{"id":319,"date":"2011-06-10T15:34:34","date_gmt":"2011-06-10T13:34:34","guid":{"rendered":"http:\/\/antynet.pl\/?p=319"},"modified":"2011-06-10T15:37:06","modified_gmt":"2011-06-10T13:37:06","slug":"mod_security-i-logi-czyli-mlogc-i-auditconsole","status":"publish","type":"post","link":"https:\/\/www.antynet.pl\/index.php\/2011\/06\/10\/mod_security-i-logi-czyli-mlogc-i-auditconsole\/","title":{"rendered":"mod_security i logi czyli mlogc i AuditConsole"},"content":{"rendered":"<p>Postanowi\u0142em opisa\u0107 tutaj konfiguracj\u0119 aplikacji AuditConsole na kt\u00f3r\u0105 b\u0119d\u0105 wysy\u0142ane logi z mod_security i prezentowane na www (szczeg\u00f3\u0142y na <a href=\"http:\/\/jwall.org\/about\" rel=\"nofollow noopener\" target=\"_blank\">http:\/\/jwall.org\/about<\/a>)<\/p>\n<p>B\u0119d\u0119 pisa\u0142 w r\u00f3wnowa\u017cnikach zda\u0144 bo tak jest kr\u00f3tko i tre\u015bciwie,<br \/>\na orginalna wersja jest pisana pod emacs-em w trybie org-mode wi\u0119c sorrki za ewentualny rozjazd<\/p>\n<div id=\"content\">\n<div id=\"table-of-contents\">\n<h2>Table of Contents<\/h2>\n<div id=\"text-table-of-contents\">\n<ul>\n<li><a href=\"#sec-1\">1 dodatkowe paczki do kompilacji modsecurity <\/a><\/li>\n<li><a href=\"#sec-2\">2 kompilacja mlogc w modsecurity <\/a><\/li>\n<li><a href=\"#sec-3\">3 przygotowanie \u015brodowiska <\/a><\/li>\n<li><a href=\"#sec-4\">4 instalacja AuditConsole <\/a><\/li>\n<li><a href=\"#sec-5\">5 konfiguracja AuditConsole <\/a><\/li>\n<li><a href=\"#sec-6\">6 konfiguracja mlogc <\/a><\/li>\n<li><a href=\"#sec-7\">7 konfiguracja modsecurity: <\/a><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<div id=\"outline-container-1\" class=\"outline-2\">\n<h2 id=\"sec-1\"><span class=\"section-number-2\">1<\/span> dodatkowe paczki do kompilacji modsecurity<\/h2>\n<div id=\"text-1\" class=\"outline-text-2\">\n<ul>\n<li> libcurl-devel<\/li>\n<li> libxml2-devel<\/li>\n<li> pcre-devel<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<div id=\"outline-container-2\" class=\"outline-2\">\n<h2 id=\"sec-2\"><span class=\"section-number-2\">2<\/span> kompilacja mlogc w modsecurity<\/h2>\n<div id=\"text-2\" class=\"outline-text-2\">\n<ul>\n<li> cd modsecurity-apache_2.5.13<\/li>\n<li> make mlogc<\/li>\n<li> po\u0142o\u017cenie skompilowanego obiektu\n<ul>\n<li> modsecurity-apache_2.5.13\/rules\/util\/mlogc<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<div id=\"outline-container-3\" class=\"outline-2\">\n<h2 id=\"sec-3\"><span class=\"section-number-2\">3<\/span> przygotowanie \u015brodowiska<\/h2>\n<div id=\"text-3\" class=\"outline-text-2\">\n<ul>\n<li> mkdir \/etc\/httpd\/mlogc \/etc\/httpd\/mlogc\/logs<\/li>\n<li> cp \u2026\/mlogc \/etc\/httpd\/mlogc\/mlogc<\/li>\n<li> touch \/etc\/httpd\/mlogc\/mlogc.conf<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<div id=\"outline-container-4\" class=\"outline-2\">\n<h2 id=\"sec-4\"><span class=\"section-number-2\">4<\/span> instalacja AuditConsole<\/h2>\n<div id=\"text-4\" class=\"outline-text-2\">\n<ul>\n<li> dowlnoad i unzip AuditConsole-0.4.2-4-standalone.zip z <a href=\"http:\/\/jwall.org\/web\/audit\/console\/download.jsp\" rel=\"nofollow noopener\" target=\"_blank\">http:\/\/jwall.org\/web\/audit\/console\/download.jsp<\/a><\/li>\n<li> sprawdzenie czy wersja java &gt; 1.6 poleceniem java -version<\/li>\n<li> zmiana u\u017ctkownika i grupy dla plik\u00f3w w [$AuditConsole_HOME]<\/li>\n<li> download postgresql jdbc4 driver z <a href=\"http:\/\/jdbc.postgresql.org\/download.html#current\" rel=\"nofollow noopener\" target=\"_blank\">http:\/\/jdbc.postgresql.org\/download.html#current<\/a><\/li>\n<li> cp postgresql-9.0-801.jdbc4.jar [$AuditConsole_HOME]\/lib\/<\/li>\n<li> stworzenie nowej bazy postgresql dla obs\u0142ugi w\/w:\n<ul>\n<li> createdb [dbname] -O [owner]<\/li>\n<\/ul>\n<\/li>\n<li> chmod o+x [$AuditConsole]\/bin\/*.sh<\/li>\n<li> konfiguracja portu Tomcata [$AuditConsole_HOME]\/bin\/catalina.sh w sekcji CONSOLE_HTTP_PORT=[port]<\/li>\n<li> uruchomienie