27

I have a number of vhosts, and I'd like to "turn off" the default vhost, either by blank page, error page, or generally whatever is the most efficient use of Nginx's resources, whilst only allowing other vhosts to be access via pre-defined domains.

44

Define a default_server that returns an HTTP 444 code:

server {
    listen      80 default_server;
    server_name _;
    return      444;
}

(Returning a 4xx error code means requests can be interpreted by a client as an unsuccessful request, rather an HTTP 200 Blank Page But Totally Worked Trust Me.)

| improve this answer | |
  • 2
    444 is a non-standard nginx specific code: "a special nginx’s non-standard code 444 is returned that closes the connection" – bzeaman Apr 13 '16 at 9:39
  • 2
    This does not work for https. A simple listen 443 default_server won't work either as the ssl handshake happens first of all and nginx will error before returning 444. One solution I have yet to try but should work is to create a self signed certificate for the default https server and optinally redirect to http to avoid any browser errors. – Simon Bengtsson Jul 21 '16 at 14:22
  • 1
    The nginx ticket to provide a nice way to refuse SSL connections is here. They also provide a workaround, setting ssl_ciphers aNULL;. – nh2 Jun 27 '18 at 17:26
  • 1
    Note the workaround I mentioned will break non-SNI-capable HTTPS clients (like nginx's own proxy_pass, unless you set proxy_ssl_server_name on;) from reaching any other server_names (so essentially break the legitimate server_names for port 443 that you do want to let through). See trac.nginx.org/nginx/ticket/195#comment:11 for details. – nh2 Jun 27 '18 at 22:48
  • I am not editing this in because it will only work in the recent 1.19.4 release, but ssl_reject_handshake is now available to provide better handling of the https case. – anx Nov 16 at 14:21
4

Just define default vhost that will point to directory with blank index.html file.

server {
    listen       80 default_server;
    server_name  _ ;
    root /var/www/placeholder ; 
    index index.html;
}

and place blank index in /var/www/placeholder

| improve this answer | |
  • it will catch every request that does not hit any of your domainnames and response with blank page. – wojciechz Aug 23 '12 at 9:31
  • Can't you just return ''; instead of root...index ? – oriadam Aug 23 '16 at 0:14
1

I learn this form asp.net core document

https://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/linux-nginx?view=aspnetcore-3.1#configure-nginx

server {
    listen   80 default_server;
    # listen [::]:80 default_server deferred;
    return   444;
}

You can find it in nginx document too

https://nginx.org/en/docs/http/request_processing.html

server {
    listen      80;
    server_name "";
    return      444;
}

Here, the server name is set to an empty string that will match requests without the “Host” header field, and a special nginx’s non-standard code 444 is returned that closes the connection.

| improve this answer | |
0

why not just deny all

server {
    listen       80 default_server;
    server_name  _;

    location / {
        deny    all;
    }
}
| improve this answer | |
0

This is what worked for me for both HTTP and HTTPS on Debian 10 (buster) running nginx 1.18.0.

Note: I always append include /etc/nginx/sites-enabled/*; to the http section of /etc/nginx/nginx.conf and manage vhosts using /etc/nginx/sites-available and /etc/nginx/sites-enabled` folders.

Step 1: create self-signed placeholder cert

$ mkdir -p /usr/local/etc/ssl

$ cd /usr/local/etc/ssl

$ openssl req -new -x509 -days 1 -nodes -out default-cert.pem -keyout default-key.pem
Generating a RSA private key
.+++++
.........................+++++
writing new private key to 'default-key.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:

Step 2: create default vhost

cat << EOF > /etc/nginx/sites-available/default
server {
    listen 80 default_server;
    listen 443 default_server ssl;

    return 444;

    ssl_ciphers aNULL;
    ssl_certificate /usr/local/etc/ssl/default-cert.pem;
    ssl_certificate_key /usr/local/etc/ssl/default-key.pem;
}
EOF

Step 3: enable default vhost

cd /etc/nginx/sites-enabled
ln -s ../sites-available/default default

Step 4: restart nginx

enter image description here

enter image description here

| improve this answer | |
  • Why are you manually creating a new cert? Was always having a dummy certificate already configured not the point of the ssl-cert package in debian&ubuntu? – anx Nov 16 at 14:17
  • @anx I didn't know about that... what cert (and path) do you recommend using? – sunknudsen Nov 16 at 14:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.