{"componentChunkName":"component---src-templates-tag-js","path":"/tags/data-masking/","result":{"data":{"site":{"siteMetadata":{"title":"LoginRadius Blog"}},"allMarkdownRemark":{"totalCount":1,"edges":[{"node":{"fields":{"slug":"/engineering/user-privacy-data-masking-in-nginx-logs/"},"html":"

There are several Consumer/User data protection regulations in place to protect customer data and privacy. With data protection act like the California Consumer Privacy Act (CCPA) and the European Union's GDPR improving awareness of privacy rights, many data-driven businesses have sought to determine which of their applications contain sensitive data, where the sensitive data goes, and why data is going. As a result, they are re-evaluating their data protection controls for employee and consumer data.

\n

Your program must record vast volumes of data to meet business requirements. It's likely that the application log data contains highly sensitive information. Email addresses, URL parameters such as tokens, credit card data, jobs data, Login Credentials, and Official ID Numbers (passport numbers, driver's license numbers, social security numbers), and authentication tokens may be included in specific log messages. It is important to mask sensitive details such as authentication tokens or credit card info while logging.

\n

A few years ago, Twitter requested users to reset their passwords. According to Twitter's release, passwords were written in the logs without masking, allowing those with access to the logs to see the password. In most startups or small businesses, all staff members have access to all tools, so masking confidential data is critical. Most log management tools allow you to mask any information until it is saved in the logs. Most of the log monitoring tools provide the feature for masking any information before it will save in the logs.

\n

Masking Sensitive Data in Nginx Logs

\n

By default, Nginx logs predefined format is combined. As you know, we can overwrite access log formatting as per the requirement. The NGINX JavaScript plugin can be used to enforce data masking in NGINX logs. This module is a kind of JavaScript implementation for NGINX and NGINX Plus that is intended for server-side use cases and per-request processing. When each request is logged, we run a small amount of JavaScript code to masking the sensitive data.

\n

Instructions for enabling the NGINX JavaScript module

\n

The NGINX JavaScript module is by default included in the official NGINX Docker image. if your installed version is 1.9.11 or later, then you can install NGINX JavaScript as a prebuilt package for your platform

\n
    \n
  1. \n

    Install the prebuilt package.

    \n

    Ubuntu and Debian systems

    \n
    $ sudo apt-get install nginx-module-njs
    \n

    RedHat, CentOS, and Oracle Linux systems

    \n
    $ sudo yum install nginx-module-njs
    \n
    2. \n
  2. \n

    Enable the module by adding a load module directive in the nginx.conf

    \n
       load_module modules/ngx_http_js_module.so;\n   load_module modules/ngx_stream_js_module.so;
    \n
    3. \n
  3. \n

    Reload NGINX service

    \n
        sudo nginx -s reload
    \n
    4. \n
\n

How to mask Query String in NGINX and NGINX Plus

\n

An application can be passed some potentially confidential information as query string parameters like tokens, public key, etc., this information logged as part of the request URI. If your program sends personal information in this manner, you can use the NGINX JavaScript module for masking customer/user personal information in the query string.

\n
    \n
  1. \n

    Create a new file maskQueryString.js

    \n
       vi maskQueryString.js\n\n   function fnv32a(str) {\n   var hval = 2166136261;\n       for (var i = 0; i < str.length; ++i ) {\n           hval ^= str.charCodeAt(i);\n           hval += (hval << 1) + (hval << 4) + (hval << 7) + (hval << 8) + (hval << 24);\n       }\n       return hval >>> 0;\n   }\n\n   function maskQueryStringParameters(req) {\n   var query_string = req.variables.query_string;\n   if (query_string.length) {                     // Proceed if we have query string\n       var keyvaluepairs = query_string.split('&');     // Convert to array of key=value\n           for (var i = 0; i < keyvaluepairs.length; i++) { // Iterate through each Key Value pairs pair\n               var keyvaluepairs = keyvaluepairs[i].split('=');    // Split Key Value pair into new array\n               \n               if (keyvaluepairs[0] == "token") {              // Mask token query paramter\n               // Use first 5 digits of masked value\n               kvpairs[i] = kvpair[0] + "=" + fnv32a(kvpair[1]).toString().substr(5);\n               } \n               ekse if (keyvaluepairs[0] == "accountno") {              // Mask account no\n               // Use first 7 digits of masked value\n               keyvaluepairs[i] = keyvaluepairs[0] + "=" + fnv32a(keyvaluepairs[1]).toString().substr(0,7);\n               } else if (keyvaluepairs[0] == "email") {     // Mask email\n               // Use hash as prefix for a single domain\n               keyvaluepairs[i] = keyvaluepairs[0] + "=" + fnv32a(keyvaluepairs[1]) + "@sample.com";\n           }\n   }\n   return req.uri + "?" + keyvaluepairs.join('&');  // Construct masked URI\n}\nreturn req.uri; // No query string, return URI\n}
    \n

    The maskQueryStringParameters function loops through and key-value pair in the query string, searching for individual keys that have been identified as containing personal data. The value is converted into a masked value for each of these keys.

    \n
    2. \n
  2. Include maskQueryString.js file in the nginx.config file
    3. \n
\n
     http {\n\n js_include maskQueryString.js;\n js_set     $request_uri_masked maskQueryStringParameters;\n\n log_format custom_log_format '$remote_addr - $remote_user [$time_local] '\n                        '"$request" $status $body_bytes_sent $request_uri_masked '\n                        '"$http_host" "$upstream_response_time"'\n                         '"$http_referer" "$http_user_agent" clientId="$clientid"';\n\n access_log /spool/logs/nginx-access.log custom_log_format;\n....................\n\n  }
\n

In the above example, I am using the maskQueryStringParameters js function and Since we only need to mask the query string, so using a different variable $requesturimasked and then using the same variable in the log format.

\n

3.Reload NGINX service

\n
      sudo nginx -s reload
\n

Now nginx will store token, accountno, and email in the logs after sanitizing the data.

\n

Summery

\n

These best practices will help you keep confidential information out of your logs. It's not a full package that will get you ready for a HIPAA or SOC2 audit, but it'll get you started.

\n

The NGINX JavaScript module provides a quick and efficient approach for adding custom logic like data sanitizing to request processing. I showed how NGINX JavaScript could be used to mask personal data in the log files.

\n

You can get more detail about the Nginx logs and mask from here -\nNginx - Everything you want to know about the Nginx logs in 10 minutes

\n","frontmatter":{"date":"May 18, 2021","updated_date":null,"title":"Data Masking In Nginx Logs For User Data Privacy And Compliance","tags":["Nginx","Logs","Data Masking","Compliance","Privacy"],"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.3333333333333333,"src":"/static/e50f9d5601792a8e4e32b1b89444ca3b/991d2/data-masking-in-nginx-logs-for-user-data-privacy-and-compliance.webp","srcSet":"/static/e50f9d5601792a8e4e32b1b89444ca3b/61e93/data-masking-in-nginx-logs-for-user-data-privacy-and-compliance.webp 200w,\n/static/e50f9d5601792a8e4e32b1b89444ca3b/1f5c5/data-masking-in-nginx-logs-for-user-data-privacy-and-compliance.webp 400w,\n/static/e50f9d5601792a8e4e32b1b89444ca3b/991d2/data-masking-in-nginx-logs-for-user-data-privacy-and-compliance.webp 640w","sizes":"(max-width: 640px) 100vw, 640px"}}},"author":{"id":"Vijay Singh Shekhawat","github":"code-vj","avatar":null}}}}]}},"pageContext":{"tag":"Data Masking"}},"staticQueryHashes":["1171199041","1384082988","2100481360","23180105","528864852"]}