How to log coraza errors/warnings with caddy ?

[Barnoux]

Hello,

Today i'm using coraza with caddy.
And i didn't find a way to log warnings or errors from the action made by the WAF to write to access.log or errors.log files on caddy ?
Actually, since i'm using docker, i only have the STDOUT or STDERR when i'm using the docker compose logs command.

this is an example of log that i want to have in access.log or erros log in caddy.

{"level":"warn","ts":1667767211.2903426,"logger":"http.handlers.waf","msg":"[client \"192.168.1.1\"] Coraza: Warning. Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6) [file \"/ruleset/coreruleset/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf\"] [line \"0\"] [id \"942431\"] [rev \"\"] [msg \"Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6)\"] [data \"Matched Data: ==|zU7wTh2dW0gDBXi9FR/WuA==| found within ARGS:json.name: 2.goKGe7Ukwa5/8vjvwYCVvw==|zU7wTh2dW0gDBXi9FR/WuA==|nPwLzjULkUiTUd7oEHqm/D3t6Kz/VlEWIJSeNIzpn9c=\"] [severity \"warning\"] [ver \"OWASP_CRS/4.0.0-rc1\"] [maturity \"0\"] [accuracy \"0\"] [tag \"application-multi\"] [tag \"language-multi\"] [tag \"platform-multi\"] [tag \"attack-sqli\"] [tag \"OWASP_CRS\"] [tag \"capec/1000/152/248/66\"] [tag \"PCI/6.5.2\"] [tag \"paranoia-level/3\"] [hostname \"\"] [uri \"/api/ciphers\"] [unique_id \"PNhhDp6vUSWgixZZi7d\"]\n[client \"192.168.1.1\"] Coraza: Warning. Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6) [file \"/ruleset/coreruleset/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf\"] [line \"0\"] [id \"942431\"] [rev \"\"] [msg \"Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6)\"] [data \"Matched Data: ==|XzfN1a2iW/93haTq7kCVHg==| found within ARGS:json.login.username: 2.RzMSpcT55E1nxm4vPNEY Q==|XzfN1a2iW/93haTq7kCVHg==|y358rGX1PeEQaLNWbxeSn6 nEU/F61lfDRcbxeS2F00=\"] [severity \"warning\"] [ver \"OWASP_CRS/4.0.0-rc1\"] [maturity \"0\"] [accuracy \"0\"] [tag \"application-multi\"] [tag \"language-multi\"] [tag \"platform-multi\"] [tag \"attack-sqli\"] [tag \"OWASP_CRS\"] [tag \"capec/1000/152/248/66\"] [tag \"PCI/6.5.2\"] [tag \"paranoia-level/3\"] [hostname \"\"] [uri \"/api/ciphers\"] [unique_id \"PNhhDp6vUSWgixZZi7d\"]\n[client \"192.168.1.1\"] Coraza: Warning. Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6) [file \"/ruleset/coreruleset/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf\"] [line \"0\"] [id \"942431\"] [rev \"\"] [msg \"Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6)\"] [data \"Matched Data: ==|4Ui GvselQpLTCi3Yqg78w==| found within ARGS:json.login.password: 2.tWrwNsM JDb7Qy8vsERdCA==|4Ui GvselQpLTCi3Yqg78w==|crLTmqfO ymbxyTenmAJTI5L/J ZJc16zn0M1cRGR4g=\"] [severity \"warning\"] [ver \"OWASP_CRS/4.0.0-rc1\"] [maturity \"0\"] [accuracy \"0\"] [tag \"application-multi\"] [tag \"language-multi\"] [tag \"platform-multi\"] [tag \"attack-sqli\"] [tag \"OWASP_CRS\"] [tag \"capec/1000/152/248/66\"] [tag \"PCI/6.5.2\"] [tag \"paranoia-level/3\"] [hostname \"\"] [uri \"/api/ciphers\"] [unique_id \"PNhhDp6vUSWgixZZi7d\"]\n"}

Regards,
BBA

[Barnoux]

I just realized that I was not precise enough on the discussion. sorry

Today Corazza is running with caddy in a docker image. I noticed that today the only logs you can write to the filesystem are the access and error logs from caddy (not from the coraza WAF). Indeed, all error logs and warnings related to WAF Coraza detections or preventions cannot be found in this file that I mentioned. Today, I have access to the error and warning logs of coraza thanks to the docker compose log feature "nameofthedockercomposeservice".

Tomorrow I would like to have the warnings and errors logs of CORAZA in a single file.

Because I would like to use the crowdsec solution with cozaza events. I would like to develop a crowdsec parser for Corazza WAF and thus be able to create crowdsec scenarios.

[jptosso]

Hey! Sorry for the late answer. This question is related directly to Caddy, as we already ship all of our error logs to caddy like you mentioned:

{"level":"warn","ts":1667767211.2903426,"logger":"http.handlers.waf","msg":"[client \"192.168.1.1\"] Coraza: Warning. Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6) [file \"/ruleset/coreruleset/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf\"] [line \"0\"] [id \"942431\"] [rev \"\"] [msg \"Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6)\"] [data \"Matched Data: ==|zU7wTh2dW0gDBXi9FR/WuA==| found within ARGS:json.name: 2.goKGe7Ukwa5/8vjvwYCVvw==|zU7wTh2dW0gDBXi9FR/WuA==|nPwLzjULkUiTUd7oEHqm/D3t6Kz/VlEWIJSeNIzpn9c=\"] [severity \"warning\"] [ver \"OWASP_CRS/4.0.0-rc1\"] [maturity \"0\"] [accuracy \"0\"] [tag \"application-multi\"] [tag \"language-multi\"] [tag \"platform-multi\"] [tag \"attack-sqli\"] [tag \"OWASP_CRS\"] [tag \"capec/1000/152/248/66\"] [tag \"PCI/6.5.2\"] [tag \"paranoia-level/3\"] [hostname \"\"] [uri \"/api/ciphers\"] [unique_id \"PNhhDp6vUSWgixZZi7d\"]\n[client \"192.168.1.1\"] Coraza: Warning. Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6) [file \"/ruleset/coreruleset/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf\"] [line \"0\"] [id \"942431\"] [rev \"\"] [msg \"Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6)\"] [data \"Matched Data: ==|XzfN1a2iW/93haTq7kCVHg==| found within ARGS:json.login.username: 2.RzMSpcT55E1nxm4vPNEY Q==|XzfN1a2iW/93haTq7kCVHg==|y358rGX1PeEQaLNWbxeSn6 nEU/F61lfDRcbxeS2F00=\"] [severity \"warning\"] [ver \"OWASP_CRS/4.0.0-rc1\"] [maturity \"0\"] [accuracy \"0\"] [tag \"application-multi\"] [tag \"language-multi\"] [tag \"platform-multi\"] [tag \"attack-sqli\"] [tag \"OWASP_CRS\"] [tag \"capec/1000/152/248/66\"] [tag \"PCI/6.5.2\"] [tag \"paranoia-level/3\"] [hostname \"\"] [uri \"/api/ciphers\"] [unique_id \"PNhhDp6vUSWgixZZi7d\"]\n[client \"192.168.1.1\"] Coraza: Warning. Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6) [file \"/ruleset/coreruleset/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf\"] [line \"0\"] [id \"942431\"] [rev \"\"] [msg \"Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6)\"] [data \"Matched Data: ==|4Ui GvselQpLTCi3Yqg78w==| found within ARGS:json.login.password: 2.tWrwNsM JDb7Qy8vsERdCA==|4Ui GvselQpLTCi3Yqg78w==|crLTmqfO ymbxyTenmAJTI5L/J ZJc16zn0M1cRGR4g=\"] [severity \"warning\"] [ver \"OWASP_CRS/4.0.0-rc1\"] [maturity \"0\"] [accuracy \"0\"] [tag \"application-multi\"] [tag \"language-multi\"] [tag \"platform-multi\"] [tag \"attack-sqli\"] [tag \"OWASP_CRS\"] [tag \"capec/1000/152/248/66\"] [tag \"PCI/6.5.2\"] [tag \"paranoia-level/3\"] [hostname \"\"] [uri \"/api/ciphers\"] [unique_id \"PNhhDp6vUSWgixZZi7d\"]\n"}

Coraza doesn't log internal errors into Caddy. Instead, it uses the file from SecDebugLog. Also, audit logs are sent to SecAuditLogDir. It might be wise to send error logs to caddy though.

You may be looking for audit logs that fit your requirement. You can use filebeat to stream the audit logs to some third party like crowdsec.

[jptosso]

@jcchavezs, how do you handle this in coraza-proxy-wasm?

[jcchavezs]

coraza-proxy-wasm does not have access to filesystem so we send to (envoy) stdout for now. We haven't discussed yet if audit logs will follow the same pattern or will call an upstream service to send the logs as proxy-wasm has no access to filesystem.

[Barnoux]

The best way that i find today is to use filebeat.

[Barnoux]

Erratum, the solution is way simpler, we just have to configure the log directive in the global options block in the Caddyfile...
But filebeats works too.

[jcchavezs]

Could you improve the docs around that?

…

On Thu, 23 Feb 2023, 16:46 Barnoux, ***@***.***> wrote: Erratum, the solution is way simpler, we just have to configure the log directive in the global options block in the Caddyfile... But filebeats works too. — Reply to this email directly, view it on GitHub <#511 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAXOYAWR2UB4PYLPGZS2TYDWY6A5RANCNFSM6AAAAAASF7MHT4> . You are receiving this because you were mentioned.Message ID: ***@***.***>