This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Category:OWASP WeBekci Project"
Line 1: | Line 1: | ||
− | [[Image:OWASP Inactive Banner.jpg| | + | {| |
+ | |- | ||
+ | ! width="700" align="center" | <br> | ||
+ | ! width="500" align="center" | <br> | ||
+ | |- | ||
+ | | align="right" | [[Image:OWASP Inactive Banner.jpg|800px| link=https://www.owasp.org/index.php/Category:OWASP_Project]] | ||
+ | | align="right" | | ||
+ | |||
+ | |} | ||
[[:Category:OWASP Project|Click here to return to OWASP Projects page.]]<br> | [[:Category:OWASP Project|Click here to return to OWASP Projects page.]]<br> | ||
[[:Project Information:Webekci|Click here to see (& edit, if wanted) the template.]] | [[:Project Information:Webekci|Click here to see (& edit, if wanted) the template.]] |
Revision as of 18:36, 23 January 2014
|
|
---|---|
![]() |
Click here to return to OWASP Projects page.
Click here to see (& edit, if wanted) the template.
PROJECT IDENTIFICATION | ||||||
---|---|---|---|---|---|---|
Project Name | WeBekci | |||||
Short Project Description | WeBekci tries to provide an admin panel that ModSecurity, which is an open source web application firewall that runs as an Apache module, lacks. Web application firewalls (WAF) are gaining importance among the information security technologies designed to protect web sites from attack. WAF solutions prevent attacks that network firewalls and intrusion detection systems can't and they require no modification of application source code. ModSecurity is an embeddable web application firewall and it provides protection from a range of attacks against web applications. It is an open source project available to everyone; it however does not come with an admin panel. | |||||
Email Contacts | Project Leader Bünyamin Demir |
Project Contributors Bedirhan Urgun Christophe Vandeplas Eduardo Jorge |
Mailing List/subscribe Mailing List/Use |
First Reviewer Alex Fry Profile |
Second Reviewer Stefano Di Paola Profile |
OWASP Board Member (if applicable) Name&Email |
PROJECT MAIN LINKS | |||||
---|---|---|---|---|---|
|
SPONSORS & GUIDELINES | |||||
---|---|---|---|---|---|
Sponsor - OWASP Summer of Code 2008 | Sponsored Project/Guidelines/Roadmap |
ASSESSMENT AND REVIEW PROCESS | ||||
---|---|---|---|---|
Review/Reviewer | Author's Self Evaluation (applicable for Alpha Quality & further) |
First Reviewer (applicable for Alpha Quality & further) |
Second Reviewer (applicable for Beta Quality & further) |
OWASP Board Member (applicable just for Release Quality) |
50% Review | Objectives & Deliveries reached? Yes/No (To update) --------- See&Edit: 50% Review/Self-Evaluation (A) |
Objectives & Deliveries reached? Yes/No (To update) --------- See&Edit: 50% Review/1st Reviewer (C) |
Objectives & Deliveries reached? Yes/No (To update) --------- See&Edit: 50%Review/2nd Reviewer (E) |
X |
Final Review | Objectives & Deliveries reached? Yes/No (To update) --------- What status has been reached? Season of Code - (To update) --------- See&Edit: Final Review/SelfEvaluation (B) |
Objectives & Deliveries reached? Yes/No (To update) --------- What status has been reached? Season of Code - (To update) --------- See&Edit: Final Review/1st Reviewer (D) |
Objectives & Deliveries reached? Yes/No (To update) --------- What status has been reached? Season of Code - (To update) --------- See&Edit: Final Review/2nd Reviewer (F) |
X |
What is WeBekci?
WeBekci is a web based ModSecurity 2.x management tool. WeBekci is written in PHP, Its backend is powered by MySQL and the frontend by XAJAX framework. It is an OWASP Project.
What is ModSecurity for Apache?
With over 70% of all attacks now carried out over the web application level, organisations need every help they can get in making their systems secure. Web application firewalls are deployed to establish an external security layer that increases security, detects, and prevents attacks before they reach web applications (ModSecurity).
Goals
It will remove management overhead of ModSecurity 2.x. You can configure modsecurity.conf, add special rules and watch system, apache and modsecurity logs (only guardianlog has been implemented in this version).
