2

Is there a way to configure Apache to drop connection for any request resulting in an HTTP status other than 200 (or possibly a list of status codes)? The idea is that, rather than returning any information to a hacker probing the server, just terminate the connection when an invalid request is made. I'm thinking about something similar to iptables DROP rules, but at the application layer.

I realize this would not be a substitute to other security measures (firewall, reverse proxy, mod_security, access control, non-default error pages, etc), but it would be an additional measure.

3
  • 2
    There's no point, since just dropping the connection will give your hypothetical hacker exactly the same information as simply sending a 404 would. Nov 24, 2014 at 19:36
  • 3
    Don't do that. You are going to cause lots of problems for yourself and legitimate users. And there isn't any real security benefit.
    – kasperd
    Nov 24, 2014 at 19:39
  • I think it's customary to use iptables to drop incoming connections from known-evil IP addresses. I understand that this makes it impossible for an attacker from one of those addresses to tell whether or not a server exists at all at your IP address. Why isn't that more secure than sending a 404 response, which confirms the presence of a server to attack at the IP address and port specified by the attacker, along with other headers that will give the attacker some additional information about your server? This is asking for the same feature from Apache (nginx uses status 444 to do this)
    – sootsnoot
    May 2, 2016 at 3:11

1 Answer 1

2

You could make 403 return a 404 page & status code (make sure it's both!), which would throw off people snooping around. I believe Google and many other large sites do this. However, dropping the connection after an error like this is not helpful (and can even be harmful).

5
  • Just to be clear, are you talking about something like this, using either ErrorDocument (and PHP for status) or mod_rewrite, or is there another way to do this? Nov 24, 2014 at 20:27
  • Use PHP for the status and then just copy the default 404 error page file over the 403 error file.
    – flashbang
    Nov 24, 2014 at 21:33
  • Here is a relevant question that should point you in the right direction.
    – flashbang
    Nov 24, 2014 at 21:35
  • This server is only being used as a reverse proxy, so mod_php is not currently installed to minimize the attack surface. I am thinking of trying to use mod_rewrite, but that brings up another question. Which will be less vulnerable - PHP or mod_rewrite? I think mod_rewrite, but I'm not sure. Nov 25, 2014 at 19:25
  • I'd go with mod_rewrite, just to be safe.
    – flashbang
    Nov 26, 2014 at 2:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .