3

Im trying to run mod_security as standalone service with nginx as reverse proxy everything works fine except logging. Mod_security logs reverse proxys ip addres instead of clients ip address.

I would appreciate if someone can help.

The following is an example of logfile where mod_security is logging 127.0.0.1 instead of clients ip address.

2012/08/29 14:18:13 [info] 206862#0: [client 127.0.0.1] ModSecurity: Access denied with code 403 (phase 2). Pattern match ...

2 Answers 2

0

At least with Apache, issues can occur with redirects/rewrites to a vhost served by the same server such that logs report a foreign request arrived from localhost. Perhaps there is something similar going on in this situation. In the case where this bad logging behavior was observed, a server configuration change was possible that corrected the issue. It involved some restructuring of the server configuration. Possibly this was related to a site defined in httpd.conf that was then moved down into a vhost .conf, but unfortunately, that situation arose and was resolved without capturing the essence of the changes. Could this, or something similar, be a factor in your situation?

0

@kbulgrien: Not really, because NGINX is capturing its own logs correctly.

I had to do a work-around for this issue. I created a RequestDeny block where I forwarded requests which were 403 denied by mod_security. In this block I formated the logs the way I wanted, that way it was easy for me to capture the ip address of the rejected request.

I know it is better to have mod_security write its logs correctly, but when you dont know a better way to do it may help and so it did for me :)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .