Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So I want all this on one server:

- 3 domains / websites
- SSL on one of them
- nothing to be accessed by an IP address (e.g. 'domain.com' is okay, but not by just typing '123.55.44.123' into the browser)

I am using:

- Ubuntu 12.04 LTS
- Apache

I have set these virtual hosts up and everything works perfectly for non-SSL

<VirtualHost *:80>
ServerName 123.55.33.123
DocumentRoot /var/www/random-empty-folder
<Directory />
Options FollowSymLinks
Deny from all                    # notice the deny here
</Directory>
</VirtualHost>

<VirtualHost *:80>
ServerName www.domain-one.com
ServerAlias domain-one.com *.domain-one.com
DocumentRoot /var/www/domain-one
<Directory />
Options FollowSymLinks
AllowOverride All
</Directory>
</VirtualHost>

<VirtualHost *:80>
ServerName www.domain-two.com
ServerAlias domain-two.com *.domain-two.com
DocumentRoot /var/www/domain-two
<Directory />
Options FollowSymLinks
AllowOverride All
</Directory>
</VirtualHost>

...etc. for 'domain-three'

The problem is that I can't get this configured for SSL. My standard SSL setup is this, but that allows access using the IP address. I just need to stop that:

<VirtualHost *:443>
ServerName www.domain-two.com:443
ServerAlias domain-two.com *.domain-two.com
DocumentRoot /var/www/domain-two
SSLEngine on
SSLCertificateFile /etc/apache2/ssl/apache.crt
SSLCertificateKeyFile /etc/apache2/ssl/apache.key
<Directory />
Options FollowSymLinks
AllowOverride All
</Directory>
</VirtualHost>

There's also a 'default-ssl' site/file which is disabled, so not sure if I should be doing something with that. I've tried enabling it and making changes, but mostly I run into a 'default duplicate' error.

So, based on the above setup, I just need to block access to [https]://123.55.44.123. Thanks in advance.

I do always run 'service apache2 reload' after making changes, just in case anyone is wondering.

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

Since the domain requested is in the http headers (and thus still encrypted when apache has to decide which vhost config to use) apache uses the IP and port to chose which SSL vhost config to use, not the domain name.

Edit:

I should have mentioned SNI and a couple other factors in my answer. SNI is an addition to TLS that allows servers to use multiple named virtual host configs on one IP/port combination. But since you only have one *:443 VirtualHost configuration block apache will always choose it.

What you want to do is possible, and the easiest way would be to activate default-ssl as a catchall for requests not targeted at a specific domain. I'm not quite sure what you mean by a 'default duplicate' error when activating default-ssl, the full error message might be more helpful. I could suggest naming the symlink 000-default-ssl so that any options you have in it are set first.

share|improve this answer
    
Thanks a lot, I've asked many people this question and nobody seemed to know the answer. Does this mean there's no way to block access to the server using the IP address (for SSL)? Is there any way to do that? –  user2143356 Oct 16 '13 at 23:33
    
I added some more detail to my answer, possibly 'default-ssl' is still missing some configuration/settings. –  RSchulze Oct 17 '13 at 0:03
add comment

A possible alternative, rather than blocking access, what if you forwarded any requests that come to the ip address over to your hostname? This could be done with htaccess or mod_rewrite.

RewriteEngine On  
RewriteCond %{HTTP_HOST} ^123\.55\.33\.123  
RewriteRule (.*) http://domain-one.com/$1 [R=301,L]  

I believe because the way SSL works (ip address-dependent) that you won't be able to block requests at the apache level. If you're working w PHP or such, you could have an include file that checks the $_SERVER['HTTP_HOST'] and dies if it's your ip address.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.