最近一直需要在grafana上畫圖

之前一陣子用的是csv檔的方式

把csv檔放在 web server上就可以了

在更之前也有使用influxdb來放資料

昨天想說可以用sqlite來試試

OS要安裝 sqlite

grafana要安裝sqlite的plugin

但碰到了時間格式的問題

這個之前使用 csv檔時也碰過 當時也試了好久

csv可以使用的日期時間格式如下

2024-12-16T07:34:01+0800

或

2024-12-16 07:34:01

sqlite 文件上說只能使用  RFC3339 的格式 但實際上這個格式無法被解析

必須要使用 iso-8601 才行

linux date 指令如下

date --iso-8601=seconds

產生格式如下

2024-12-17T22:17:01+08:00

還有一個要注意的是在下方的 sql指令欄位中 

記得要在 format as 選 time series 然後把 日期時間的欄位加進去 這裡是 time

醬才能被解析 也才能成功畫圖

https://grafana.com/grafana/plugins/frser-sqlite-datasource/

這几天用ZAP在弱掃

當網站很大時 因為會產生很大量的cache

所以要確保執行弱掃那台几器的HD空間要夠

不然有可能還沒做完就爆了

另外有很多網站都出現以下的報告

 

查了一下 可以在httpd.conf 設定

新增以下內容

<IfModule mod_headers.c>

Header set X-Frame-Options "SAMEORIGIN"

Header set Content-Security-Policy "default-src 'self'"

</IfModule>

設完要重啟apache

另外 如果有參考到外面的任何元件

版面是會亂掉的

這個要特別注意

設完後再掃一次出現另一個報告

如果要再處理

Header set 就要再改成如下的設定

Header set Content-Security-Policy "frame-ancestors 'self'; form-action 'self'; base-uri 'self'; img-src 'self'; default-src 'self'; script-src 'self'; style-src 'self';"

當然影響範圍就會更大

https://lawrencechuang760223.medium.com/%E5%A6%82%E4%BD%95%E5%9C%A8apache-server%E4%B8%8B%E6%96%B0%E5%A2%9Ex-frame-options%E8%88%87content-security-policy%E8%87%B3response-header%E4%B8%AD-fix-web-application-d68209ff385c

https://medium.com/@andy001018/owasp-zap-%E5%BC%B1%E6%8E%83%E8%99%95%E7%90%86%E7%B4%80%E9%8C%84-2fb0f4888908

之前就一直想從http的log裡找出一些不正常的網路行為
但實行上有點麻煩
要麼就要在每台上去解析log再把資料收回來處理
要麼就是在每台 web server 設定把log丟到一台log server 再來處理這些log
但以上都會碰到相同的問題
就是log格式都不同
處理起來相當不方便
bro ids 解決了這個問題
因為她把http的訊息存成 http.log
由於是port mirror的資料
所以不用管是用什麼web server 沒有格式的問題
以下是收到的部分相關log

