Varnish caching and brute force failed logins not detected

Question

Since I installed and set up varnish caching, failed logins are being logged to auth.log with the IP of the cache (127.0.0.1) instead of the attacker. e.g.

Jul 8 14:48:06 host wordpress(hostname.com)[7285]: Authentication failure for admin from 127.0.0.1

In my config Varnish serves HTTP, HTTPS is served from apache2 both as the reverse proxy and the backend webserver. Internal and external web requests are logged separately.. All appears working correctly, except brute force logins are now not being picked up by fail2ban as they all appear to originate from the server.

sub vcl_recv is set to 'pass' the login pages;

if (req.url ~ "/wp-(login|admin)") {
return (pass);
        }

How can I get the requesting IP logged to auth.log instead of 127.0.0.1 ?

Answer 1

Varnish keeps track of the client IP and stores it in a X-Forwarded-For header, that it forwards to your backend.

It's just a matter of adding that header to your LogFormat to include X-Forwarded-For.

This is what the combined and common log formats looks like in your Apache config file:

LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %O" common

You'll have to change it as follows:

LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %O" common

Instead of the client IP address, the value of the X-Forwared-For header will be stored in your logs.

UPDATE

As it turns out, the log items in question are not related to Apache. The suggestion to modify the LogFormat is irrelevant.

This is likely related to the use of wp-fail2ban, a WordPress module that logs failed login attempts in the system's auth.log file.

Because wp-fail2ban is not aware of Varnish, the IP address it logs is always 127.0.0.1. However the WP_FAIL2BAN_PROXIES configuration parameter can make this module proxy aware.