Varnish 4 Basic authentication

Question

I have to cache multiple backend servers, I switch from Nginx to Varnish and finally discover 2 server need to run HTTP Basic Authentication. I try this link http://blog.tenya.me/blog/2011/12/14/varnish-http-authentication and it not work for me (they ran Varnish 3) Is there an easy way to configure Basic Authentication in Varnish 4?

Answer 1

You can use the VMOD basicauth

Install the Varnish VMOD

First you need to install it. Download the source from the Git repo for basicauth. Extract into your homedir e.g. ~/vmod-basicauth/

You'll also need the Varnish source to build the VMOD.

In Debian/Ubuntu type

apt-get source varnish

This will copy the source to your pwd.

Then do this to install it. Note that you need to change the paths according to your setup and version of varnish

cd ~/vmod-basicauth
./configure VARNISHSRC=$HOME/varnish-4.0.2
make 
sudo make install
sudo make check

Update It seems like the source have been removed from the Ubuntu and Debian package repos (most likely by accident).

Download the source directly from Git (v4.0.2)

Make Varnish

You'll have to "make" the downloaded source

cd ~
wget https://github.com/varnish/Varnish-Cache/archive/varnish-4.0.2.zip
unzip varnish-4.0.2.zip
cd Varnish-Cache-varnish-4.0.2
sudo ./autogen.sh
sudo ./configure --prefix=/usr
sudo make

Note that you don't have to install the source, so don't "make-install" because that might mess up your current installation.

Build & install VMOD

cd ~
./configure VARNISHSRC=$HOME/Varnish-Cache-varnish-4.0.2
make 
sudo make install
sudo make check

It might be that you also have to specify your VMOD install directory if it can't be autodetected. If ./configure fails try this

./configure VARNISHSRC=$HOME/Varnish-Cache-varnish-4.0.2 VMODDIR=/usr/lib/varnish/vmods/

Some build dependencies

I often require alot of different build dependencies so I often install these when I setup a new Varnish server.

sudo apt-get install git-core zlib1g-dev automake build-essential libtool libssl-dev libreadline-dev libyaml-dev libsqlite3-dev ncurses-dev sqlite3 libxml2-dev libxslt1-dev libpcre3-dev libcurl4-openssl-dev python-docutils python-software-properties libvarnishapi-dev

Configure Varnish to use the VMOD

It uses a .htpasswd file for authentication instead of storing the password directly in the VCL.

Make sure to change "/var/www/.htpasswd" to the path of your htpasswd file.

#default.vcl
import basicauth;

sub vcl_recv {
    if (!basicauth.match("/var/www/.htpasswd",  req.http.Authorization)) {
        return(synth(401, "Authentication required"));
    }
}

#Prompt the user for a password
sub vcl_synth {
    if (resp.status == 401) {
        set resp.http.WWW-Authenticate = "Basic";
    }
}

Answer 2

this also works:

sub vcl_recv {
  if (! req.http.Authorization ~ "Basic Zm9vOmJhcg==") {
    return(synth(401, "Authentication required"));
  }
  unset req.http.Authorization
}

sub vcl_synth {
  if (resp.status == 401) {
    set resp.status = 401;
    set resp.http.WWW-Authenticate = "Basic";
    return(deliver);
  }
}

src: http://blog.tenya.me/blog/2011/12/14/varnish-http-authentication/#comment-2882579903

Answer 3

For anyone who follows these steps on Debian Jessie - you may come across a couple of issues when building Varnish from source.

1. That automake requires subdir-options specified in the configure.ac line 18

   AM_INIT_AUTOMAKE([1.11 foreign color-tests parallel-tests subdir-options])
   

2. The Makefiles in the bin/varnishadm and bin/varnishhist require the variable $(top_srcdir) replaced with ../../ due to a bug in variable expansion in automake (see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=402727)

   varnishadm_SOURCES = \ 
           varnishadm.c \ 
           ../../lib/libvarnish/vas.c \ 
           ../../lib/libvarnish/vsa.c \ 
           ../../lib/libvarnish/vtcp.c \ 
           ../../lib/libvarnish/vss.c
   

Fix those and then you can follow the instructions in the answer by jacob-rastad above.

I have made some further notes here : http://www.blue-bag.com/blog/compiling-varnish-modules