Apache answers request it shouldn't

Question

I have the following 2 domain records

website.com 10.0.0.1
www.website.com 10.0.0.1

I have(had) the following 2 Virtualhosts

#note how the IP address is wrong
<VirtualHost 10.0.0.2:80>

    ServerName website.com
    Redirect / http://www.website.com

</VirtualHost>

<VirtualHost 10.0.0.1:80>

    ServerName www.website.com
  #note how there is no alias here
    DocumentRoot /var/www/www.website.com

    <IfModule mpm_itk_module>
            AssignUserId www-website www-website
    </IfModule>

    CustomLog /var/log/apache2/www.website.com-access.log combined
    ErrorLog /var/log/apache2/www.website.com-error.log

</VirtualHost>

<VirtualHost 10.0.0.1:443>
    ServerName www.website.com

    DocumentRoot /var/www/www.website.com

    <IfModule mpm_itk_module>
            AssignUserId www-website www-website
    </IfModule>

    SSLEngine On
    SSLCertificateFile /etc/apache2/ssl/www.website.com

    CustomLog /var/log/apache2/www.website.com-ssl-access.log combined
    ErrorLog /var/log/apache2/www.website.com-ssl-error.log

</VirtualHost>

I expected that a request to http://website.com would be returned with a 404. However it was served as if it was delivered from http://www.website.com. Why?

Answer 1

LazyOne is exactly right. As long as you have your NameVirtualHost directives sorted out, then the first VirtualHost defined for the ip address requested is used, if no other ServerName or ServerAlias matches exist.

Therefore, if you want to serve a 404 for each ip address that doesn't hit a host header match, create a VirtualHost (per ip) without a ServerName or ServerAlias directive, and position it in the config so that it is loaded first. Something like:

<VirtualHost 10.0.0.1:80>
    Redirect 404 /   
</VirtualHost>

<VirtualHost 10.0.0.2:80>
    Redirect 404 /   
</VirtualHost>

<VirtualHost 10.0.0.2:80>
    ServerName website.com
    Redirect / http://www.website.com
</VirtualHost>

<VirtualHost 10.0.0.1:80>
    ServerName www.website.com
    #note how there is no alias here
    DocumentRoot /var/www/www.website.com
...
</VirtualHost>

Update: Most of the following is cribbed from the apache2 docs, here and here.

The main config file, generally named httpd.conf, is loaded first. But if you're using a binary package on a debian-based system, there's a good chance it'll be called apache2.conf. Other config files are added using the Include directive in the main config. Multiple uses of the Include directive are allowed. Include directives may use fnmatch-style wildcards to load several config files at once, in alphabetical order.

To clarify further (hopefully), your main config is loaded first. As Include directives are encountered, they are loaded in the order they appear in the main config. If an individual Include uses a wildcard, each config file that matches is loaded in alphabetical order.

On a debian server, apache2.conf may look something like this:

# Include module configuration:
# ...
Include mods-enabled/*.conf

# Include all the user configurations:
Include httpd.conf

# Include ports listing
Include ports.conf

# ...

# Include generic snippets of statements
Include conf.d/

# Include the virtual host configurations:
Include sites-enabled/

In other words, any file ending in .conf in mods-enabled/ is loaded before httpd.conf, which is loaded before ports.conf, which is loaded before any file in conf.d/, etc.