2

An Ubuntu 9.04 box running Apache on 8080 and Varnish on 80.

Recently set up Munin and was wondering why Apache graphs are empty. Saw from the logs that Munin is accessing /server-status?auto and getting 403 Forbidden back. So I edited /etc/apache2/monds-enabled/status.conf to allow access from 127.0.0.1. But doing this actually made /server-status public, since requests coming through Varnish appear to come from 127.0.0.1 too.

So the question is, how do I configure mod_status to be accessible only by munin-node and not by Varnish?

3 Answers 3

3

The way I address this is by ensuring that Apache gets the IP of the actual visitor even when requests pass through varnish cache. I use Apache mod_rpaf for that (see http://giantdorks.org/alain/easily-get-the-correct-client-ip-with-mod_rpaf/).

Also, just in case the client's request also went through some proxy that set the X-Forwarded-For header, I reset it in my varnish cache instance (in vcl_recv):

  remove req.http.X-Forwarded-For;
  set    req.http.X-Forwarded-For = client.ip;

Then also tell varnish to never cache the response for /server-status and /server-info. The following (also in vcl_recv) works for me:

  if (req.url ~ "server-(info|status)") {
    return (pass);
  }
1

This looks like a solution, tell me what you think.

Varnish adds some HTTP headers like X-Varnish to every request it sends to backend. These can be used in Apache configuration to recognize requests coming from Varnish.

In /etc/apache2/mods-enabled/status.conf:

<IfModule mod_status.c>

SetEnvIf X-Varnish ".+" from_varnish
ExtendedStatus On

<Location /server-status>
    SetHandler server-status
    Order allow,deny
    Deny from env=from_varnish
    Allow from localhost ip6-localhost 127.0.0.1

</Location>

</IfModule>

Then tell munin to monitor port 8080 instead of 80. Requests from munin-node will come directly and so won't have the X-Varnish header set.

Added to /etc/munin/plugin-conf.d/munin-node:

[apache_*]
env.url   http://127.0.0.1:%d/server-status?auto
env.ports 8080
0

I had the same situation with Ubuntu 12.04, Apache2 on port 8008 and Varnish on port 80. With the Varnish VCL I was using my server-status page was cached for an hour so it was still available but only provided a status report when the cache refreshed. Implementing Alain's solution made the live server-status available through Varnish as it passed it to the backend. To secure my server-status I did the following:

I configured munin-node to listen on 8008 in /etc/munin/plugin-conf.d/munin-node:

[apache_*]
env.url   http://127.0.0.1:%d/server-status?auto
env.ports 8008

I then added the following line to my VCL at the top of the vcl_recv section:

if (req.url ~ "^/server-status") {
error 403;
}

This blocks access to the server-status URL on port 80 with a 403 forbidden message but munin-node can still connect to the server-status on localhost:8008

This post was helpful: http://nwlinux.com/how-to-configure-varnish-on-ubuntu-server/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .