Question

有人可以帮助我设置规则，以便我仅获取使用POST发布的数据。我有一个要提交姓名和电子邮件ID的表格。我只想保存要保存在日志文件中的那部分。在我的情况下，我只想在日志文件中的以下数据：-

--29000000-C--
name1=ssn&email1=ssn%40gmail.com
--29000000-F--
HTTP/1.1 200 OK
X-Powered-By: PHP/7.2.4
Content-Length: 16
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

我目前的mod_security如下：-

<IfModule security2_module>
#Enable the module.
SecRuleEngine On
SecAuditEngine on

#Setup logging in a dedicated file.
SecAuditLog C:/wamp64/bin/apache/apache2.4.33/logs/website-audit.log

#Allow it to access requests body.
SecRequestBodyAccess on
SecAuditLogParts ABIFHZ

#Setup default action.
SecDefaultAction "nolog,noauditlog,allow,phase:2"

#Define the rule that will log the content of POST requests.
SecRule REQUEST_METHOD "^POST$" "chain,allow,phase:2,id:123"
SecRule REQUEST_URI ".*" "auditlog"

</ifmodule>

Answer 1

我找到了解决问题的方法。我们可以根据需要设置以下字段：-

SecAuditLogParts ABIFHZ

就我而言，我将该字段设置为：- SecAuditLogParts C

但是它将显示为：-

template <typename = void>
struct X {
   constexpr static int size() { return 5; }
   static const int array[size()]; 
};

int main()
{
    X<> x{};
    ...
}

如何在Apache的mod_security模块中设置规则

1 个答案: