mod-security-users

[mod-security-users] Modsecurity Nginx: Audit log not being populated

[Christian V. <cv...@it...>]

Hello, I’ve conpiled a nginx and Modsecurity today, every works fine except the audit log. The audit log is not being populated, the attacks are logged only in the error log but not in the audit log.
If I change modsecurity to “DetectionOnly” the audit logs start to being populated but if I set modsecurity in “On” the audit log does not work…
This is my setup:

nginx version: 1.15.8.1
Modsecurity: branch v3/Master from GitHub

I have this lines to log the transactions:

SecRuleEngine On
SecDefaultAction "phase:1,log,auditlog,deny,status:403"
SecDefaultAction "phase:2,log,auditlog,deny,status:403"


SecAuditLogDirMode 1733
SecAuditLogFileMode 0550
SecAuditLogFormat JSON
SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4)”
SecAuditLogParts ABCHIZ
SecAuditLogType Serial
SecAuditLog /opt/waf/nginx/var/log/nnoc.vtr.cl/nnoc.vtr.cl_audit.log



Maybe I need to fix my configuration ?
Does anybody else is experimenting the same ?

Thanks in advanced.
Cheers.
Chris.

Re: [mod-security-users] Modsecurity Nginx: Audit log not being populated

[Peter K. <pe...@kr...>]

Let me add a "me too"!

nginx 1.17.x

Am 2020-02-11 20:05, schrieb Christian Varas:
> Hello, I’ve conpiled a nginx and Modsecurity today, every works fine
> except the audit log. The audit log is not being populated, the
> attacks are logged only in the error log but not in the audit log.
> If I change modsecurity to “DetectionOnly” the audit logs start to
> being populated but if I set modsecurity in “On” the audit log does
> not work…
> This is my setup:
> 
> nginx version: 1.15.8.1
> Modsecurity: branch v3/Master from GitHub
> 
> I have this lines to log the transactions:
> 
> SecRuleEngine On
> SecDefaultAction "phase:1,log,auditlog,deny,status:403"
> SecDefaultAction "phase:2,log,auditlog,deny,status:403"
> 
> 
> SecAuditLogDirMode 1733
> SecAuditLogFileMode 0550
> SecAuditLogFormat JSON
> SecAuditEngine RelevantOnly
> SecAuditLogRelevantStatus "^(?:5|4)”
> SecAuditLogParts ABCHIZ
> SecAuditLogType Serial
> SecAuditLog /opt/waf/nginx/var/log/nnoc.vtr.cl/nnoc.vtr.cl_audit.log
> 
> 
> 
> Maybe I need to fix my configuration ?
> Does anybody else is experimenting the same ?
> 
> Thanks in advanced.
> Cheers.
> Chris.
> 
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] Modsecurity Nginx: Audit log not being populated

[Christian F. <chr...@ne...>]

Hey guys,

the configuration looks correct. Normally the file permissions can pose
a problem. However, the fact that DetectionOnly makes it functional points to
a ModSec bug, which you may want to report on github.

The ModSec devs are hardly active on this ML, but they are usually quick to
react on github issues.

Please keep us posted.

Christian

On Wed, Feb 12, 2020 at 09:49:02AM +0100, Peter Kreuser wrote:
> Let me add a "me too"!
> 
> nginx 1.17.x
> 
> Am 2020-02-11 20:05, schrieb Christian Varas:
> > Hello, I’ve conpiled a nginx and Modsecurity today, every works fine
> > except the audit log. The audit log is not being populated, the
> > attacks are logged only in the error log but not in the audit log.
> > If I change modsecurity to “DetectionOnly” the audit logs start to
> > being populated but if I set modsecurity in “On” the audit log does
> > not work…
> > This is my setup:
> > 
> > nginx version: 1.15.8.1
> > Modsecurity: branch v3/Master from GitHub
> > 
> > I have this lines to log the transactions:
> > 
> > SecRuleEngine On
> > SecDefaultAction "phase:1,log,auditlog,deny,status:403"
> > SecDefaultAction "phase:2,log,auditlog,deny,status:403"
> > 
> > 
> > SecAuditLogDirMode 1733
> > SecAuditLogFileMode 0550
> > SecAuditLogFormat JSON
> > SecAuditEngine RelevantOnly
> > SecAuditLogRelevantStatus "^(?:5|4)”
> > SecAuditLogParts ABCHIZ
> > SecAuditLogType Serial
> > SecAuditLog /opt/waf/nginx/var/log/nnoc.vtr.cl/nnoc.vtr.cl_audit.log
> > 
> > 
> > 
> > Maybe I need to fix my configuration ?
> > Does anybody else is experimenting the same ?
> > 
> > Thanks in advanced.
> > Cheers.
> > Chris.
> > 
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
> 
> 
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] Modsecurity Nginx: Audit log not being populated

[Christian F. <chr...@ne...>]

Actually, the problem has been reported before. There is working fix that is
making it's way into the master src code tree as we speak.

https://github.com/SpiderLabs/ModSecurity-nginx/issues/170


On Wed, Feb 12, 2020 at 10:50:38AM +0100, Christian Folini wrote:
> Hey guys,
> 
> the configuration looks correct. Normally the file permissions can pose
> a problem. However, the fact that DetectionOnly makes it functional points to
> a ModSec bug, which you may want to report on github.
> 
> The ModSec devs are hardly active on this ML, but they are usually quick to
> react on github issues.
> 
> Please keep us posted.
> 
> Christian
> 
> On Wed, Feb 12, 2020 at 09:49:02AM +0100, Peter Kreuser wrote:
> > Let me add a "me too"!
> > 
> > nginx 1.17.x
> > 
> > Am 2020-02-11 20:05, schrieb Christian Varas:
> > > Hello, I’ve conpiled a nginx and Modsecurity today, every works fine
> > > except the audit log. The audit log is not being populated, the
> > > attacks are logged only in the error log but not in the audit log.
> > > If I change modsecurity to “DetectionOnly” the audit logs start to
> > > being populated but if I set modsecurity in “On” the audit log does
> > > not work…
> > > This is my setup:
> > > 
> > > nginx version: 1.15.8.1
> > > Modsecurity: branch v3/Master from GitHub
> > > 
> > > I have this lines to log the transactions:
> > > 
> > > SecRuleEngine On
> > > SecDefaultAction "phase:1,log,auditlog,deny,status:403"
> > > SecDefaultAction "phase:2,log,auditlog,deny,status:403"
> > > 
> > > 
> > > SecAuditLogDirMode 1733
> > > SecAuditLogFileMode 0550
> > > SecAuditLogFormat JSON
> > > SecAuditEngine RelevantOnly
> > > SecAuditLogRelevantStatus "^(?:5|4)”
> > > SecAuditLogParts ABCHIZ
> > > SecAuditLogType Serial
> > > SecAuditLog /opt/waf/nginx/var/log/nnoc.vtr.cl/nnoc.vtr.cl_audit.log
> > > 
> > > 
> > > 
> > > Maybe I need to fix my configuration ?
> > > Does anybody else is experimenting the same ?
> > > 
> > > Thanks in advanced.
> > > Cheers.
> > > Chris.
> > > 
> > > _______________________________________________
> > > mod-security-users mailing list
> > > mod...@li...
> > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > http://www.modsecurity.org/projects/commercial/rules/
> > > http://www.modsecurity.org/projects/commercial/support/
> > 
> > 
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
> 
> 
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] Modsecurity Nginx: Audit log not being populated

[Christian V. <cv...@it...>]

Sorry the delay, thanks 😊 this worked!

Cheers!
Chris.

> El 12-02-2020, a la(s) 10:00, Christian Folini <chr...@ne...> escribió:
> 
> Actually, the problem has been reported before. There is working fix that is
> making it's way into the master src code tree as we speak.
> 
> https://github.com/SpiderLabs/ModSecurity-nginx/issues/170
> 
> 
>> On Wed, Feb 12, 2020 at 10:50:38AM +0100, Christian Folini wrote:
>> Hey guys,
>> 
>> the configuration looks correct. Normally the file permissions can pose
>> a problem. However, the fact that DetectionOnly makes it functional points to
>> a ModSec bug, which you may want to report on github.
>> 
>> The ModSec devs are hardly active on this ML, but they are usually quick to
>> react on github issues.
>> 
>> Please keep us posted.
>> 
>> Christian
>> 
>>> On Wed, Feb 12, 2020 at 09:49:02AM +0100, Peter Kreuser wrote:
>>> Let me add a "me too"!
>>> 
>>> nginx 1.17.x
>>> 
>>> Am 2020-02-11 20:05, schrieb Christian Varas:
>>>> Hello, I’ve conpiled a nginx and Modsecurity today, every works fine
>>>> except the audit log. The audit log is not being populated, the
>>>> attacks are logged only in the error log but not in the audit log.
>>>> If I change modsecurity to “DetectionOnly” the audit logs start to
>>>> being populated but if I set modsecurity in “On” the audit log does
>>>> not work…
>>>> This is my setup:
>>>> 
>>>> nginx version: 1.15.8.1
>>>> Modsecurity: branch v3/Master from GitHub
>>>> 
>>>> I have this lines to log the transactions:
>>>> 
>>>> SecRuleEngine On
>>>> SecDefaultAction "phase:1,log,auditlog,deny,status:403"
>>>> SecDefaultAction "phase:2,log,auditlog,deny,status:403"
>>>> 
>>>> 
>>>> SecAuditLogDirMode 1733
>>>> SecAuditLogFileMode 0550
>>>> SecAuditLogFormat JSON
>>>> SecAuditEngine RelevantOnly
>>>> SecAuditLogRelevantStatus "^(?:5|4)”
>>>> SecAuditLogParts ABCHIZ
>>>> SecAuditLogType Serial
>>>> SecAuditLog /opt/waf/nginx/var/log/nnoc.vtr.cl/nnoc.vtr.cl_audit.log
>>>> 
>>>> 
>>>> 
>>>> Maybe I need to fix my configuration ?
>>>> Does anybody else is experimenting the same ?
>>>> 
>>>> Thanks in advanced.
>>>> Cheers.
>>>> Chris.
>>>> 
>>>> _______________________________________________
>>>> mod-security-users mailing list
>>>> mod...@li...
>>>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>>>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>>>> http://www.modsecurity.org/projects/commercial/rules/
>>>> http://www.modsecurity.org/projects/commercial/support/
>>> 
>>> 
>>> _______________________________________________
>>> mod-security-users mailing list
>>> mod...@li...
>>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>>> http://www.modsecurity.org/projects/commercial/rules/
>>> http://www.modsecurity.org/projects/commercial/support/
>> 
>> 
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
> 
> 
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/