I created a filter plugin for ulogd2 that does retrieve informations
from HTTP request, it is similar to ulogd_filter_PWSNIFF (on which the
code is based) which allows to monitor/log HTTP requests sent/recieved
by the system.
Other solutions based on PCAP allows to log HTTP queries but not along
with informations such as the UID that did sent the packet which can be
useful to which users are executing virus/hacked scripts.
Output of "ulogd --info ulogd_filter_HTTPSNIFF.so" :
Input keys:
Key: raw.pkt (raw data)
Output keys:
Key: httpsniff.host (string)
Key: httpsniff.uri (string)
Key: httpsniff.method (unsigned int 8)
The code is available at : https://github.com/jb-boin/ulogd_filter_HTTPSNIFF
It requires both https://bugzilla.netfilter.org/show_bug.cgi?id=1192 and
https://bugzilla.netfilter.org/show_bug.cgi?id=1193 to be fixed for it
to work correctly.
I included proposed patchs for those two bugs.
I have been using it with a MariaDB output for about 3 months on more
than 30 Debian Jessie hosts, ulogd2 compiled as packages using the
Debian Stretch 2.0.5-5 source package and i didnt hit any issue so far.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
