主页 / server / 问题 / 482273
Accepted
WooDzu
Asked: 2013-02-26 07:26:54 +0800 CST

LFD 是否检查失败的 HTTP 摘要登录尝试？

  • 772

我确信 LFD（登录失败守护进程）会检查 Apache 的错误日志以查找失败的 HTTP 身份验证尝试，即。日志条目如：

 [Mon Feb 25 10:12:45 2013] [error] [client 10.0.0.1] user FAKEUSER not found: /index.html
 [Mon Feb 25 10:11:56 2013] [error] [client 10.0.0.1] user REALUSER: authentication failure for "/index.html": Password Mismatch

以上所有尝试都是失败的 HTTP Basic 登录。以下是来自同一错误日志的失败 HTTP 摘要身份验证

 [Mon Feb 25 10:10:37 2013] [error] [client 10.0.0.1] Digest: user 'FAKEUSER' in realm 'REALM' not found: index.html

我是否认为这表明 LFD 不检查失败的 HTTP 摘要登录是否正确？如果是这样，是否有一种简单的方法可以将这种“验证”模式添加到脚本中？

任何建议将不胜感激！

apache-2.2

1 个回答

  1. Best Answer

    好的，自己做了一个解决方案：

    去编辑文件：/etc/csf/regex.custom.pm

    在以以下内容开头的行之前：

    # The return values from this example are as follows:

    添加以下正则表达式：

    # 1. Include failed HTTP Digest method - Invalid User
if (($config{LF_HTACCESS}) and ($lgfile eq $config{HTACCESS_LOG}) and ($line =~ /^\[\S+\s+\S+\s+\S+\s+\S+\s+\S+\] \[error\] \[client (\S+)\] Digest: user `(\S*)' in realm `\S+' not found:/)) {
        return ("Failed web page login from",$1,"htdigest",5,"80,443","1");
}

# 2. Include failed HTTP Digest method - Invalid Password
if (($config{LF_HTACCESS}) and ($lgfile eq $config{HTACCESS_LOG}) and ($line =~ /^\[\S+\s+\S+\s+\S+\s+\S+\s+\S+\] \[error\] \[client (\S+)\] Digest: user (\S*): password mismatch:/)) {
        return ("Failed web page login from",$1,"htdigest",5,"80,443","1");
}
    • 0

相关问题