On my server running Ubuntu 12.04, I have Apache2 listening on port 8008 (20 virtual hosts) and Varnish on port 80. I use munin and monit to keep tabs on the various services running on the machine and they use the mod_status output to keep tabs on Apache2 processes. As mod_status is compiled into Apache2 by default and the module is enabled this means that the detailed information about your secure webserver is exposed for all the world to see. The mod_status configuation file allows you to lock access down to localhost access only which is nice.
However, Varnish connects to the backend Apache2 server as localhost and so exposes the server-status page to the wild wild web. With the Varnish VCL I was using my server-status page was cached for an hour so it was still available but only provided a static status report that changed when the cache refreshed. Implementing a solution from serverfault.com made the live server-status available through Varnish as it passed it to the backend. This did not help. To secure my server-status I had to block access to the server-status URL but still keep it open for munin-node. Continue reading