przez [$AuditConsole_HOME]\/bin\/startup.sh<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<div id=\"outline-container-5\" class=\"outline-2\">\n<h2 id=\"sec-5\"><span class=\"section-number-2\">5<\/span> konfiguracja AuditConsole<\/h2>\n<div id=\"text-5\" class=\"outline-text-2\">\n<ul>\n<li> logowanie na www (uruchomiony zostanie wizzard)\n<ul>\n<li> http:\/\/[AuditConsole_host]:[port]\/<\/li>\n<li> admin\/admin<\/li>\n<\/ul>\n<\/li>\n<li> wpisy dla wizzarda (dost\u0119pne p\u00f3\u017aniej w menu System =&gt; Setup =&gt; Storage Engine\n<ul>\n<li> jdbc url: jdbc:postgresql:\/\/localhost:5432\/[dbname]<\/li>\n<li> User: [dbuser]<\/li>\n<li> Password: [dbpass]<\/li>\n<li> Storage Type: Database<\/li>\n<li> Data directory: [$AuditConsole_HOME]\/var\/data<\/li>\n<li> Database limit: 1024<\/li>\n<\/ul>\n<\/li>\n<li> dodanie sensora\n<ul>\n<li> menu System =&gt; Sensors =&gt; New Sensor<\/li>\n<li> nada\u0107 [sensor_name] i [sensor_password]<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<div id=\"outline-container-6\" class=\"outline-2\">\n<h2 id=\"sec-6\"><span class=\"section-number-2\">6<\/span> konfiguracja mlogc<\/h2>\n<div id=\"text-6\" class=\"outline-text-2\">\n<ul>\n<li> wpisy w \/etc\/httpd\/mlogc\/mlogc.conf<br \/>\nCollectorRoot       \/etc\/httpd\/mlogc\/logs<br \/>\nErrorLog            mlogc-error.log<br \/>\nErrorLogLevel       3<br \/>\nTransactionLog      mlogc-transaction.log<br \/>\nQueuePath           mlogc-queue.log<br \/>\nLockFile            mlogc.lck<br \/>\nConsoleURI          &#8222;http:\/\/[AuditConsole_host]:[port]\/rpc\/auditLogReceiver&#8221;<br \/>\nSensorUsername      &#8222;[sensor_name]&#8221;<br \/>\nSensorPassword      &#8222;[sensor_password]&#8221;<br \/>\nLogStorageDir       \/etc\/httpd\/modsec\/logs<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<div id=\"outline-container-7\" class=\"outline-2\">\n<h2 id=\"sec-7\"><span class=\"section-number-2\">7<\/span> konfiguracja modsecurity:<\/h2>\n<div id=\"text-7\" class=\"outline-text-2\">\n<ul>\n<li> zmiana konfiguracji:<br \/>\nSecAuditLogType Serial<br \/>\nSecAuditLog logs\/modsec_audit.log<\/li>\n<li> na<br \/>\nSecAuditLogType Concurrent<br \/>\nSecAuditLogStorageDir \/etc\/httpd\/modsec\/logs<br \/>\nSecAuditLog &#8222;|\/etc\/httpd\/mlogc\/mlogc \/etc\/httpd\/mlogc\/mlogc.conf&#8221;<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<div id=\"postamble\">\n<p class=\"date\">inspiracja &#8211; amon \ud83d\ude42<\/p>\n<p class=\"date\">Date: 2011-06-10 15:26:56 CEST<\/p>\n<p class=\"creator\">HTML generated by org-mode 6.33x in emacs 23<\/p>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Postanowi\u0142em opisa\u0107 tutaj konfiguracj\u0119 aplikacji AuditConsole na kt\u00f3r\u0105 b\u0119d\u0105 wysy\u0142ane logi z mod_security i prezentowane na www (szczeg\u00f3\u0142y na http:\/\/jwall.org\/about) B\u0119d\u0119 pisa\u0142 w r\u00f3wnowa\u017cnikach zda\u0144 bo tak jest kr\u00f3tko i tre\u015bciwie, a orginalna wersja jest pisana pod emacs-em w trybie org-mode wi\u0119c sorrki za ewentualny rozjazd Table of Contents 1 dodatkowe paczki do kompilacji modsecurity [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[4],"tags":[],"class_list":["post-319","post","type-post","status-publish","format-standard","hentry","category-sciaga-admina"],"_links":{"self":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts\/319","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/comments?post=319"}],"version-history":[{"count":6,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts\/319\/revisions"}],"predecessor-version":[{"id":324,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts\/319\/revisions\/324"}],"wp:attachment":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/media?parent=319"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/categories?post=319"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/tags?post=319"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}