Home Operation and Maintenance Linux Operation and Maintenance Security auditing and event log management of web servers built on CentOS

Security auditing and event log management of web servers built on CentOS

Aug 05, 2023 pm 02:33 PM
centos web server security audit

Security auditing and event log management of web servers built on CentOS

Overview
With the development of the Internet, security auditing and event log management of web servers have become more and more important. After setting up a web server on the CentOS operating system, we need to pay attention to the security of the server and protect the server from malicious attacks. This article will introduce how to perform security auditing and event log management, and provide relevant code examples.

Security Audit
Security audit refers to comprehensive monitoring and inspection of the security status of the server, timely discovery of potential security issues and taking corresponding security measures. The following are the key steps to perform a web server security audit on CentOS:

  1. Install necessary software
    We need to install some tools to assist in security auditing. The following are some commonly used security audit tools:
  • Nmap: used to scan open ports and services on the server.
  • Lynis: Security auditing and risk assessment for automated servers.
  • OpenVAS: for comprehensive vulnerability scanning and security auditing.

You can use the following command to install these tools:

sudo yum install nmap lynis openvas
Copy after login
  1. Scan open ports and services
    Use the Nmap tool to scan open ports and services on the server running services. The following is an example of an Nmap command:

    nmap -p 1-65535 -sV <服务器IP地址>
    Copy after login

    This command will scan all ports in the range 1 to 65535 and display running services and version information.

  2. Run security audit tools
    Use tools like Lynis and OpenVAS to run a comprehensive security audit. The following is an example of a command to run Lynis:

    sudo lynis audit system
    Copy after login

    This command will check files, users, network services, etc. on the server and generate a security audit report.

  3. Analyze the security audit report
    Analyze the generated security audit report, find the security problems in it, and take appropriate measures to fix these problems. For example, if a report indicates a security vulnerability exists in a specific version of software, you can upgrade to the latest version to patch the vulnerability.

Event log management
Event log management refers to recording and analyzing various events on the server in order to promptly discover and solve potential security issues. The following are the key steps for event log management on CentOS:

  1. Configuring Logging
    We need to configure the server to record various event logs. In CentOS, the logging configuration file is located in the /etc/rsyslog.conf file. Open the file with a text editor and make sure the following lines are not commented out:

    *.info;mail.none;authpriv.none;cron.none    /var/log/messages
    authpriv.*                                  /var/log/secure
    mail.*                                      -/var/log/maillog
    Copy after login

    This will ensure that system, security, and mail logs are logged in the appropriate files.

  2. Set log level
    We can also set the log level to filter events of different severity. In the /etc/rsyslog.conf file, the following line can be found:

    *.info;mail.none;authpriv.none;cron.none    /var/log/messages
    Copy after login

    *.info can be replaced as needed with a more specific level, for example *.err. This will only log events of error level and above.

  3. Analyze log files
    Use log analysis tools to analyze log files to find abnormal events. The following are some commonly used log analysis tools:
  • Logwatch: an automated log analysis tool used to generate easy-to-read log reports.
  • Fail2ban: Tool for detecting and fighting malicious IP addresses to prevent brute force and DDoS attacks.

These tools can be installed using the following command:

sudo yum install logwatch fail2ban
Copy after login

Code Example
The following is a simple PHP code example to record all user actions on the login page , and write the record to the log file:

<?php
$logFile = '/var/log/login.log';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = $_POST['username'];
    $password = $_POST['password'];
    $date = date('Y-m-d H:i:s');

    $logMessage = "[$date] User '$username' attempted to login from IP '{$_SERVER['REMOTE_ADDR']}'
";

    file_put_contents($logFile, $logMessage, FILE_APPEND);
}
?>
Copy after login

Add the above code to the PHP file of the login page. Each time the user submits the login form, the login log will be recorded to /var/log/ login.log file.

Conclusion
After setting up a web server on CentOS, security auditing and event log management are crucial. By conducting comprehensive security audits and effective event log management, we are able to promptly discover and resolve potential security issues and protect our servers from malicious attacks. We hope that the steps and code examples provided in this article for security auditing and event log management are helpful to you.

The above is the detailed content of Security auditing and event log management of web servers built on CentOS. For more information, please follow other related articles on the PHP Chinese website!

Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

AI Hentai Generator

AI Hentai Generator

Generate AI Hentai for free.

Hot Article

R.E.P.O. Energy Crystals Explained and What They Do (Yellow Crystal)
2 weeks ago By 尊渡假赌尊渡假赌尊渡假赌
Repo: How To Revive Teammates
4 weeks ago By 尊渡假赌尊渡假赌尊渡假赌
Hello Kitty Island Adventure: How To Get Giant Seeds
3 weeks ago By 尊渡假赌尊渡假赌尊渡假赌

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

How to input Chinese in centos How to input Chinese in centos Apr 07, 2024 pm 08:21 PM

Methods for using Chinese input in CentOS include: using the fcitx input method: install and enable fcitx, set shortcut keys, press the shortcut keys to switch input methods, and input pinyin to generate candidate words. Use iBus input method: Install and enable iBus, set shortcut keys, press the shortcut keys to switch input methods, and input pinyin to generate candidate words.

How to read USB disk files in centos7 How to read USB disk files in centos7 Apr 07, 2024 pm 08:18 PM

To read U disk files in CentOS 7, you need to first connect the U disk and confirm its device name. Then, use the following steps to read the file: Mount the USB flash drive: mount /dev/sdb1 /media/sdb1 (replace "/dev/sdb1" with the actual device name) Browse the USB flash drive file: ls /media/sdb1; cd /media /sdb1/directory; cat file name

How to enter root permissions in centos7 How to enter root permissions in centos7 Apr 02, 2024 pm 08:57 PM

There are two ways to enter the root authority of CentOS 7: use the sudo command: enter sudo su - in the terminal and enter the current user password. Log in directly as the root user: Select "Other" on the login screen, enter "root" and the root password. Note: Operate carefully with root privileges, perform tasks with sudo privileges, and change the root password regularly.

What to do if you forget your password to log in to centos What to do if you forget your password to log in to centos Apr 07, 2024 pm 07:33 PM

Solutions for forgotten CentOS passwords include: Single-user mode: Enter single-user mode and reset the password using passwd root. Rescue Mode: Boot from CentOS Live CD/USB, mount root partition and reset password. Remote access: Use SSH to connect remotely and reset the password with sudo passwd root.

SCP usage tips-recursively exclude files SCP usage tips-recursively exclude files Apr 22, 2024 am 09:04 AM

One can use the scp command to securely copy files between network hosts. It uses ssh for data transfer and authentication. Typical syntax is: scpfile1user@host:/path/to/dest/scp -r/path/to/source/user@host:/path/to/dest/scp exclude files I don't think you can when using scp command Filter or exclude files. However, there is a good workaround to exclude the file and copy it securely using ssh. This page explains how to filter or exclude files when copying directories recursively using scp. How to use rsync command to exclude files The syntax is: rsyncav-essh-

What should I do if I forget my centos username and password? What should I do if I forget my centos username and password? Apr 02, 2024 pm 08:54 PM

After forgetting your CentOS username and password, there are two ways to restore access: Reset the root password: Restart the server, edit the kernel command line in the GRUB menu, add "rw init=/sysroot/bin/sh" and press Ctrl+x ;Mount the root file system and reset the password in single-user mode. Use rescue mode: Start the server from the CentOS installation ISO image, select rescue mode; mount the root file system, copy the chroot environment from the ISO image, reset the password, exit the chroot environment and restart the server.

How to enable root permissions in centos7 How to enable root permissions in centos7 Apr 07, 2024 pm 08:03 PM

CentOS 7 disables root permissions by default. You can enable it by following the following steps: Temporarily enable it: Enter "su root" on the terminal and enter the root password. Permanently enabled: Edit "/etc/ssh/sshd_config", change "PermitRootLogin no" to "yes", and restart the SSH service.

What should I do if I forget my centos7 password? What should I do if I forget my centos7 password? Apr 02, 2024 pm 08:51 PM

Three solutions for forgotten passwords in CentOS 7: Single-user mode: Restart the system, edit the kernel options, change ro to rw init=/sysroot/bin/sh, and use the passwd command to reset the root password. Rescue mode: Boot from the installation media, select rescue mode, mount the root file system, chroot to the root file system, and use the passwd command to reset the root password. Grub2 command line: Restart the system, press c to enter the command line, load the kernel, mount the root file system, chroot to the root file system, and use the passwd command to reset the root password.

See all articles