EasyWAF v0.9.0
Added
- Flow logs over syslog: one line per proxied request, sent to a collector with the site, client, method, path, verdict, score and rules. Off by default.
- Settings › Logging: the syslog collector's address and port, applied to the running proxy on save rather than at the next restart.
- Logging configuration in
config.toml: the directory the audit log is written to —/var/log/easywafon every installation, created by the systemd unit — and how many days of files are kept. - Audit log: every change made through the management interface is written to
/var/log/easywaf/audit.logwith the account, the client address, the outcome and — when a save was refused — the reason. - Sign-ins, failed sign-ins and sign-outs appear in the audit log, a failed one naming the account that was tried.
docs/design/easylog-easywaf-type.md— the wire format EasyWAF emits, specified for EasyLog to implement a parser against.
Fixed
scripts/modsec2easywaf.pyconverted CRS rules of every paranoia level. CRS runs level 1 by default and higher levels are opt-in, so 53% of the output was rules CRS itself would not run. It now takes--max-paranoia, default 1.
Commits
- 2fdaee5 Teach the ModSecurity converter about paranoia levels — yarivha
- 312f59b Plan the missing decoders for 0.10.0 — yarivha
- a4e232c Move flow logs to 0.9.0, ahead of IP lists and the engine release — yarivha
- ce89740 Add the logging core: an audit file and a syslog sender — yarivha
- c67f2eb Specify the easywaf log type for EasyLog — yarivha
- 00866c5 Emit the flow line for every proxied request — yarivha
- a873e6f Set the syslog collector in Settings, not config.toml — yarivha
- b94006a Put the log directory at /var/log/easywaf everywhere — yarivha
- 847ce5c Record who changed what, in a layer rather than in handlers — yarivha
- d5e1b8b Release 0.9.0 — yarivha
Full changelog: v0.8.1...v0.9.0