5

I looking for a way to make the msg information of the rule (which rule had been triggered) to appears in the error and/or audit log files and sent back to the client in response headers. I understand that there is phase "msg" but it doesn't sent back to the client in response headers the information so it's doesn't help me. I want to see the information of the log in the error page in html, what can I do? thank you for help, Vladi.

leppie
  • 115,091
  • 17
  • 196
  • 297
Vladi Sandler
  • 47
  • 1
  • 2

2 Answers2

6

It's a bad idea to let the client know what exactly went wrong. A hacker could use that to work around your security framework. A much better approach is a combination of mod_unique_id and customized error pages. Steps to follow:

  • enable mod_unique_id with your apache configuration
  • create customized error pages for the http return codes you're interested in (example below)
  • enable those in your apache config (ErrorDocument 403 /<url_path_to>/403.php for this example)

Here's an example for a 403 error page, let's call it 403.php (and no, a pure static page won't work):

<?php
 $protocol = $_SERVER['SERVER_PROTOCOL'];
 header("$protocol 403 Forbidden");
 header("Status: 403 Forbidden");
 header("Connection: close");
 $msg = $_SERVER["UNIQUE_ID"];
?>
<HTML><HEAD>
 <TITLE>You have no access to this resource (403)</TITLE>
</HEAD><BODY>
<P>An error occured. Please tell the admin the error code: <?php echo $msg; ?></P>
</BODY></HTML>

That's just a very abbreviated variant with no styling etc (you might want to enhance this), but I incidentally kept it simple for understanding. The $msg will print a unique code. The client can tell you this code, and you can use it to look up the exact line in your error log, where you will see which rule triggered it etc.

Izzy
  • 1,364
  • 3
  • 32
  • 65
  • cool, but what if I don't want PHP on my frontend reverse proxy? – dAm2K Jul 26 '21 at 17:43
  • If you have another idea to obtain/include those variables and set the headers, go ahead – I was rather suggesting the principle, and PHP is what I work with. – Izzy Jul 26 '21 at 17:50
  • I solved the problem with mod_include and SSI with a custom ErrorDocument. Please check my answer for details. Thank you. – dAm2K Jul 31 '21 at 23:19
3

If you don't want to use external stuff (mod_perl, mod_php, etc) because, for example, you are on a front end reverse proxy and you don't want to expose a larger attack surface, you can use SSI (Server Side Include), since apache supports SSI internally with mod_include.

Just load mod_include, then add this to your virtualhosts:

# Custom 403 HTML error with base64 encoded date + uniqueid on response
<Directory /var/www/html/common/_Errors>
        AddType text/html .shtml
        AddOutputFilter INCLUDES .shtml
        Options +Includes
</Directory>
ErrorDocument 403 /common/_Errors/403.shtml
<Location "/common/_Errors/403.shtml">
        # don't block redirected error page due rule to correlation
        SecRuleRemoveById 980130
</Location>

Then, create a HTML file /var/www/html/common/_Errors/403.shtml containing something like this:

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>Your request was denied.</p>
<!--#config timefmt="%Y-%m-%d %H:%M:%S" -->
<p><pre><!--#set var="ERR" value="${DATE_LOCAL} - ${UNIQUE_ID}" --></pre></p>
<p><pre><!--#echo encoding="base64" var="ERR" --></pre></p>
</body></html>

If you want you can change #config timefmt to fit your date time format.

SSI on mod_include will create a HTML response expanding the ERR variable with DATE_LOCAL and UNIQUE_ID and will encode the output as a base64 string. Just enough for me to get the uniqueid for the rule that was fired and its date.

dAm2K
  • 9,923
  • 5
  • 44
  • 47