0

Let's say we have a huge list of clients (~30) all running on the same server under different users (and other security settings).

I need to write a "spy/logging" script which is able to handle all HTTP traffic without actually modifying it or hindering its execution.

Usually, we have a setup as follows:

Web Browser <--> Apache <--> PHP/FCGI

I need a setup as follows:

Web Browser ---> Apache ---> PHP/FCGI
                      '----> PHP/CLI (or any other script, module...)

I need this set up so that I don't have to change each client's code (and having to maintain it as well), so instead I have only one script to have to manage by myself.

One way to do this is to somehow get a pcap daemon triggering a script of mine each time it receives an HTTP request, but I figured someone out there must have a better way of doing this?

Christian
  • 466
  • 5
  • 23

3 Answers3

0

I can offer this variants:

  • Switch to pure CGI instead of FCGI, and write script, that will fork your script, and than give control to php-cgi. To make php files executable without adding shebang, use binfmt_misc This will significantly decrease performance, but may be used for testing.
  • Use some king of reverse proxy(like nginx) with some tricky settings in front of apache.
  • Slightly patch php-fcgi, so that it will fork your script on every request.
Selivanov Pavel
  • 2,206
  • 3
  • 26
  • 48
  • **1.** Not an option. **2.** I don't quite understand that? **3.** Ughhh... – Christian Sep 19 '11 at 08:52
  • I lurked and didn't find the way for nginx to do 2nd... maybe I'm wrong and this is impossible. Then the fourth way: create very special apache [log format](http://httpd.apache.org/docs/2.2/mod/mod_log_config.html), with all request information and headers. Create pipe file, configure apache to write this log to it. Use pipe file as input for script, that will fork your script for each request. Or this may be just regular file, and script will use inotify-tools to launch your script every time file is changed. What is original problem, that you try to solve in such unusual way? – Selivanov Pavel Sep 19 '11 at 09:26
  • Those seem more practical ideas. I'm trying to do a basic IDS system with a specific entry point (as opposed to other IDSes). – Christian Sep 19 '11 at 09:45
  • As you are doing host-based IDS, IMHO the best way to make deep request analysis without significant performance gap is writing your own reverse proxy or some kind of IDS module for existing. And this will allow to block bad request before apache can proceed it. – Selivanov Pavel Sep 19 '11 at 10:21
  • I'm not looking at blocking the request, though. It's IDS not IPS :). The only "performance-loss" I'm allowing is that from parallel threads (multi-threading the scanner rather than doing this in the request processor itself). – Christian Sep 19 '11 at 10:41
  • I find it strange that Apache doesn't have such a module/configuration... – Christian Sep 19 '11 at 10:43
0

Apache LogForensic seems to achieve what I want. I have yet to try it out, but it looks ok so far...

http://httpd.apache.org/docs/2.0/mod/mod_log_forensic.html

The next step would be to figure out a way to make LogForensic ignore my requests to avoid infinite loops. For this, I could simply run my IDS system (which is PHP-based) through CLI.

Christian
  • 466
  • 5
  • 23
0

to handle all HTTP traffic

Is there a reason you can't use the existing logging built into the webserver? Have you looked at mod_security

Is there a reason you have to do this on the webserver and not on a reverse proxy?

without ... hindering its execution

Then sniffing the traffic is the only way.

Usually, we have a setup as follows

So you only ever serve up content generated via PHP. No static CSS, HTML, javascript, images... Or do you mean you only want to monitor the PHP generated traffic? In which case you could easily add an auto_prepend script in Apache, and you could offload the processing by setting it to make an asynchronous call. But there will still be some performance impact.

symcbean
  • 21,009
  • 1
  • 31
  • 52
  • 1. That's what I'm asking, if people know about any specific functionality matching my needs. 2. To decrease complexity. 3. Yes I'm more interested in dynamic content than static one. – Christian Sep 19 '11 at 19:29