owasp-modsecurity / owasp-modsecurity/ModSecurity
`SecAuditLogStorageDir` behavior change from 2.9 to 3.x
@zimmerle is already working on this.
Since Sep 2, 2020.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
Describe the bug
Given identical configuration (see the last section of the post for details) for Apache and mod sec 2 and thenginx connector and mod sec 3.0 SecAuditLogStorageDir behaves this way:
- Apache logs to
$SecAuditLogStorageDir/<USER>/YYYYMMDD/… - nginx logs to
$SecAuditLogStorageDir/YYYYMMDD/…
To Reproduce
- configure an Apache machine like below
- configure an nginx machine like below
- do some traffic on both that would utilize
SecAuditLogStorageDir - compare
SecAuditLogStorageDiron both machines and note the presence of$SecAuditLogStorageDir/<USER>on the apache one and the lack of$SecAuditLogStorageDir/<USER>on the nginx one
Expected behavior
the same configuration should behave the same way between 2.9 and 3.0 the docs give no reason to think otherwise for the configuration involved, in this case nginx connector should use $SecAuditLogStorageDir/<USER>/YYYYMMDD/…
Server:
- WebServer: apache v2.4.46
- ModSecurity version: mod_security2 v2.9.3
- WebServer: nginx v1.19.1
- ModSecurity version (and connector): libmodsecurity v3.0.4 with nginx-connector v1.0.1]
- OS (and distro): CentOS 7
Rule Set:
- only running owasp CRS v3.3.0
Additional context
besides module loading config in both ➜
Apache config:
SecAuditLog logs/modsec_audit.log
SecDebugLog logs/modsec_debug.log
SecDebugLogLevel 0
SecDefaultAction "phase:2,deny,log,status:406"
SecAuditLogStorageDir logs/modsec_audit
SecAuditLogType Concurrent
SecDataDir "/var/cpanel/secdatadir"
SecAuditEngine "RelevantOnly"
SecRuleEngine "On"
Include … all the OWASP rule files here
nginx config:
modsecurity on;
modsecurity_rules '
SecAuditLog /var/log/nginx/modsec30_audit.log
SecDebugLog /var/log/nginx/modsec30_debug.log
SecDebugLogLevel 0
SecDefaultAction "phase:2,deny,log,status:406"
SecAuditLogStorageDir /var/log/nginx/modsec30_audit
SecAuditLogType Concurrent
SecAuditEngine RelevantOnly
SecRuleEngine On
';
modsecurity_rules_file … all the OWASP rule files here
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.