Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding ModSecurity parameter for audit log format. #2583

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
+20 −0
Open

Adding ModSecurity parameter for audit log format. #2583

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3c58ec6
Adding ModSecurity parameter for audit log format.
Tamerz Nov 28, 2024
db12e0e
Update REFERENCE.md with new parameter
Tamerz Nov 28, 2024
b085de6
Fixed docstring to fit existing format
Tamerz Nov 28, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions REFERENCE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6075,6 +6075,7 @@ The following parameters are available in the `apache::mod::security` class:
* [`audit_log_relevant_status`](#-apache--mod--security--audit_log_relevant_status)
* [`audit_log_parts`](#-apache--mod--security--audit_log_parts)
* [`audit_log_type`](#-apache--mod--security--audit_log_type)
* [`audit_log_format`](#-apache--mod--security--audit_log_format)
* [`audit_log_storage_dir`](#-apache--mod--security--audit_log_storage_dir)
* [`secpcrematchlimit`](#-apache--mod--security--secpcrematchlimit)
* [`secpcrematchlimitrecursion`](#-apache--mod--security--secpcrematchlimitrecursion)
Expand Down Expand Up @@ -6194,6 +6195,14 @@ Defines the type of audit logging mechanism to be used.

Default value: `$apache::params::modsec_audit_log_type`

##### <a name="-apache--mod--security--audit_log_format"></a>`audit_log_format`

Data type: `Enum['Native', 'JSON']`

Defines what format the logs should be written in. Accepts `Native` and `JSON`.

Default value: `$apache::params::modsec_audit_log_format`

##### <a name="-apache--mod--security--audit_log_storage_dir"></a>`audit_log_storage_dir`

Data type: `Optional[Stdlib::Absolutepath]`
Expand Down
5 changes: 5 additions & 0 deletions manifests/mod/security.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,9 @@
#
# @param audit_log_type
# Defines the type of audit logging mechanism to be used.
#
# @param audit_log_format
# Defines what format the logs should be written in. Accepts `Native` and `JSON`.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No need to list accepted values, as the documentation include the data type (and the default value).

#
# @param audit_log_storage_dir
# Defines the directory where concurrent audit log entries are to be stored. This directive is only needed when concurrent audit logging is used.
Expand Down Expand Up @@ -143,6 +146,7 @@
String $audit_log_relevant_status = '^(?:5|4(?!04))',
String $audit_log_parts = $apache::params::modsec_audit_log_parts,
String $audit_log_type = $apache::params::modsec_audit_log_type,
Enum['Native', 'JSON'] $audit_log_format = $apache::params::modsec_audit_log_format,
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Put the default value here instead.

That way, the default value is correctly documented in the generated documentation.

Optional[Stdlib::Absolutepath] $audit_log_storage_dir = undef,
Integer $secpcrematchlimit = $apache::params::secpcrematchlimit,
Integer $secpcrematchlimitrecursion = $apache::params::secpcrematchlimitrecursion,
Expand Down Expand Up @@ -256,6 +260,7 @@
'audit_log_relevant_status' => $audit_log_relevant_status,
'audit_log_parts' => $audit_log_parts,
'audit_log_type' => $audit_log_type,
'audit_log_format' => $audit_log_format,
'audit_log_storage_dir' => $audit_log_storage_dir,
'logroot' => $logroot,
}
Expand Down
1 change: 1 addition & 0 deletions manifests/params.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@

$modsec_audit_log_parts = 'ABIJDEFHZ'
$modsec_audit_log_type = 'Serial'
$modsec_audit_log_format = 'Native'
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't put the default value in params.pp

$modsec_custom_rules = false
$modsec_custom_rules_set = undef

Expand Down
2 changes: 2 additions & 0 deletions spec/classes/mod/security_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,6 +102,7 @@
audit_log_relevant_status: '^(?:5|4(?!01|04))',
audit_log_parts: 'ABCDZ',
audit_log_type: 'Concurrent',
audit_log_format: 'JSON',
audit_log_storage_dir: '/var/log/httpd/audit',
secdefaultaction: 'deny,status:406,nolog,auditlog',
secrequestbodyaccess: 'Off',
Expand All @@ -114,6 +115,7 @@
it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecAuditLogRelevantStatus "\^\(\?:5\|4\(\?!01\|04\)\)"$} }
it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecAuditLogParts ABCDZ$} }
it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecAuditLogType Concurrent$} }
it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecAuditLogFormat JSON$} }
it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecAuditLogStorageDir /var/log/httpd/audit$} }
it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecRequestBodyAccess Off$} }
it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecResponseBodyAccess On$} }
Expand Down
3 changes: 3 additions & 0 deletions templates/mod/security.conf.epp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,9 @@
SecAuditLogRelevantStatus "<%= $audit_log_relevant_status %>"
SecAuditLogParts <%= $audit_log_parts %>
SecAuditLogType <%= $audit_log_type %>
<%- if $audit_log_format == 'JSON' { -%>
SecAuditLogFormat JSON
<%- } -%>
<%- if $audit_log_storage_dir { -%>
SecAuditLogStorageDir <%= $audit_log_storage_dir %>
<%- } -%>
Expand Down