1

Scenario: example.com, a.example.com, and b.example.com all resolve to the IP 1.2.3.4. Apache 2.4.29 on Ubuntu 18.04.1 is configured with several virtualhosts (possibly on non-standard ports); something like:

<VirtualHost *:81>
  ServerName example.com
  ...
</VirtualHost>

<VirtualHost *:81>
  ServerName a.example.com
  DocumentRoot /var/www/a
  ...
</VirtualHost>

<VirtualHost *:81>
  ServerName b.example.com
  DocumentRoot /var/www/b
  ...
</VirtualHost>

What I'd like is for requests to a.example.com and b.example.com to work as normal virtual hosts, but for requests to example.com (or to 1.2.3.4) to not get any response at all - not a 404 response, not a 5xx response, just nothing at all.

The goal is to have the virtual hosts work normally, but for anything probing the domain or the IP address to not even be aware that an HTTP server is running on that IP.

I've perused the Apache docs for the VirtualHost directive but haven't come up with anything. I've also looked at RFC 7230 and I didn't see anything obvious that would make this scenario impossible - of course a TCP session has to be established before the server knows what the client is requesting, so an attacker would know that something is listening on that port, but as far as I could tell I didn't see anything in the protocol itself that makes the server reveal that it's listening for HTTP before the client makes the request.

I'm not sure what I'm describing is possible, and even if it is, I'm not sure how valuable it would be. Input appreciated.

  • 2
    If you don’t send any response the tcp connection will eventually time out, but be kept open for as long as that takes. much better resource wise to immediately send an http protocol message to go away. 410 Gone Is particularly suitable for that. – HBruijn Sep 21 '18 at 21:35
  • 1
    nginx can do something like this (see return 444;) but Apache cannot. – Michael Hampton Sep 22 '18 at 2:47
0

Perhaps something along the lines of

RewriteEngine on
RewriteRule ^ - [L,redirect=410]

Place this in your default virtual host and every request should return a 410 error.

| improve this answer | |
  • Looks like the best option in Apache, short of the ability to drop the TCP connection like the return 444; directive does in nginx. – ras Sep 23 '18 at 3:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.