tailieunhanh - Hardening Apache by Tony Mobily phần 3

Giữ một mắt trên các máy chủ web để họ chạy trơn tru là một phần thiết yếu của công việc của quản trị viên, cho cả hai mục đích hiệu suất và độ tin cậy. Hợp lý đăng nhập giúp phát hiện vấn đề hiệu suất tốt trước khi chúng trở nên rõ ràng cho người sử dụng, và cung cấp bằng chứng của các vấn đề bảo mật tiềm năng. | Team LiB 1 PREVIOUS I NEXT Chapter 3 Logging Keeping an eye on web servers so that they run smoothly is an essential part of the administrator s job for both performance and reliability purposes. Sensible logging helps to detect performance problems well before they become apparent to users and provides evidence of potential security problems. In this chapter I will first explain how to configure Apache for logging purposes highlighting the most common problems. I will then introduce remote logging using syslogd the standard logging server that comes with Unix. Finally I will propose a remote logging solution which will allow you to encrypt logging information and store it on a remote database using MySQL. Why Logging Log files show you what your daemons are doing. From a security perspective Apache s log files are used for Logging requests made and pages served in order to identify suspicious requests. Logging Apache s extra information such as errors and warnings. This information is very interesting because an attack generally creates some abnormal entries. The importance of log files is often underestimated. Sometimes even in important production servers they are left there to grow and grow until one day they make themselves noticed because they have filled up the file system. Note Log files should never be placed on file systems that don t support adequate logging. Typically that means NFS but it might also mean Samba AFS and others. You must either log to a remote application or to a local file system. Team LiB 1 F-RE VI OUS I NEXT Team LiB 1 PREVIOUS I NEXT Configuring Logging in Apache I will give an overview of how to configure log files in Apache. Remember that this is not a comprehensive explanation and for more information you should look at Apache s official documentation http docs . Normal Classic Configuration There are two types of log information in Apache the access log handled by the module mod_log_config and the error .