99 lines
2.8 KiB
Bash
99 lines
2.8 KiB
Bash
|
#!/bin/bash
|
||
|
|
|
||
|
|
PROGRAM=$(basename $0)
|
||
|
|
|
||
|
|
usage() {
|
||
|
|
echo "Usage: $PROGRAM [-n fichier ] [ -c ] [ -u ] [ file(s) ]"
|
||
|
|
echo "Liste les erreurs modsecurity rencontrées depuis un fichier d'erreurs apache. Si aucun fichier n'est précisé, utilise l'entrée standard."
|
||
|
|
echo " -n : uniquement les erreurs plus récentes que la date du fichier indiqué"
|
||
|
|
echo " -c : a la place la liste, génère la configuration des exceptions pour le reverse proxy pour éviter les erreurs modsecurity detectées"
|
||
|
|
echo " -u : si combiné avec -c, génère la configuration des exceptions par url plutôt que globalement"
|
||
|
|
exit 1
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
while getopts "cum:" o; do
|
||
|
|
case "${o}" in
|
||
|
|
n)
|
||
|
|
file=${OPTARG}
|
||
|
|
echo "option -n non implemente"
|
||
|
|
exit
|
||
|
|
;;
|
||
|
|
c)
|
||
|
|
conf="true"
|
||
|
|
;;
|
||
|
|
u)
|
||
|
|
byurl="true"
|
||
|
|
;;
|
||
|
|
*)
|
||
|
|
usage
|
||
|
|
;;
|
||
|
|
esac
|
||
|
|
done
|
||
|
|
|
||
|
|
shift $((OPTIND-1))
|
||
|
|
|
||
|
|
|
||
|
|
TMP=$(mktemp /tmp/$PROGRAM.XXXXXXX)
|
||
|
|
TMP_NOPHASE=$(mktemp /tmp/$PROGRAM.XXXXXXX)
|
||
|
|
|
||
|
|
if [ "$*" == "" ]; then
|
||
|
|
FILES="-"
|
||
|
|
else
|
||
|
|
FILES="$*"
|
||
|
|
fi
|
||
|
|
|
||
|
|
# retient les lignes modsecurity avec id et uri et conserve les colonnes timestamp, fichier de règle, id, et uri
|
||
|
|
cat $FILES | grep ModSecurity | grep "\[id" | grep "\[uri" | egrep -o '^\[[A-Za-z0-9:\. ]*\]|\[id "[0-9]*"\]|\[file "[^"]*"\]|\[uri\ "[^"]*"\]' | paste -d "|" - - - - > $TMP_NOPHASE
|
||
|
|
|
||
|
|
# formate et ajoute la phase de la regle
|
||
|
|
while read line
|
||
|
|
do
|
||
|
|
TIMESTAMP=$(echo $line | cut -d '|' -f 1 | cut -c 2- | head -c -2)
|
||
|
|
RULEFILE=$(echo $line | cut -d '|' -f 2 | cut -d '"' -f 2)
|
||
|
|
ID=$(echo $line | cut -d '|' -f 3 | cut -d '"' -f 2)
|
||
|
|
URI=$(echo $line | cut -d '|' -f 4 | cut -d '"' -f 2)
|
||
|
|
PHASE=$(cat "$RULEFILE" | grep -E 'SecRule|id:|phase:' | sed ':a;N;$!ba;s/\n//g' | sed 's/SecRule/\nSecRule/g' | grep $ID | egrep -o 'phase:[^,^"]*?' | paste -)
|
||
|
|
echo "$TIMESTAMP|$RULEFILE|$ID|$URI|$PHASE" >> $TMP
|
||
|
|
done < $TMP_NOPHASE
|
||
|
|
rm $TMP_NOPHASE
|
||
|
|
|
||
|
|
|
||
|
|
if [ "$conf" == "true" ]; then
|
||
|
|
echo
|
||
|
|
echo "### Configuration des exclusions mod_security pour le reverse proxy"
|
||
|
|
|
||
|
|
|
||
|
|
if [ "$byurl" == "true" ]; then
|
||
|
|
echo "# Regles phase 1"
|
||
|
|
for id in $(cat $TMP | grep "phase:1" | cut -d '|' -f 3 | sort | uniq)
|
||
|
|
do
|
||
|
|
echo SecRuleRemoveById $id
|
||
|
|
done
|
||
|
|
echo "# Fin regles phase 1"
|
||
|
|
|
||
|
|
for url in $(cat $TMP | grep -v "phase:1" | cut -d '|' -f 4 | sort | uniq)
|
||
|
|
do
|
||
|
|
echo "<LocationMatch \"^$url\$\">"
|
||
|
|
|
||
|
|
for id in $(cat $TMP | grep -v "phase:1" | grep $url | cut -d '|' -f 3 | sort | uniq)
|
||
|
|
do
|
||
|
|
echo " SecRuleRemoveById $id"
|
||
|
|
done
|
||
|
|
|
||
|
|
echo "</LocationMatch>"
|
||
|
|
echo
|
||
|
|
done
|
||
|
|
else
|
||
|
|
for id in $(cat $TMP | cut -d '|' -f 3 | sort | uniq)
|
||
|
|
do
|
||
|
|
echo SecRuleRemoveById $id
|
||
|
|
done
|
||
|
|
fi
|
||
|
|
else
|
||
|
|
cat $TMP
|
||
|
|
fi
|
||
|
|
|
||
|
|
|
||
|
|
rm $TMP
|