3

Im trying to run mod_security as standalone service with nginx as reverse proxy everything works fine except logging. Mod_security logs reverse proxys ip addres instead of clients ip address.

I would appreciate if someone can help.

The following is an example of logfile where mod_security is logging 127.0.0.1 instead of clients ip address.

2012/08/29 14:18:13 [info] 206862#0: [client 127.0.0.1] ModSecurity: Access denied with code 403 (phase 2). Pattern match ...

0

At least with Apache, issues can occur with redirects/rewrites to a vhost served by the same server such that logs report a foreign request arrived from localhost. Perhaps there is something similar going on in this situation. In the case where this bad logging behavior was observed, a server configuration change was possible that corrected the issue. It involved some restructuring of the server configuration. Possibly this was related to a site defined in httpd.conf that was then moved down into a vhost .conf, but unfortunately, that situation arose and was resolved without capturing the essence of the changes. Could this, or something similar, be a factor in your situation?

0

@kbulgrien: Not really, because NGINX is capturing its own logs correctly.

I had to do a work-around for this issue. I created a RequestDeny block where I forwarded requests which were 403 denied by mod_security. In this block I formated the logs the way I wanted, that way it was easy for me to capture the ip address of the rejected request.

I know it is better to have mod_security write its logs correctly, but when you dont know a better way to do it may help and so it did for me :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.