0

I'm running an apache-server, with a bunch of virtual hosts for about seven domain names. Now I'd like to disallow access for clients who try to access my server using only its IP-adress. So:

  • When someone accesses my website through www.domain.com, they reach the site hosted in /var/www/domain.com/public_html/.

  • When someone enters the ip-address of the server they reach a 403 Forbidden-message.

The problem with this is that they are theoretically able to reach my other sites through bruteforce, when getting http://11.22.33.44/domain.com/public_html/.

I rather want them to reach a 403 Forbidden all the time, as long as they don't access my server by a valid domain name.

How do I solve this problem?

2 Answers 2

1

With name-based virtual hosts, the first VirtualHost to load will get all requests that don't have a host name (or that have a host name that doesn't match one that's configured).

On Debian, what you likely have is a file /etc/apache2/sites-available/default that is loading first because its link is located at /etc/apache2/sites-enabled/0-default (first alphabetically means it will load first) which is set with a VirtualHost that serves up /var/www/.

Assuming that your domain.com is served by either a different site file, or a different VirtualHost block in the same file, one good solution would be to set the default VirtualHost to no longer serve up any documents at all, and to have it instead send a redirect over to the correct DNS name. This approach will also apply the same action to any request that comes in with a host header that your system doesn't recognize:

RewriteEngine on

RewriteRule ^.*$ http://domain.com/ [R]

1

Change the default document path to something else than /var/www/. For example set default path to /var/www/forbidden/.

You can also create _default_ virtual host, which will match everything that is not matched by other virtual hosts.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .