0

I have two domains and one IP. Both domains listen on port 80. Also on port 443 listen one of the domains (from these two). But there is also possibility to access one of the domains only by IP. I blocked the IP on port 80 and this is fine. Problem now is, that using https (port 443) and IP anyone can access page from one of the domains. How can I separate two domains from IP access?

domain1 listens on 80 only - this is ok
domain2 listens on 80 and 443 - this is ok
IP listens on 80 and 443 but must be blocked - don't know how to set it

There is set one VirtualHost for 443, but trying the second is not accepted by apache. Everything is set on apache2 working on Raspberry Pi (Raspbian).

EDIT

What I have is:

ports.conf file:

ServerName localhost
NameVirtualHost *:80
Listen 80
<IfModule mod_ssl.c>
    NameVirtualHost *:443
    ServerName 1st_domain.pl
    Listen 443
</IfModule>

ip.addr.file:

<VirtualHost *:80>
    ServerName my.ip.address.here
    ServerAlias my.ip.address.here
    <Directory /*>
        Deny from all
    </Directory>
</VirtualHost>

1st_domain file:

<VirtualHost *:80>
    ServerName 1st_domain.pl
    ServerAlias www.1st_domain.pl
    ...
</VirtualHost>
<VirtualHost *:443>
    ServerName 1st_domain.pl
    ServerAlias www.1st_domain.pl
    ...
    SSLEngine on
    SSLCertificateFile ...crt
    SSLCertificateKeyFile ...key
</VirtualHost>

2nd_domain file:

<VirtualHost *:80>
    ServerName 2nd_domain.pl
    ServerAlias www.2nd_domain.pl
    ...
</VirtualHost>
1

If you want only one domain accessible via HTTPS, configure the virtual host listening on port 443 to only handle that domain.

The virtualhosts I would use are:

  • domain 1 on port 80: accessible by name or IP address (also handles all invalid domains)
  • domain 2 on port 80: accessible only by name
  • domain 2 on port 443: responds to all HTTPS requests

You can use a default domain on port 443 using the ssl keys for the domain you are serving to catch requests for other domains. (If you want to host multiple HTTPS domains on one IP you can use aliases on the certificate. I haven't managed to get certificate negotiation to work.)

If you don't want to serve responses to requests without a Host header, create a default virtualhost and have it fail all requests. This can be done with modRewrite, or by basing the domain in a directory the server can't read.

1
  • I've posted the configuration files. Can't imagine how this should be set. As I set the files, it should be running as I need. – pbies Oct 15 '13 at 16:27
0

hard to explain without seeing your exact configs, but;

have a look at http://httpd.apache.org/docs/2.2/vhosts/examples.html which explains quite well.

# Ensure that Apache listens on port 80
Listen 80
Listen 443

<VirtualHost *:443>
DocumentRoot /www/example1
ServerName www.example.com

# Other directives here

</VirtualHost>

<VirtualHost *:80>
DocumentRoot /www/example1
ServerName www.example.com

# Other directives here

</VirtualHost>

<VirtualHost *:80>
DocumentRoot /www/example2
ServerName www.example.org

# Other directives here

</VirtualHost>
5
  • Setting this up in ports.conf gives me not working any of the domains and IP. Apache is starting, there are no errors, but apache seems to not start. – pbies Oct 15 '13 at 15:56
  • see updates to my answer, I haven't tested this config yet because my test rig is down but I will test and let you know, this should work – Sam Leach Oct 15 '13 at 16:13
  • I've read very carefully the examples before posting this question. Didn't find answers for HTTPS. Rest is set as your answer and it does not work as I would expect to. – pbies Oct 15 '13 at 16:25
  • As I can see here: wiki.apache.org/httpd/NameBasedSSLVHosts - there is no possibility to set IP+port 443 to serve other content than the domain content, because apache2 is not able to do that (last lines of this page). – pbies Oct 15 '13 at 16:34
  • I have a configuration with multiple virtualhosts using the same certificate. The certificate needs to have all the sites listed either as the primary address or aliases. If you can live with the site name warning, you can use a certificate which belongs to a different domain. – BillThor Oct 15 '13 at 21:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.