3

I remember using a logging module or add-on for apache2 to inspect the contents of POST/PUT/GET data coming in and out of my webserver.

Here's a screenshot that I took back then: enter image description here

11

What you are showing us, are logs generated by Modsecurity. You can tell they're ModSecurity because of the segment messages that look like this:

--6b253045-A--
...
--6b253045-B--
...
--6b253045-C--
...
--6b253045-F--
...
--6b253045-E--
...
--6b253045-H--
...
--6b253045-Z--

Modsecurity is a layer-7 firewall/filter on top of Apache, and belongs to a class of security applications known as WAF - Web Application Firewall(s).

The corresponding package is known as libapache2-mod-security in Debian and derivative systems (including Ubuntu).

Package: libapache2-mod-security2

External Resources:

Homepage [www.modsecurity.org]

Tighten web applications security for Apache

Modsecurity is an Apache module whose purpose is to tighten the Web application security. Effectively, it is an intrusion detection and prevention system for the web server.

At the moment its main features are:

  • Audit log; store full request details in a separate file, including POST payloads.

  • Request filtering; incoming requests can be analysed and offensive requests

    can be rejected (or simply logged, if that is what you want). This feature can be used to prevent many types of attacks (e.g. XSS attacks, SQL injection, ...) and even allow you to run insecure applications on your servers (if you have no other choice, of course).

To install it, you run:

sudo apt install libapache2-mod-security

References

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.