0

i have an apache server running several vhosts. all of my vhosts are working great, but i came across a security hole that i need to plug.

if i go a dns entry, i get the appropriate vhost, if i go to the IP address of the server, i get the first web site that happened to be deployed. how do i lock that down so if you go to the IP address you get an error or something?

thank you.

Improve this question
2
  • 3
    This may not be nice, but why do you call this a security hole?
    – Oliver
    May 3, 2012 at 13:11
  • the simplest reason is if you hit it by IP address, the server does something that it isn't supposed to do. This type of issue i call a security hole. I don't know if its industry standard terminology, but its how i approach the issue.
    – scphantm
    May 7, 2012 at 15:02

1 Answer 1

Reset to default
5

just create a blank vhost and make sure it is the first vhost added to apache.. being the top of the file of the first file in alphabetic order.

What I do is this

<VirtualHost *:80>
    ServerName localhost
    DocumentRoot /var/www/localhost

    ErrorLog logs/localhost-error_log
    CustomLog logs/localhost-access_log combined
</VirtualHost>

So put that at the top of your list or I have all my vhosts broken out into an include directory so my filename is 

00-localhost.conf

In /var/www/localhost you can have like a empty index.html or whatever you want and all requests to the IP or hosts that are directed towards you but aren't listed in a vhost will go there.

Improve this answer
1
  • You could even use mod_redirect to have that vhost redirect to your company site on another server entirely, rather than serving an error.
    – pjmorse
    May 3, 2012 at 13:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .