Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow configuring mod_security's SecAuditLogParts #1392

Merged
merged 6 commits into from
Mar 10, 2016
Merged

Allow configuring mod_security's SecAuditLogParts #1392

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
7212175
Allow configuring mod_security's SecAuditLogParts
Mar 8, 2016
d2699d1
Add SecAuditLogParts tests for Debian-based systems
Mar 8, 2016
78ee594
Fix parameter name
Mar 9, 2016
388ab4b
Use regular expression rather than exact string match
Mar 9, 2016
3d5aa16
Move default value outside the redhat-specific section
Mar 9, 2016
9ac6064
Document mod_security's audit_log_parts parameter in README
Mar 10, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,8 @@
[Apache modules]: https://httpd.apache.org/docs/current/mod/
[array]: https://docs.puppetlabs.com/puppet/latest/reference/lang_data_array.html

[audit log]: https://github.com/SpiderLabs/ModSecurity/wiki/ModSecurity-2-Data-Formats#audit-log

[beaker-rspec]: https://github.com/puppetlabs/beaker-rspec

[certificate revocation list]: https://httpd.apache.org/docs/current/mod/mod_ssl.html#sslcarevocationfile
Expand Down Expand Up @@ -1706,6 +1708,7 @@ ${modsec\_dir}/activated\_rules.
- `restricted_headers`: A list of restricted headers separated by slashes and spaces. Default: 'Proxy-Connection/ /Lock-Token/ /Content-Range/ /Translate/ /via/ /if/'.
- `secpcrematchlimit`: Sets the number for the match limit in the PCRE library. Default: '1500'
- `secpcrematchlimitrecursion`: Sets the number for the match limit recursion in the PCRE library. Default: '1500'
- `audit_log_parts`: Sets the sections to be put in the [audit log][]. Default: 'ABIJDEFHZ'

##### Class: `apache::mod::wsgi`

Expand Down
2 changes: 2 additions & 0 deletions manifests/mod/security.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
$activated_rules = $::apache::params::modsec_default_rules,
$modsec_dir = $::apache::params::modsec_dir,
$modsec_secruleengine = $::apache::params::modsec_secruleengine,
$audit_log_parts = $::apache::params::modsec_audit_log_parts,
$secpcrematchlimit = $::apache::params::secpcrematchlimit,
$secpcrematchlimitrecursion = $::apache::params::secpcrematchlimitrecursion,
$allowed_methods = 'GET HEAD POST OPTIONS',
Expand Down Expand Up @@ -35,6 +36,7 @@

# Template uses:
# - $modsec_dir
# - $audit_log_parts
# - secpcrematchlimit
# - secpcrematchlimitrecursion
file { 'security.conf':
Expand Down
2 changes: 2 additions & 0 deletions manifests/params.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,8 @@

$vhost_include_pattern = '*'

$modsec_audit_log_parts = 'ABIJDEFHZ'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

According to the docs the default is ABCFHZ. Why did you choose this instead? It actually says that D isn't even implemented yet.


if $::operatingsystem == 'Ubuntu' and $::lsbdistrelease == '10.04' {
$verify_command = '/usr/sbin/apache2ctl -t'
} else {
Expand Down
18 changes: 18 additions & 0 deletions spec/classes/mod/security_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@
it { should contain_file('security.conf').with(
:path => '/etc/httpd/conf.modules.d/security.conf'
) }
it { should contain_file('security.conf').with_content %r{^\s+SecAuditLogParts ABIJDEFHZ$} }
it { should contain_file('/etc/httpd/modsecurity.d').with(
:ensure => 'directory',
:path => '/etc/httpd/modsecurity.d',
Expand All @@ -43,6 +44,14 @@
:path => '/etc/httpd/modsecurity.d/security_crs.conf'
) }
it { should contain_apache__security__rule_link('base_rules/modsecurity_35_bad_robots.data') }

describe 'with parameters' do
let :params do
{ :audit_log_parts => "ABCDZ"
}
end
it { should contain_file('security.conf').with_content %r{^\s+SecAuditLogParts ABCDZ$} }
end
end

context "on Debian based systems" do
Expand Down Expand Up @@ -71,6 +80,7 @@
it { should contain_file('security.conf').with(
:path => '/etc/apache2/mods-available/security.conf'
) }
it { should contain_file('security.conf').with_content %r{^\s+SecAuditLogParts ABIJDEFHZ$} }
it { should contain_file('/etc/modsecurity').with(
:ensure => 'directory',
:path => '/etc/modsecurity',
Expand All @@ -87,6 +97,14 @@
:path => '/etc/modsecurity/security_crs.conf'
) }
it { should contain_apache__security__rule_link('base_rules/modsecurity_35_bad_robots.data') }

describe 'with parameters' do
let :params do
{ :audit_log_parts => "ACEZ"
}
end
it { should contain_file('security.conf').with_content %r{^\s+SecAuditLogParts ACEZ$} }
end
end

end
2 changes: 1 addition & 1 deletion templates/mod/security.conf.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@
SecDebugLogLevel 0
SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4(?!04))"
SecAuditLogParts ABIJDEFHZ
SecAuditLogParts <%= @audit_log_parts %>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, because this was already the default...

SecAuditLogType Serial
SecArgumentSeparator &
SecCookieFormat 0
Expand Down