CIS Varnish Cache Benchmark

This recommendation verifies that Varnish is running the latest stable version on the Varnish Cache HTTP accelerator. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Varnish Cache HTTP accelerator vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Varnish version
varnishd -V 2>&1
dpkg -l varnish 2>/dev/null || rpm -qi varnish 2>/dev/null

# Update Varnish
apt-get update && apt-get install -y varnish
# or
yum update varnish
systemctl restart varnish

This recommendation verifies that service parameters are properly configured on the Varnish Cache HTTP accelerator. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Varnish Cache HTTP accelerator vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Varnish service configuration
systemctl status varnish
cat /etc/default/varnish 2>/dev/null || cat /etc/varnish/varnish.params 2>/dev/null

# Configure service parameters
# In /etc/default/varnish or systemd override:
ExecStart=/usr/sbin/varnishd \
  -a :6081 \
  -f /etc/varnish/default.vcl \
  -s malloc,256m \
  -p thread_pool_min=5 \
  -p thread_pool_max=500

This recommendation verifies that VCL ACLs restrict purge and admin operations on the Varnish Cache HTTP accelerator. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Varnish Cache HTTP accelerator vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check VCL ACL configuration
grep -A10 'acl' /etc/varnish/default.vcl

# Configure ACLs in VCL
# In /etc/varnish/default.vcl:
acl purge_allowed {
    "127.0.0.1";
    "10.0.0.0"/8;
}
sub vcl_recv {
    if (req.method == "PURGE") {
        if (!client.ip ~ purge_allowed) {
            return(synth(403, "Purge not allowed"));
        }
        return(purge);
    }
}

This setting ensures that the management CLI is secured and restricted on the Varnish Cache HTTP accelerator. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Varnish Cache HTTP accelerator is essential for defense in depth.

# Check admin interface security
varnishadm -T localhost:6082 status 2>&1
grep -r 'cli_timeout\|secret' /etc/varnish/

# Secure management interface
# Restrict CLI to localhost:
varnishd -T 127.0.0.1:6082 -S /etc/varnish/secret
# Set strong secret file:
openssl rand -hex 32 > /etc/varnish/secret
chmod 600 /etc/varnish/secret
chown root:root /etc/varnish/secret

This recommendation verifies that backend probes and timeouts are configured on the Varnish Cache HTTP accelerator. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Varnish Cache HTTP accelerator vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check backend connection
grep -A10 'backend' /etc/varnish/default.vcl | head -15

# Configure secure backend
# In /etc/varnish/default.vcl:
backend default {
    .host = "127.0.0.1";
    .port = "8080";
    .probe = {
        .url = "/health";
        .interval = 5s;
        .timeout = 2s;
        .window = 5;
        .threshold = 3;
    }
    .connect_timeout = 5s;
    .first_byte_timeout = 30s;
}

This setting ensures that the listening address is restricted on the Varnish Cache HTTP accelerator. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Varnish Cache HTTP accelerator is essential for defense in depth.

# Check listening address
ss -tlnp | grep varnish
grep '\-a ' /etc/default/varnish /lib/systemd/system/varnish.service 2>/dev/null

# Restrict listening address
# Bind to specific interface:
varnishd -a 10.0.1.5:6081
# Or use systemd override:
mkdir -p /etc/systemd/system/varnish.service.d
cat > /etc/systemd/system/varnish.service.d/override.conf << 'EOF'
[Service]
ExecStart=
ExecStart=/usr/sbin/varnishd -a 10.0.1.5:6081 -f /etc/varnish/default.vcl -s malloc,256m
EOF
systemctl daemon-reload && systemctl restart varnish

This recommendation verifies that NCSA access logging is enabled with rotation on the Varnish Cache HTTP accelerator. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Varnish Cache HTTP accelerator vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Varnish logging
varnishlog -d -k 5 2>/dev/null
varnishncsa -d -k 5 2>/dev/null
systemctl status varnishncsa

# Enable NCSA logging
systemctl enable varnishncsa
systemctl start varnishncsa
# Custom log format:
varnishncsa -a -w /var/log/varnish/access.log \
  -F '%h %l %u %t "%r" %s %b "%{Referer}i" "%{User-agent}i" %{Varnish:handling}x'
# Rotate logs:
cat > /etc/logrotate.d/varnish << 'EOF'
/var/log/varnish/*.log {
    daily
    rotate 30
    compress
    missingok
    postrotate
        systemctl reload varnishncsa
    endscript
}
EOF

