owasp-modsecurity / owasp-modsecurity/ModSecurity

`SecAuditLogStorageDir` behavior change from 2.9 to 3.x

Open
#2,392 11 comments 0 reactions 1 assignee View on GitHub

@zimmerle is already working on this.

Since Sep 2, 2020.

3.x
Dominant language
C++
Stars
9.8k
Forks
1.8k
Avg merge
2h 46m
Merged PRs (30d)
1

Description

Describe the bug

Given identical configuration (see the last section of the post for details) for Apache and mod sec 2 and thenginx connector and mod sec 3.0 SecAuditLogStorageDir behaves this way:

  1. Apache logs to $SecAuditLogStorageDir/<USER>/YYYYMMDD/…
  2. nginx logs to $SecAuditLogStorageDir/YYYYMMDD/…

To Reproduce

  1. configure an Apache machine like below
  2. configure an nginx machine like below
  3. do some traffic on both that would utilize SecAuditLogStorageDir
  4. compare SecAuditLogStorageDir on both machines and note the presence of $SecAuditLogStorageDir/<USER> on the apache one and the lack of $SecAuditLogStorageDir/<USER> on the nginx one

Expected behavior

the same configuration should behave the same way between 2.9 and 3.0 the docs give no reason to think otherwise for the configuration involved, in this case nginx connector should use $SecAuditLogStorageDir/<USER>/YYYYMMDD/…

Server:

  • WebServer: apache v2.4.46
    • ModSecurity version: mod_security2 v2.9.3
  • WebServer: nginx v1.19.1
    • ModSecurity version (and connector): libmodsecurity v3.0.4 with nginx-connector v1.0.1]
  • OS (and distro): CentOS 7

Rule Set:

  • only running owasp CRS v3.3.0

Additional context

besides module loading config in both ➜

Apache config:

SecAuditLog logs/modsec_audit.log
SecDebugLog logs/modsec_debug.log
SecDebugLogLevel 0
SecDefaultAction "phase:2,deny,log,status:406"

SecAuditLogStorageDir logs/modsec_audit
SecAuditLogType Concurrent

SecDataDir "/var/cpanel/secdatadir"
SecAuditEngine "RelevantOnly"
SecRuleEngine "On"

Include … all the OWASP rule files here

nginx config:

modsecurity on;

modsecurity_rules '
  SecAuditLog /var/log/nginx/modsec30_audit.log
  SecDebugLog /var/log/nginx/modsec30_debug.log
  SecDebugLogLevel 0
  SecDefaultAction "phase:2,deny,log,status:406"
  SecAuditLogStorageDir /var/log/nginx/modsec30_audit
  SecAuditLogType Concurrent
  SecAuditEngine RelevantOnly
  SecRuleEngine On
';

modsecurity_rules_file … all the OWASP  rule files here

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.