PHP 怎么PHP OSSEC

wen PHP项目 2026-07-30 202

本文目录导读：

PHP 怎么PHP OSSEC

通过OSSEC API集成
监控PHP应用事件
OSSEC规则配置
完整的集成示例
最佳实践

我来帮你了解如何在PHP中使用OSSEC（开源安全监控系统），PHP与OSSEC集成主要有以下几种方式：

通过OSSEC API集成

使用Socket直接通信

<?php
class OssecSocketClient {
    private $socket;
    private $host;
    private $port;
    public function __construct($host = '127.0.0.1', $port = 1514) {
        $this->host = $host;
        $this->port = $port;
    }
    public function connect() {
        $this->socket = socket_create(AF_INET, SOCK_DGRAM, SOL_UDP);
        if (!$this->socket) {
            throw new Exception("Socket创建失败: " . socket_strerror(socket_last_error()));
        }
    }
    public function sendAlert($level, $description, $location = 'php_app') {
        $message = sprintf(
            "1:%d:%s:%s:PHP Alert: %s",
            time(),
            $level,
            $location,
            $description
        );
        socket_sendto(
            $this->socket, 
            $message, 
            strlen($message), 
            0, 
            $this->host, 
            $this->port
        );
    }
    public function close() {
        if ($this->socket) {
            socket_close($this->socket);
        }
    }
}
// 使用示例
try {
    $ossec = new OssecSocketClient('192.168.1.100', 1514);
    $ossec->connect();
    $ossec->sendAlert(7, "检测到异常登录尝试", "user_login");
    $ossec->close();
} catch (Exception $e) {
    error_log("OSSEC通信失败: " . $e->getMessage());
}

通过文件方式写入

<?php
class OssecFileWriter {
    private $logFile;
    public function __construct($logFile = '/var/ossec/logs/alerts/alerts.log') {
        $this->logFile = $logFile;
    }
    public function writeAlert($level, $message, $source = 'PHP_Application') {
        $alert = sprintf(
            "** Alert %d.%d: - %s\n" .
            "%s\n" .
            "Rule: %d (level %d) -> 'PHP Alert'\n" .
            "Src IP: %s\n" .
            "Message: %s\n\n",
            time(),
            rand(1000, 9999),
            date('Y M d H:i:s'),
            $source,
            100, // 规则ID
            $level,
            $_SERVER['REMOTE_ADDR'] ?? '127.0.0.1',
            $message
        );
        return file_put_contents($this->logFile, $alert, FILE_APPEND | LOCK_EX);
    }
}
// 使用示例
$logger = new OssecFileWriter();
$logger->writeAlert(10, "检测到SQL注入尝试", "web_app");

监控PHP应用事件

<?php
class OssecPHPIntegration {
    private $ossecClient;
    public function __construct($ossecClient) {
        $this->ossecClient = $ossecClient;
    }
    // 监控文件变更
    public function monitorFileChange($filePath, $oldHash, $newHash) {
        if ($oldHash !== $newHash) {
            $this->ossecClient->sendAlert(
                7,
                "文件变更检测: $filePath\n" .
                "旧哈希: $oldHash\n" .
                "新哈希: $newHash\n" .
                "操作IP: " . $_SERVER['REMOTE_ADDR'] ?? '127.0.0.1'
            );
        }
    }
    // 监控登录失败
    public function monitorFailedLogin($username, $ip) {
        static $failedAttempts = [];
        $key = "$username@$ip";
        $failedAttempts[$key] = ($failedAttempts[$key] ?? 0) + 1;
        if ($failedAttempts[$key] >= 5) {
            $this->ossecClient->sendAlert(
                10,
                "多次登录失败: 用户=$username, IP=$ip, " .
                "尝试次数={$failedAttempts[$key]}"
            );
        }
    }
    // 监控异常请求
    public function monitorAnomalousRequest($requestData) {
        $suspiciousPatterns = [
            '/<script>/i' => 'XSS攻击',
            '/UNION.*SELECT/i' => 'SQL注入',
            '/(\bexec\b|\bsystem\b|\bpassthru\b)/i' => '命令注入'
        ];
        foreach ($suspiciousPatterns as $pattern => $attackType) {
            if (preg_match($pattern, $requestData)) {
                $this->ossecClient->sendAlert(
                12,
                "检测到$attackType: " . 
                "IP=" . $_SERVER['REMOTE_ADDR'] . 
                ", URL=" . $_SERVER['REQUEST_URI']
                );
                break;
            }
        }
    }
}
// 使用示例
$ossecClient = new OssecSocketClient();
$integration = new OssecPHPIntegration($ossecClient);
// 监控登录
$integration->monitorFailedLogin('admin', '192.168.1.50');
// 监控文件变更
$integration->monitorFileChange('/etc/passwd', 'old_hash', 'new_hash');
// 监控异常请求
$integration->monitorAnomalousRequest($_SERVER['QUERY_STRING']);

OSSEC规则配置

在 /var/ossec/rules/local_rules.xml 中添加自定义规则：

<group name="php_rules">
    <rule id="100001" level="7">
        <if_sid>100</if_sid>
        <field name="location">php_app</field>
        <description>PHP应用安全告警</description>
        <group>php_alerts</group>
    </rule>
    <rule id="100002" level="10">
        <if_sid>100</if_sid>
        <field name="location">php_app</field>
        <match>SQL注入</match>
        <description>检测到SQL注入尝试</description>
        <group>php_security</group>
    </rule>
    <rule id="100003" level="12">
        <if_sid>100</if_sid>
        <match>多次登录失败</match>
        <description>暴力破解攻击检测</description>
        <group>php_bruteforce</group>
    </rule>
</group>

完整的集成示例

<?php
// ossec_integration.php
class OssecIntegration {
    private $config;
    private $logger;
    public function __construct() {
        $this->config = [
            'host' => '127.0.0.1',
            'port' => 1514,
            'log_file' => '/var/log/php_ossec.log',
            'enabled' => true
        ];
        $this->initLogger();
    }
    private function initLogger() {
        $this->logger = new OssecSocketClient(
            $this->config['host'],
            $this->config['port']
        );
    }
    public function alert($level, $message, $context = []) {
        if (!$this->config['enabled']) {
            return false;
        }
        try {
            $contextStr = !empty($context) ? 
                ' | 上下文: ' . json_encode($context) : '';
            $this->logger->sendAlert(
                $level,
                $message . $contextStr
            );
            $this->logLocal($level, $message);
            return true;
        } catch (Exception $e) {
            error_log("OSSEC告警失败: " . $e->getMessage());
            return false;
        }
    }
    private function logLocal($level, $message) {
        $logEntry = sprintf(
            "[%s] [LEVEL:%d] %s\n",
            date('Y-m-d H:i:s'),
            $level,
            $message
        );
        file_put_contents(
            $this->config['log_file'],
            $logEntry,
            FILE_APPEND | LOCK_EX
        );
    }
}
// 全局使用
$ossec = new OssecIntegration();
// 安全事件告警
$ossec->alert(10, "未授权访问尝试", [
    'ip' => $_SERVER['REMOTE_ADDR'],
    'uri' => $_SERVER['REQUEST_URI'],
    'user_agent' => $_SERVER['HTTP_USER_AGENT']
]);
// 文件完整性监控
$ossec->alert(7, "重要文件被修改", [
    'file' => '/var/www/html/config.php',
    'action' => 'modified'
]);