This recommendation verifies that VSL retention and monitoring are configured on the Varnish Cache HTTP accelerator. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Varnish Cache HTTP accelerator vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check VSM/VSL configuration
varnishstat -1 | head -10
ls -la /var/lib/varnish/

# Configure VSL retention
# In varnishd params:
-p vsl_space=80M
-p vsm_space=1M
# Monitor cache hit rate:
varnishstat -f MAIN.cache_hit -f MAIN.cache_miss

This recommendation verifies that security headers are added and server info is removed on the Varnish Cache HTTP accelerator. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Varnish Cache HTTP accelerator increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check VCL security headers
grep -E 'set resp.http|unset resp.http|X-|Server' /etc/varnish/default.vcl

# Add security headers in VCL
sub vcl_deliver {
    # Remove server identification
    unset resp.http.X-Powered-By;
    unset resp.http.Server;
    unset resp.http.Via;
    unset resp.http.X-Varnish;
    # Add security headers
    set resp.http.X-Content-Type-Options = "nosniff";
    set resp.http.X-Frame-Options = "DENY";
    set resp.http.Strict-Transport-Security = "max-age=31536000; includeSubDomains";
    set resp.http.Referrer-Policy = "strict-origin-when-cross-origin";
}

This recommendation verifies that dangerous requests and methods are filtered on the Varnish Cache HTTP accelerator. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Varnish Cache HTTP accelerator vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check request filtering
grep -E 'req.method|req.url|return.*synth' /etc/varnish/default.vcl

# Filter dangerous requests in VCL
sub vcl_recv {
    # Allow only safe methods
    if (req.method !~ "^(GET|HEAD|POST|PUT|DELETE|OPTIONS)$") {
        return(synth(405, "Method not allowed"));
    }
    # Block access to sensitive paths
    if (req.url ~ "^/(admin|wp-admin|phpmyadmin)") {
        if (!client.ip ~ admin_allowed) {
            return(synth(403, "Forbidden"));
        }
    }
    # Limit request size
    if (req.http.Content-Length ~ "[0-9]{8,}") {
        return(synth(413, "Request too large"));
    }
}

This setting ensures that VCL and secret file permissions are restricted on the Varnish Cache HTTP accelerator. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Varnish Cache HTTP accelerator is essential for defense in depth.

# Check VCL file permissions
stat -c '%a %U %G' /etc/varnish/default.vcl
find /etc/varnish -type f -exec stat -c '%a %U %G %n' {} \;

# Restrict VCL and config permissions
chown root:root /etc/varnish/default.vcl
chmod 644 /etc/varnish/default.vcl
chmod 600 /etc/varnish/secret
chmod 750 /etc/varnish

This setting ensures that working directory permissions are restricted on the Varnish Cache HTTP accelerator. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Varnish Cache HTTP accelerator is essential for defense in depth.

# Check working directory permissions
stat -c '%a %U %G' /var/lib/varnish
find /var/lib/varnish -maxdepth 1 -exec stat -c '%a %n' {} \;

# Restrict working directory
chown -R varnish:varnish /var/lib/varnish
chmod 750 /var/lib/varnish
chmod 750 /var/log/varnish

This recommendation verifies that sensitive content is excluded from caching on the Varnish Cache HTTP accelerator. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Varnish Cache HTTP accelerator vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check cache policy
grep -E 'beresp.ttl|beresp.grace|beresp.keep|hash_data' /etc/varnish/default.vcl

# Configure secure cache policy
sub vcl_backend_response {
    # Don't cache sensitive content
    if (bereq.url ~ "^/(api/auth|login|account)") {
        set beresp.uncacheable = true;
        return(deliver);
    }
    # Set reasonable TTLs
    set beresp.ttl = 1h;
    set beresp.grace = 6h;
    # Strip cookies from static content
    if (bereq.url ~ "\.(css|js|png|jpg|gif|ico)$") {
        unset beresp.http.Set-Cookie;
    }
}

This recommendation verifies that resource limits are configured for the service on the Varnish Cache HTTP accelerator. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Varnish Cache HTTP accelerator vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check resource limits
systemctl show varnish | grep -i 'limit\|memory'
ulimit -n

# Configure resource limits
mkdir -p /etc/systemd/system/varnish.service.d
cat > /etc/systemd/system/varnish.service.d/limits.conf << 'EOF'
[Service]
LimitNOFILE=131072
LimitMEMLOCK=82000
EOF
systemctl daemon-reload && systemctl restart varnish