Can I Log Logged in Wordpress users in Apache without a Wordpress plugin?

Although a little clunky I’ve found a passable solution to this problem using mod_security.

To implement this, enable modsecurity in Apache (presumably with a2enmod security). Then edit the config file. On my Ubuntu based systems this is at /etc/modsecurity/modsecurity.conf and as follows:

Ensure SecRequestBodyAccess is On (and I assume SecRuleEngine to DetectionOnly).

You may also want to limit logging to part H –

 SecAuditLogParts H

Add a rule to the end of the file like :

SecRule ARGS:log "@rx ^[a-zA-Z0-9_.-]+$" \
    "id:800002,\
    phase:2,\
    pass,\
    capture,\
    log,\
    msg:'Login value: %{MATCHED_VAR}'"

This will write a fairly noisy log file to whatever file is specified in SecAuditLog which contains the appropriate information. You can extract the interesting line with a command like

 grep "Apache-Error" /var/log/apache2/modsec_audit.log | grep "800002"

or for an even less noisy version which will give you a comma delimited set of entries with IP addrsss, auth username, website name and URL

 grep "Apache-Error" /var/log/apache2/modsec_audit.log | grep "800002"  | tr -s '"[]: ' ' ' | awk '{print $29,$9,$31,$33}'

Unfortunately this does not on my systems show the date in an easily readable form although there is an additional line “StopWatch” which shows date since the Epoch. I presume it is possible to ship the logfile to syslog and have syslog timestamp each line.

Related Posts: