Doug Erwin >> >> President >> >> TTP Solutions / TheTradingPortal.com >> >> [email protected] >> >> Office: 615-469-0409 >> >> Cell: 615-498-4756 >> >> <image001.png> >> >> >> >> _______________________________________________ >> mod-security-users mailing list >> [email protected] >> https://lists.sourceforge.net/lists/listinfo/mod-security-users >> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: >> http://www.modsecurity.org/projects/commercial/rules/ >> http://www.modsecurity.org/projects/commercial/support/ >> >> >> >> >> >> -- >> >> -- >> Chaim Sanders >> http://www.ChaimSanders.com >> >> _______________________________________________ >> mod-security-users mailing list >> [email protected] >> https://lists.sourceforge.net/lists/listinfo/mod-security-users >> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: >> http://www.modsecurity.org/projects/commercial/rules/ >> http://www.modsecurity.org/projects/commercial/support/ >> >> >> >> >> >> >> >> _______________________________________________ >> mod-security-users mailing list >> [email protected] >> https://lists.sourceforge.net/lists/listinfo/mod-security-users >> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: >> http://www.modsecurity.org/projects/commercial/rules/ >> http://www.modsecurity.org/projects/commercial/support/ >> >> >> _______________________________________________ >> mod-security-users mailing list >> [email protected] >> https://lists.sourceforge.net/lists/listinfo/mod-security-users >> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: >> http://www.modsecurity.org/projects/commercial/rules/ >> http://www.modsecurity.org/projects/commercial/support/ > _______________________________________________ > mod-security-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/mod-security-users > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > http://www.modsecurity.org/projects/commercial/rules/ > http://www.modsecurity.org/projects/commercial/support/ _______________________________________________ mod-security-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/mod-security-users Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: http://www.modsecurity.org/projects/commercial/rules/ http://www.modsecurity.org/projects/commercial/support/