Skip to content

Adding ModSecurity parameter for audit log format. #2583

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Jan 8, 2025
Merged

Adding ModSecurity parameter for audit log format. #2583

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
3c58ec6
Adding ModSecurity parameter for audit log format.
tamerz Nov 28, 2024
db12e0e
Update REFERENCE.md with new parameter
tamerz Nov 28, 2024
b085de6
Fixed docstring to fit existing format
tamerz Nov 28, 2024
72ceff3
Following smortex's suggestions
TamesNU Jan 5, 2025
9fd0db7
Merge branch 'main' into modsec_log_format
TamesNU Jan 5, 2025
8a10df5
Regenerate REFERENCE.md
smortex Jan 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions REFERENCE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6075,6 +6075,7 @@ The following parameters are available in the `apache::mod::security` class:
* [`audit_log_relevant_status`](#-apache--mod--security--audit_log_relevant_status)
* [`audit_log_parts`](#-apache--mod--security--audit_log_parts)
* [`audit_log_type`](#-apache--mod--security--audit_log_type)
* [`audit_log_format`](#-apache--mod--security--audit_log_format)
* [`audit_log_storage_dir`](#-apache--mod--security--audit_log_storage_dir)
* [`secpcrematchlimit`](#-apache--mod--security--secpcrematchlimit)
* [`secpcrematchlimitrecursion`](#-apache--mod--security--secpcrematchlimitrecursion)
Expand Down Expand Up @@ -6194,6 +6195,14 @@ Defines the type of audit logging mechanism to be used.

Default value: `$apache::params::modsec_audit_log_type`

##### <a name="-apache--mod--security--audit_log_format"></a>`audit_log_format`

Data type: `Enum['Native', 'JSON']`

Defines what format the logs should be written in.

Default value: `'Native'`

##### <a name="-apache--mod--security--audit_log_storage_dir"></a>`audit_log_storage_dir`

Data type: `Optional[Stdlib::Absolutepath]`
Expand Down
5 changes: 5 additions & 0 deletions manifests/mod/security.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,9 @@
#
# @param audit_log_type
# Defines the type of audit logging mechanism to be used.
#
# @param audit_log_format
# Defines what format the logs should be written in.
#
# @param audit_log_storage_dir
# Defines the directory where concurrent audit log entries are to be stored. This directive is only needed when concurrent audit logging is used.
Expand Down Expand Up @@ -143,6 +146,7 @@
String $audit_log_relevant_status = '^(?:5|4(?!04))',
String $audit_log_parts = $apache::params::modsec_audit_log_parts,
String $audit_log_type = $apache::params::modsec_audit_log_type,
Enum['Native', 'JSON'] $audit_log_format = 'Native',
Optional[Stdlib::Absolutepath] $audit_log_storage_dir = undef,
Integer $secpcrematchlimit = $apache::params::secpcrematchlimit,
Integer $secpcrematchlimitrecursion = $apache::params::secpcrematchlimitrecursion,
Expand Down Expand Up @@ -256,6 +260,7 @@
'audit_log_relevant_status' => $audit_log_relevant_status,
'audit_log_parts' => $audit_log_parts,
'audit_log_type' => $audit_log_type,
'audit_log_format' => $audit_log_format,
'audit_log_storage_dir' => $audit_log_storage_dir,
'logroot' => $logroot,
}
Expand Down
2 changes: 2 additions & 0 deletions spec/classes/mod/security_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,6 +102,7 @@
audit_log_relevant_status: '^(?:5|4(?!01|04))',
audit_log_parts: 'ABCDZ',
audit_log_type: 'Concurrent',
audit_log_format: 'JSON',
audit_log_storage_dir: '/var/log/httpd/audit',
secdefaultaction: 'deny,status:406,nolog,auditlog',
secrequestbodyaccess: 'Off',
Expand All @@ -114,6 +115,7 @@
it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecAuditLogRelevantStatus "\^\(\?:5\|4\(\?!01\|04\)\)"$} }
it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecAuditLogParts ABCDZ$} }
it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecAuditLogType Concurrent$} }
it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecAuditLogFormat JSON$} }
it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecAuditLogStorageDir /var/log/httpd/audit$} }
it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecRequestBodyAccess Off$} }
it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecResponseBodyAccess On$} }
Expand Down
3 changes: 3 additions & 0 deletions templates/mod/security.conf.epp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,9 @@
SecAuditLogRelevantStatus "<%= $audit_log_relevant_status %>"
SecAuditLogParts <%= $audit_log_parts %>
SecAuditLogType <%= $audit_log_type %>
<%- if $audit_log_format == 'JSON' { -%>
SecAuditLogFormat JSON
<%- } -%>
<%- if $audit_log_storage_dir { -%>
SecAuditLogStorageDir <%= $audit_log_storage_dir %>
<%- } -%>
Expand Down