"2018-12-29T04:20:32.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057222.232953 CMitkC4cDzyAFEKkR7 103.13.222.104 58845 10.10.10.10 80 78 GET 10.10.10.10 /phpmyadmin1/index.php - - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) 0 0 - - - - (empty) - - - - - - - - -"
"2018-12-29T04:20:32.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057225.584942 CMitkC4cDzyAFEKkR7 103.13.222.104 58845 10.10.10.10 80 97 GET 10.10.10.10 /phpMyAdmin__/index.php - - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) 0 0 - - - - (empty) - - - - - - - - -"
"2018-12-29T04:20:32.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057223.108940 CMitkC4cDzyAFEKkR7 103.13.222.104 58845 10.10.10.10 80 83 GET 10.10.10.10 /xampp/phpmyadmin/index.php - - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) 0 0 - - - - (empty) - - - - - - - - -"
"2018-12-29T04:20:32.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057214.432996 CMitkC4cDzyAFEKkR7 103.13.222.104 58845 10.10.10.10 80 47 POST 10.10.10.10 /mm.php - - Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.105 Safari/537.36 33 0 - - - - (empty) - - - FtjKnE4d9dGZ1eTimg - text/plain - - -"
"2018-12-29T04:20:32.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057223.824968 CMitkC4cDzyAFEKkR7 103.13.222.104 58845 10.10.10.10 80 87 GET 10.10.10.10 /phpmyadmin-old/index.php - - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) 0 0 - - - - (empty) - - - - - - - - -"
"2018-12-29T04:20:32.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057217.248956 CMitkC4cDzyAFEKkR7 103.13.222.104 58845 10.10.10.10 80 63 GET 10.10.10.10 /dbadmin/index.php - - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) 0 0 - - - - (empty) - - - - - - - - -"
"2018-12-29T04:20:32.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057210.580951 CMitkC4cDzyAFEKkR7 103.13.222.104 58845 10.10.10.10 80 26 POST 10.10.10.10 /xiaohei.php - - Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.105 Safari/537.36 28 0 - - - - (empty) - - - F2YNwr3qgj6VkZiouf - text/plain - - -"
"2018-12-29T04:20:32.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057215.136950 CMitkC4cDzyAFEKkR7 103.13.222.104 58845 10.10.10.10 80 51 GET 10.10.10.10 /index.php - - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) 0 0 - - - - (empty) - - - - - - - - -"
"2018-12-29T04:20:32.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057216.020960 CMitkC4cDzyAFEKkR7 103.13.222.104 58845 10.10.10.10 80 56 GET 10.10.10.10 /PMA/index.php - - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) 0 0 - - - - (empty) - - - - - - - - -"
"2018-12-29T04:20:32.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057218.484938 CMitkC4cDzyAFEKkR7 103.13.222.104 58845 10.10.10.10 80 70 GET 10.10.10.10 /admin/phpMyAdmin/index.php - - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) 0 0 - - - - (empty) - - - - - - - - -"
"2018-12-29T04:20:32.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057218.308939 CMitkC4cDzyAFEKkR7 103.13.222.104 58845 10.10.10.10 80 69 GET 10.10.10.10 /admin/phpmyadmin/index.php - - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) 0 0 - - - - (empty) - - - - - - - - -"
"2018-12-29T04:20:32.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057223.648956 CMitkC4cDzyAFEKkR7 103.13.222.104 58845 10.10.10.10 80 86 GET 10.10.10.10 /tools/phpMyAdmin/index.php - - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) 0 0 - - - - (empty) - - - - - - - - -"
"2018-12-29T04:20:32.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057216.196985 CMitkC4cDzyAFEKkR7 103.13.222.104 58845 10.10.10.10 80 57 GET 10.10.10.10 /PMA2/index.php - - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) 0 0 - - - - (empty) - - - - - - - - -"
"2018-12-29T04:20:32.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057222.937003 CMitkC4cDzyAFEKkR7 103.13.222.104 58845 10.10.10.10 80 82 GET 10.10.10.10 /myadmin2/index.php - - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) 0 0 - - - - (empty) - - - - - - - - -"
"2018-12-29T04:20:32.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057213.724938 CMitkC4cDzyAFEKkR7 103.13.222.104 58845 10.10.10.10 80 43 POST 10.10.10.10 /test123.php - - Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.105 Safari/537.36 21 0 - - - - (empty) - - - FIDl5w1kIO2VHsjo8a - text/plain - - -"
"2018-12-29T04:20:32.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057221.163288 CMitkC4cDzyAFEKkR7 103.13.222.104 58845 10.10.10.10 80 72 GET 10.10.10.10 /mysqladmin/index.php - - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) 0 0 - - - - (empty) - - - - - - - - -"
"2018-12-29T04:20:32.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057221.704931 CMitkC4cDzyAFEKkR7 103.13.222.104 58845 10.10.10.10 80 75 GET 10.10.10.10 /phpadmin/index.php - - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) 0 0 - - - - (empty) - - - - - - - - -"
"2018-12-29T04:20:32.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057224.528944 CMitkC4cDzyAFEKkR7 103.13.222.104 58845 10.10.10.10 80 91 GET 10.10.10.10 /claroline/phpMyAdmin/index.php - - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) 0 0 - - - - (empty) - - - - - - - - -"
"2018-12-29T04:20:32.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057217.776981 CMitkC4cDzyAFEKkR7 103.13.222.104 58845 10.10.10.10 80 66 GET 10.10.10.10 /admin/PMA/index.php - - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) 0 0 - - - - (empty) - - - - - - - - -"
"2018-12-29T04:20:32.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057211.996955 CMitkC4cDzyAFEKkR7 103.13.222.104 58845 10.10.10.10 80 34 POST 10.10.10.10 /zxc2.php - - Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.105 Safari/537.36 27 0 - - - - (empty) - - - Ft1eC04yYKwCWhrTPi - text/plain - - -"
"2018-12-29T04:20:32.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057224.884950 CMitkC4cDzyAFEKkR7 103.13.222.104 58845 10.10.10.10 80 93 GET 10.10.10.10 /phpma/index.php - - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) 0 0 - - - - (empty) - - - - - - - - -"
"2018-12-29T04:20:41.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057229.508999 C95B7c0UxBS1gw2Yg 103.13.222.104 64912 10.10.10.10 80 17 GET 10.10.10.10 /wp-content/plugins/portable-phpmyadmin/wp-pma-mod/index.php - - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) 0 0 - - - - (empty) - - - - - - - - -"
"2018-12-29T04:20:41.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057227.352989 C95B7c0UxBS1gw2Yg 103.13.222.104 64912 10.10.10.10 80 5 GET 10.10.10.10 /phpMyAdmin1/index.php - - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) 0 0 - - - - (empty) - - - - - - - - -"
"2018-12-29T04:20:41.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057229.144976 C95B7c0UxBS1gw2Yg 103.13.222.104 64912 10.10.10.10 80 15 GET 10.10.10.10 /mysql/sqlmanager/index.php - - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) 0 0 - - - - (empty) - - - - - - - - -"
"2018-12-29T04:20:41.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057229.681003 C95B7c0UxBS1gw2Yg 103.13.222.104 64912 10.10.10.10 80 18 GET 10.10.10.10 /manager/html - - Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0 0 0 - - - - (empty) - - - - - - - - -"
"2018-12-29T04:20:28.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057227.000982 C95B7c0UxBS1gw2Yg 103.13.222.104 64912 10.10.10.10 80 3 GET 10.10.10.10 /phpMyAdmion/index.php - 1.1 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) 0 159 404 Not Found - - (empty) - - - - - - F3YCn01Lompw5GiAdh - text/plain"
"2018-12-29T04:20:28.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057226.644633 C95B7c0UxBS1gw2Yg 103.13.222.104 64912 10.10.10.10 80 1 GET 10.10.10.10 /shaAdmin/index.php - 1.1 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) 0 159 404 Not Found - - (empty) - - - - - - F6zWHY3ZersNuWiVX2 - text/plain"
"2018-12-29T04:20:11.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057189.296983 CTOH8U3JKYGtswHTJe 103.13.222.104 52431 10.10.10.10 80 30 POST 10.10.10.10 /1hou.php - - Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.105 Safari/537.36 24 0 - - - - (empty) - - - FFzi3l4NQmxiu0bsfg - text/plain - - -"
"2018-12-29T04:20:11.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057194.068951 CTOH8U3JKYGtswHTJe 103.13.222.104 52431 10.10.10.10 80 50 POST 10.10.10.10 /sha.php - - Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.105 Safari/537.36 24 0 - - - - (empty) - - - FjR3jA2532rlkSNbEf - text/plain - - -"
"2018-12-29T04:20:11.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057202.900966 CTOH8U3JKYGtswHTJe 103.13.222.104 52431 10.10.10.10 80 88 POST 10.10.10.10 /2.php - - Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.105 Safari/537.36 24 0 - - - - (empty) - - - F3ewddDCWbrsByyN8 - text/plain - - -"
"2018-12-29T04:20:11.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057193.716947 CTOH8U3JKYGtswHTJe 103.13.222.104 52431 10.10.10.10 80 48 POST 10.10.10.10 /core.php - - Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.105 Safari/537.36 25 0 - - - - (empty) - - - FMBWxFbha0axdctTj - text/plain - - -"
"2018-12-29T04:20:11.000Z","bro-ids-centos7-lxc","bro-ids-centos7-lxc bro_http: 1546057185.908958 CTOH8U3JKYGtswHTJe 103.13.222.104 52431 10.10.10.10 80 11 POST 10.10.10.10 /aaaa.php - - Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.105 Safari/537.36 25 0 - - - - (empty) - - - Fsbkfe4RxpY2HRVpkg - text/plain FGwnQrbAvp4Iov629 - -"

除了偽裝成不同OS跟不同browser之外

再來就是一直try各種預設管理軟体的路徑及檔案

封包丟過來不一定會等回應

所以不一定會有 404 的回應碼

可以用搜尋關鍵字的方式

找出有問題的 ip 來處理

一直都是使用BASE這個工具來看snort產生的報表
但也一直都有個問題就是查詢結果會分頁
在之前都是一頁一頁分別列印出pdf
想把查詢結果轉成csv然後寄出
試了一下發現有二個地方要處理
一個是要把php-pear-Mail這個rpm裝上去

yum install php-pear-Mail

再來要修改base_conf.php如下

base_conf.php

$action_email_smtp_host = 'localhost';
$action_email_smtp_auth = 0;
$action_email_from = 'base@snort';

不要忘記重啟httpd

systemctl restart httpd

如下圖　在查詢結果的最下方選擇　電子郵件警告(csv)  然後打入要寄出的 email 最後點進入查詢　就可以寄出了

今天本來是要升級OCS
但升到2.2後畫面竟然只有几個數字
而且升級的過程一直不順
想說重裝好了
因為原來是裝在centos 5上
而centos 5 的EOL是2017年3 月
所以試看看裝在centos 7 會不會比較沒問題
查了一下
現在在centos 7 上裝很簡單了
稍微記錄一下
最小安裝後改一下hosts.allow hosts.deny 及selinux
關掉filewalld
systemctl stop firewalld
systemctl disable firewalld

再裝一下net-tools及 epel-release
epel-release是用來加入額外repo
安裝mariadb
yum install mariadb-server -y
systemctl start mariadb
systemctl enable mariadb

修改mariadb的root密碼及一些安全設定
mysql_secure_installation

再來安裝ocs
yum install -y ocsinventory-server ocsinventory-reports

因為加入了epel-release 所以系統會把所有相依性的套件一次裝好

啟動httpd服務
systemctl start httpd
sytemctl enable httpd

接下來就可以進入web介面 依畫面指示進行接下來的安裝動作了
http://ocs-server-ip/ocsreports/

預設登入帳號密碼是 admin/admin 記得要改

修改server ip 使用文字化圖形介面指令
nmtui

目前的版本是2.1.2
再等一陣子看看 應該會直接升到 2.2 到時直接使用yum update就好了