Features
It covers 90 percent of the ModSecurity 2.x configuration features. Manual- and GUI-based rule managements are supported. It permits to add single-argument rules and it covers 70 percent of the action parameters. It can be used in monitoring system, apache and ModSecurity guardian logs. As of this version the monitoring utility is rather basic and it gives some information about the system.
Future Development
- Configuration : Most of the configuration parameters will be managed through the web interface
- Rule Generator : Basic rules will be generated using the web interface
- Core Rule Integration: Core rules will be added to the database for use
- Logging and Reporting: Apache error log and modsec_audit log will be parsed and presented to the user thru the web interface
- DB Support : MySQL
Requirement
- Platform Linux/Unix,
- Apache + ModSecurty 2.x
- Php
- Mysql
News
OWASP WeBekci Project Release! - 31 March 2007
Installation
Download adress: http://sourceforge.net/projects/webekci/
# tar –zxvf webekci-1.0.tar.gz # mv webekci /usr/local/www/ # cd /usr/local/www/webekci
Primarily, create .htaccess and .htpasswd files. These are required for WeBekci`s own. Edit .htaccess file:
# vi .htaccess
In the .htaccess file, enter the correct path for the .htpasswd file in the AuthUserFile line in accordance with your own configuration:
AuthUserFile /usr/home/bunyamin/.htpasswd AuthType Basic AuthName "Owasp-WeBekci Screet Area" <LIMIT GET POST> require valid-user </LIMIT>
Now edit .htpasswd file:
# vi .htpasswd
If the user name is going to be “webekci” and password “1234”, then enter:
webekci:cwc9eWGIM9r5M
You may enter your own UID and password.
Now, you need define “directory” in the httpd.conf file.
Alias /webekci/ "/usr/local/www/webekci/" <Directory "/usr/local/www/webekci/"> Options None AllowOverride All Order Allow,Deny Allow from all </Directory>
Note: If you are using mod_rewrite, then enter “AllowOverride All” so that .htaccess file can be read. Otherwise enter “AllowOverride None”.
# apachectl restart
Make necessary modifications in config.php file. Add the following line:
$config['modsecurity_conf']='/usr/local/etc/apache22/extra/mod_security.conf';
It’s important to create the mod_security.conf file and include its path to the httpd.conf. Let’s add the following line into your httpd.conf. Change the path according to your distribution if necessary.
Include etc/apache22/extra/mod_security.conf
To give the www user read and write permissions:
# chown www /usr/local/etc/apache22/extra/mod_security.conf
Note: www user is the user where apache runs. Please check the the following entries in httpd.conf:
User www
Group www
Some distributions may have different user and/or group names.
After configuring WeBekci you need to restart apache. Do this with these sudo configurations: $config['apache_config_test'] = '/usr/local/bin/sudo /usr/local/sbin/httpd -t';
$config['apache_restart']='/usr/local/bin/sudo /usr/local/sbin/httpd -k restart';
Also alter your config.php according to your distro. Edit sudoers file:
# vi /usr/local/etc/sudoers
Enter these lines:
www ALL=NOPASSWD:/usr/local/sbin/httpd -k restart www ALL=NOPASSWD:/usr/local/sbin/httpd -t
Now www user can do “config test” and “restart” operations restart apache without having to enter password.
Please make sure you entered MySQL related changes in your config.php file; and browse your site and run the install.php file:
http://www.site.com/webekci/install.php
Do not forget to delete install.php later..
# rm install.php
A reminder: www user must have read-write rights to audit, debug and guardian log files. For instance, if the Guardian log file has the path as “/var/log/modsec_guardian.log” , then we need to enter this command:
# chown www /var/log/modsec_guardian.log
Now the guardian log can be seen in the program. You have to do chown for other log files, too.
I express my gratitude to those who helped me with this write-up.
Project Contributor
The project is lead by * Bunyamin Demir (bunyamin~owasp.org)
Mail list: owasp-webekci~lists.owasp.org
Documents
ModSecurity 2.1.0 Reference documentation (English) (Turkish)
WeBekci documentation (English) (Turkish)
Project Sponsor
If you would like to help WeBekci project development, feel free to contact the project leader.
This category currently contains no pages or media.