ENABLE LOGGING OF THE X-FORWARDED-FOR HEADER

-

LOGGING OF THE X-FORWARDED-FOR HEADER



The dev-opes team , struggles to find the end user IP while working / troubleshooting the DOS, D-DOS attacks/issue. 

To troubleshoot such issue first thing you need to do is , log the end user IP. 

Please follow the steps to do the same. 

In the Apache HTTP Server's access_log, add this to the httpd.conf file in the dispatcher servers:

LogFormat "%{X-Forwarded-For}i %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent

In Microsoft IIS add X-Forwarded-For in the "Advanced Logging" configuration.

That would log the correct end-user IP.

Use the output showing the IP and User-Agent to analyse whether it is a malicious attack and block the offending IPs if it makes sense.

2. SET DISPATCHER.LOG'S LOG LEVEL TO DEBUG:

Apache:
In the httpd configuration files there should be a section for the dispatcher.  

Set DispatcherLogLevel to 3

DispatcherLogLevel 3

IIS:

Modify the dis_iis.ini and set the log level to 3:

loglevel=3

Comments

Post a Comment

Popular Posts

How to configure s3 in AEM ?

-
Image
How to Configure S3 in AEM  Configuring s3 data stores in AEM 6 In Adobe Experience Manager (AEM), binary data can be stored independently from the content nodes. The binary data is stored in a data store, whereas content nodes are stored in a node store. Both data stores and node stores can be configured using OSGi configuration. Each OSGi configuration is referenced using a persistent identifier (PID). In this article we learn the detailed steps for configuration S3 data store in AEM.  You can get the architectural level understand of S3 with AEM from article -  https://www.aemrules.com/2021/06/how-does-s3-works-with-aem.html   Amazon S3 Data Store AEM can be configured to store data in Amazon’s Simple Storage Service (S3). It uses the org.apache.jackrabbit.oak.plugins.blob.datastore.S3DataStore.config PID for configuration.   In order to enable the S3 data store functionality, a feature pack containing the S3 Datastore Connector needs to be downloaded and installed.  Go to the Adob
Read more

Pre warming AWS Load balancer

-
Image
AWS: Pre-Warming the Load Balancer How to Resolve Load balancer request over flow for a sudden traffic spike ?  Load balancer is giving 504 error ? Load balancer is giving target connection  error ? If you are facing such issues ,  please read this article to get the solution.  Do you expect a spike in traffic? Let’s say your stakeholders expect a ramp of 20000 users in the first minutes of your website. How do you handle a scenario where you expect tens of thousands of users in the first minutes since the launch of your website? This is a great example of handling fault tolerance in AWS. If one wants to achieve fault tolerance in AWS, there a few options to do that: Use a Load Balancer – no matter how much the traffic increases, if you place your instances behind a Load Balancer it is always a great idea because the traffic is balanced across all the healthy instances. Use an Auto Scaling Group – Load balancer can scale up/down with as many instances as you want, this is a really po
Read more

AEM ACL and how they are evaluated

-
Image
ACL's and how they are evaluated ? AEM Developers, Infrastructure Engineers / Dev-ops teams working in any domain regularly come across a challenge for understanding the ACL & its evaluation mechanism.  Adobe Experience Manager is designed to cater for content authoring of multiple sites by multiple content authors. Naturally, this process needs to be controlled by strict Access Control Lists (ACLs) to manage. AEM WCM uses Access Control Lists (ACLs) to organise the permissions being applied to the various pages. This article addresses in a simple way on how to understand the ACL's , its different ways,  This article covers the following - How can we read and understand the ACL.  Evaluation of user permissions.  Concurrent Permission on ACL Access Control Lists are made up of the individual permissions and are used to determine the order in which these permissions are actually applied. The list is formed according to the hierarchy of the pages under consideration. How can w
Read more

How to prevent DOS attacks in AEM ?

-
Image
Prevent Denial of Service (DoS) Attacks : AEM  A denial of service (DoS) attack is an attempt to make a computer resource unavailable to its intended users. At the dispatcher level, there are two methods of configuring to prevent DoS attacks: Use the mod_rewrite module (for example,  Apache 2.4 ) to perform URL validations (if the URL pattern rules are not too complex). Prevent the dispatcher from caching URLs with spurious extensions by using  filters .  For example, change the caching rules to limit caching to the expected mime types, such as .html .jpeg .gif .swf .js .doc .pdf .ppt .... as per your project requirement. An example configuration file is given below,  for  this includes restrictions for mime types.      When configuring Dispatcher you should restrict external access as much as possible. The      following example provides example for the minimal access for external visitors, you can refer the default file.  /filter { # Deny everything first and then allow s
Read more

How Does S3 works with AEM ?

