[SOLVED] Apache Access LogFormat related question

saagar · 06-30-2011, 07:25 AM

Hi Friends,

I have a requirement related to the apache access log file format:

When a user access my local site, http authentication will be displayed:

Code:

  username: saagar
  password: 123

I wish to have the LogFormat in the configuration file in such a way that the username and password (saagar/123 in this case) will be logged in the /var/log/apache2/mysite_access_log file. I used the %u parameter as follows:

Code:

 LogFormat "%h %u \"%r\" %>s %b" common
CustomLog /var/log/apache2/mydreamhome_access.log common

and it works, similarly I wish the password too to be displayed in the access_log file.

Please help

Thanks

bathory · 06-30-2011, 12:22 PM

Hi,

Why do you want to log the password? Do you understand the security risks by having the username/password in your logs?

Regards

saagar · 06-30-2011, 06:10 PM

Hi bathory,

Our testing team wants this for their Apache Jmeter tool, so that they use these Apache log files to test performance of the application.

Thanks

bathory · 07-01-2011, 12:09 AM

Hi,

Why don't you use the combined Logformat, so apache logs more things like referer and browser user-agent
Anyway, you can log the "Authorization" header. In this case you'll get a "Basic username

assword" in the logs, where Basic is the authentication method and the u/p pair is encoded in base64

Regards

saagar · 07-04-2011, 02:11 AM

Bathory,

Sorry for the late reply. I could not understand what you meant by logging the "Authorization" header. Can you please a little bit more clear.

Thanks a lot.

bathory · 07-04-2011, 03:46 AM

Hi,

There is an "Authorization" header containing credentials, returned when a user authenticates himself using apache authentication.
So, from apache documentation about LogFormat:

Quote:

%{Foobar}i The contents of Foobar: header line(s) in the request sent to the server. Changes made by other modules (e.g. mod_headers) affect this.

Regards

saagar · 07-05-2011, 08:10 AM

Hi bathory,

I used the following way as you guided plus the cookie-related entry (as suggested by a different site) but I get a "-" correspoding to it.

Code:

 LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Cookie}i\" \"%{Referer}i\" \"%{User-Agent}i\"" combined
       CustomLog /var/log/apache2/mydreamhome_access.log combined

Following is the corresponding access log:

Code:

192.168.1.30 - saagar [05/Jul/2011:18:26:36 +0530] "GET / HTTP/1.1" 200 127 "-" "-" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.17) Gecko/20110422 Ubuntu/10.04 (lucid) Firefox/3.6.17"

Thanks a lot.

bathory · 07-05-2011, 08:50 AM

Hi,

Quote:

I used the following way as you guided plus the cookie-related entry (as suggested by a different site) but I get a "-" correspoding to it.
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Cookie}i\" \"%{Referer}i\" \"%{User-Agent}i\"" combined
CustomLog /var/log/apache2/mydreamhome_access.log combined

I cannot see where the Authorization header is. You need to add "%{Authorization}i\" in the LogFormat above

saagar · 07-06-2011, 12:07 AM

Hi bathory,

That was awesome. My mistake i didnt understand what you mentioned. thanks a lot, it works.

bathory · 07-06-2011, 03:15 AM

Hi,

Glad to see it worked, but once again I want to warn you. Base64 encoded stuff can be very easily decoded. It's not hashed like a usual password, that is hard to crack.
So having a username/password in the logfile could be a potential risk for your server.

Regards

saagar · 07-07-2011, 01:52 PM

Bathory,

Thanks for your concern, but thats okay, since I am not going to use that in the live environment, just for testing purpose.

Thanks