Moree comments on example Apache config
@@ -21,24 +21,15 @@ Listen 8070
DocumentRoot /var/www/html
- # LogFormat
- # %t timestamp
- # %{hostname}e hostname set with SetEnv below as well as global rewrite rule. Needs more testing
- # %P Apache process id
- # %A IP serving the request
- # %{local}p Port of incoming request
- # %{backend_name} Default backend set with SetEnv below. Modified by RewriteRule if hit.
- # %{c2_ip} C2 IP serving request. Set by RewriteRule
- # %{c2_port} C2 Port serving the request. Set by RewriteRule
- # %{User_agent} User Agent
- # %r First line of incoming request
-
+ # exact LogFormat setup is important for RedELK!
LogFormat "%t %{hostname}e apache[%P]: frontend:%{frontend_name}e/%A:%{local}p backend:%{backend_name}e client:%h:%{remote}p xforwardedfor:%{X-Forwarded-For}i headers:{%{User-Agent}i|%{Host}i|%{X-Forwarded-For}i|%{X-Forwarded-Proto}i|%{X-Host}i|%{Forwarded}i|%{Via}i|} statuscode:%s request:%r" redelklogformat
CustomLog ${APACHE_LOG_DIR}/access-redelk.log redelklogformat
# Set the defaults. Assume all incoming requests are decoys unless changed by RewriteRule below.
+ # backend name should start with decoy or with c2
SetEnv backend_name decoy
SetEnv hostname $$HOSTNAME_OF_THIS_REDIRECTOR
+ # frontend name can be whatever you like
SetEnv frontend_name www-http
# Enable RewriteEngine
@@ -57,7 +48,7 @@ Listen 8070
ProxyPassReverse "/" "http://$$IP_OF_YOUR_C2SERVER"
# if requets didn't match previous rules, this rule will forward the request to a decoy website with 302 redirect
- RewriteRule ^ https://www.amazon.com [E=backend_name:decoy,L,R=302]
+ RewriteRule ^ https://www.amazon.com [E=backend_name:decoy-amazon,L,R=302]
</VirtualHost>