-
Image
How Does S3 works with AEM  ? Accommodating a huge amount of assets in any content management platform is challenging. Adobe Experience Manager offers an integration with the Amazon S3 storage solution, allowing binary data for images, documents and videos to be stored in an S3 bucket. Amazon S3 is highly performant and offers nearly infinite storage capacity.   When talking about terabyte storage, performance is everything. The choices made during the planning and architecting phase can literally make or break the performance of a CMS system and the websites running on it.  Adobe Experience Manager offers a number of storage methods, each offering a different way of storing data. Each of these options has its strengths and weaknesses. In AEM storage the mechanisms are called Micro Kernels, or MK for short.  In this article we will look at the AEM with S3 data store. For the detailed steps for S3 configuration you can refer -  https://www.aemrules.com/2022/05/how-to-configure-s3-in-aem
Read more

Managing AEM Repository Size Growth ?

-
Image
 Managing AEM Repository Size Growth Managing your AEM repository size growth can be challenging for numerous reasons. What’s more, it may suddenly start to grow unexpectedly and fill up space in the assigned drive of your AEM application. In this post, I want to share a few AEM utilities & methods which can help you to not only manage the AEM repository size but also help to improve the AEM application performance. 1: Tar Compaction (also known as Revision Cleanup) By running the regular tar compaction, you can not only control the AEM repository size growth, but it will also help improve the AEM application performance. Tar compaction reclaims the disk space by removing the obsolete/redundant data from your AEM application. You can use both online and offline compaction. You can schedule online Tar compaction during weekdays after business hours & offline compaction on weekends (Non-business hours or during your designated Maintenance Window). 2: Garbage Collection By running
Read more

How Encrypt-Decrypt Data in AEM , Crypto Support ?

-
Image
How to Use Crypto Support in AEM to Encrypt/Decrypt Data? While working with AEM, The AEM dev-ops / developer team sometimes have a requirements to call third-party APIs/Services. Configurations related to these APIs/Services like username, passwords, client id/secrets, API keys are usually stored in a code repository in the form of OSGi configuration. This sensitive information should be stored encrypted rather than plain-text format. This is possible through the OOTB AEM Crypto Support bundle. This bundle provides services for encrypting and decrypting the confidential/secured data through system-wide keys (hmac and master files).   What are the Features of Crypto Support? Decryption happens at runtime. No one can decrypt the data through the UI. There’s no UI to decrypt the encrypted data. So, the information remains secure. What are hmac/master keys? Encryption/decryption happens through keys (hmac and master files). These keys get generated during the first startup of AEM instance
Read more

Dispatcher flush from AEM UI

-
Image
How to Delete Dispatcher cache without logging into the Dispatcher servers? Our Authoring team faces day to day challenges while deleting/flush the dispatcher cache. when the changes are not visible on server. They have to be depended on the IT operations/Dev ops teams to do the same. Which some time get very much time consuming for a small work.  In this article we will see it can be configure and used by Author UI itself.  This will allow  AEM authors (or “super authors”) to flush parts of the dispatcher cache manually without the involvement of IT Operations. How to Use 1. Log in to AEM Author 2. Download the ACS commons tool from  ACS Commons Official page 3. Install the downloaded package via aem package manager.   4. Make sure you create the dispatcher flush agents on Author for all Dispatchers. from http://<<host:port>>/miscadmin#/etc/replication/agents.author, check the NOTE's part at the end of page. 5. Navigate to Tools 6. Under the acs-commmons/dispatcher-flu
Read more

How to Sync HMAC in AEM ?

-
Image
Crypto Support in AEM (Syncing HMAC among AEM instances) AEM OOTB provides a feature where we can encrypt the secured and confidential data through OOTB AEM Crypto Support and store it in a code repository in the form of OSGi configuration. Crypto Support is based on keys (hmac and master files) which are unique for each AEM instance. Encrypted text generated for the same plain-text string on one AEM instance will be different from another instance. This can raise alarms in cases where we have the same OSGi configuration values shared among Author and Publish instances under the same topology. For e.g. /apps/project/config.prod/com.day.cq.db.dbservice.xml Here DB password for Default DB Service will be same across all Prod AEM instances. So, in order to make sure that the same encrypted value works on all Prod instances, we will have to sync hmac and master files among Prod Author and Publish instances. Vital Points to know before HMAC SYNC  Sync of HMAC/keys will break the AEM SSL and
Read more

Replication : PKIX path building failed:

-
Image
 SSL handshake error while replication  While configuring the SSL between author and publish servers, for a secured data flow you want to make the replication calls also over HTTPS.  Assumption -      Author and publish servers will have working SSL and sling security check should be pass.  Error -   Replication test  failed PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target Cause -  This issue comes as replication agents try to find the certificates with exact name. and it ignores the wild card certificates.  Solution  -  Login to AEM , open replication agent which has the error. Edit the replication agent Go to transport  Make ssl to R elaxed . 
Read more