Home Operation and Maintenance Linux Operation and Maintenance Security auditing and event log management of web servers built on CentOS

Security auditing and event log management of web servers built on CentOS

Aug 05, 2023 pm 02:33 PM
centos web server security audit

Security auditing and event log management of web servers built on CentOS

Overview
With the development of the Internet, security auditing and event log management of web servers have become more and more important. After setting up a web server on the CentOS operating system, we need to pay attention to the security of the server and protect the server from malicious attacks. This article will introduce how to perform security auditing and event log management, and provide relevant code examples.

Security Audit
Security audit refers to comprehensive monitoring and inspection of the security status of the server, timely discovery of potential security issues and taking corresponding security measures. The following are the key steps to perform a web server security audit on CentOS:

  1. Install necessary software
    We need to install some tools to assist in security auditing. The following are some commonly used security audit tools:
  • Nmap: used to scan open ports and services on the server.
  • Lynis: Security auditing and risk assessment for automated servers.
  • OpenVAS: for comprehensive vulnerability scanning and security auditing.

You can use the following command to install these tools:

sudo yum install nmap lynis openvas
Copy after login
  1. Scan open ports and services
    Use the Nmap tool to scan open ports and services on the server running services. The following is an example of an Nmap command:

    nmap -p 1-65535 -sV <服务器IP地址>
    Copy after login

    This command will scan all ports in the range 1 to 65535 and display running services and version information.

  2. Run security audit tools
    Use tools like Lynis and OpenVAS to run a comprehensive security audit. The following is an example of a command to run Lynis:

    sudo lynis audit system
    Copy after login

    This command will check files, users, network services, etc. on the server and generate a security audit report.

  3. Analyze the security audit report
    Analyze the generated security audit report, find the security problems in it, and take appropriate measures to fix these problems. For example, if a report indicates a security vulnerability exists in a specific version of software, you can upgrade to the latest version to patch the vulnerability.

Event log management
Event log management refers to recording and analyzing various events on the server in order to promptly discover and solve potential security issues. The following are the key steps for event log management on CentOS:

  1. Configuring Logging
    We need to configure the server to record various event logs. In CentOS, the logging configuration file is located in the /etc/rsyslog.conf file. Open the file with a text editor and make sure the following lines are not commented out:

    *.info;mail.none;authpriv.none;cron.none    /var/log/messages
    authpriv.*                                  /var/log/secure
    mail.*                                      -/var/log/maillog
    Copy after login

    This will ensure that system, security, and mail logs are logged in the appropriate files.

  2. Set log level
    We can also set the log level to filter events of different severity. In the /etc/rsyslog.conf file, the following line can be found:

    *.info;mail.none;authpriv.none;cron.none    /var/log/messages
    Copy after login

    *.info can be replaced as needed with a more specific level, for example *.err. This will only log events of error level and above.

  3. Analyze log files
    Use log analysis tools to analyze log files to find abnormal events. The following are some commonly used log analysis tools:
  • Logwatch: an automated log analysis tool used to generate easy-to-read log reports.
  • Fail2ban: Tool for detecting and fighting malicious IP addresses to prevent brute force and DDoS attacks.

These tools can be installed using the following command:

sudo yum install logwatch fail2ban
Copy after login

Code Example
The following is a simple PHP code example to record all user actions on the login page , and write the record to the log file:

<?php
$logFile = '/var/log/login.log';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = $_POST['username'];
    $password = $_POST['password'];
    $date = date('Y-m-d H:i:s');

    $logMessage = "[$date] User '$username' attempted to login from IP '{$_SERVER['REMOTE_ADDR']}'
";

    file_put_contents($logFile, $logMessage, FILE_APPEND);
}
?>
Copy after login

Add the above code to the PHP file of the login page. Each time the user submits the login form, the login log will be recorded to /var/log/ login.log file.

Conclusion
After setting up a web server on CentOS, security auditing and event log management are crucial. By conducting comprehensive security audits and effective event log management, we are able to promptly discover and resolve potential security issues and protect our servers from malicious attacks. We hope that the steps and code examples provided in this article for security auditing and event log management are helpful to you.

The above is the detailed content of Security auditing and event log management of web servers built on CentOS. For more information, please follow other related articles on the PHP Chinese website!

Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

Video Face Swap

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

How to optimize CentOS HDFS configuration How to optimize CentOS HDFS configuration Apr 14, 2025 pm 07:15 PM

Improve HDFS performance on CentOS: A comprehensive optimization guide to optimize HDFS (Hadoop distributed file system) on CentOS requires comprehensive consideration of hardware, system configuration and network settings. This article provides a series of optimization strategies to help you improve HDFS performance. 1. Hardware upgrade and selection resource expansion: Increase the CPU, memory and storage capacity of the server as much as possible. High-performance hardware: adopts high-performance network cards and switches to improve network throughput. 2. System configuration fine-tuning kernel parameter adjustment: Modify /etc/sysctl.conf file to optimize kernel parameters such as TCP connection number, file handle number and memory management. For example, adjust TCP connection status and buffer size

Centos stops maintenance 2024 Centos stops maintenance 2024 Apr 14, 2025 pm 08:39 PM

CentOS will be shut down in 2024 because its upstream distribution, RHEL 8, has been shut down. This shutdown will affect the CentOS 8 system, preventing it from continuing to receive updates. Users should plan for migration, and recommended options include CentOS Stream, AlmaLinux, and Rocky Linux to keep the system safe and stable.

How to check CentOS HDFS configuration How to check CentOS HDFS configuration Apr 14, 2025 pm 07:21 PM

Complete Guide to Checking HDFS Configuration in CentOS Systems This article will guide you how to effectively check the configuration and running status of HDFS on CentOS systems. The following steps will help you fully understand the setup and operation of HDFS. Verify Hadoop environment variable: First, make sure the Hadoop environment variable is set correctly. In the terminal, execute the following command to verify that Hadoop is installed and configured correctly: hadoopversion Check HDFS configuration file: The core configuration file of HDFS is located in the /etc/hadoop/conf/ directory, where core-site.xml and hdfs-site.xml are crucial. use

What are the backup methods for GitLab on CentOS What are the backup methods for GitLab on CentOS Apr 14, 2025 pm 05:33 PM

Backup and Recovery Policy of GitLab under CentOS System In order to ensure data security and recoverability, GitLab on CentOS provides a variety of backup methods. This article will introduce several common backup methods, configuration parameters and recovery processes in detail to help you establish a complete GitLab backup and recovery strategy. 1. Manual backup Use the gitlab-rakegitlab:backup:create command to execute manual backup. This command backs up key information such as GitLab repository, database, users, user groups, keys, and permissions. The default backup file is stored in the /var/opt/gitlab/backups directory. You can modify /etc/gitlab

Centos shutdown command line Centos shutdown command line Apr 14, 2025 pm 09:12 PM

The CentOS shutdown command is shutdown, and the syntax is shutdown [Options] Time [Information]. Options include: -h Stop the system immediately; -P Turn off the power after shutdown; -r restart; -t Waiting time. Times can be specified as immediate (now), minutes ( minutes), or a specific time (hh:mm). Added information can be displayed in system messages.

How to mount hard disk in centos How to mount hard disk in centos Apr 14, 2025 pm 08:15 PM

CentOS hard disk mount is divided into the following steps: determine the hard disk device name (/dev/sdX); create a mount point (it is recommended to use /mnt/newdisk); execute the mount command (mount /dev/sdX1 /mnt/newdisk); edit the /etc/fstab file to add a permanent mount configuration; use the umount command to uninstall the device to ensure that no process uses the device.

Centos install mysql Centos install mysql Apr 14, 2025 pm 08:09 PM

Installing MySQL on CentOS involves the following steps: Adding the appropriate MySQL yum source. Execute the yum install mysql-server command to install the MySQL server. Use the mysql_secure_installation command to make security settings, such as setting the root user password. Customize the MySQL configuration file as needed. Tune MySQL parameters and optimize databases for performance.

What steps are required to configure CentOS in HDFS What steps are required to configure CentOS in HDFS Apr 14, 2025 pm 06:42 PM

Building a Hadoop Distributed File System (HDFS) on a CentOS system requires multiple steps. This article provides a brief configuration guide. 1. Prepare to install JDK in the early stage: Install JavaDevelopmentKit (JDK) on all nodes, and the version must be compatible with Hadoop. The installation package can be downloaded from the Oracle official website. Environment variable configuration: Edit /etc/profile file, set Java and Hadoop environment variables, so that the system can find the installation path of JDK and Hadoop. 2. Security configuration: SSH password-free login to generate SSH key: Use the ssh-keygen command on each node

See all articles