3 ms·
That's why I recommend always pointing the default virtual host in the apache or nginx configuration to an empty static site, and making the real site visible o
by cesarb 4y ago
That's why I recommend always pointing the default virtual host in the apache or nginx configuration to an empty static site, and making the real site visible only as a named virtual host (requiring the correct Host header), even when the server will be used only for a single site. Most of these automated exploit attempts will never send the correct Host header, and therefore will only see the default virtual host.
- semi-extrinsic 4y agoCould you give a pointer to more info on that? I couldn't find more details on such a setup while googling it.
- cesarb 4y agoWhen configuring apache or nginx, one of the virtual hosts you configure is the "default" virtual host, used when the Host header didn't match any of the virtual hosts. IIRC, on nginx, you explicitly say on the virtual host "this is the default", while on apache, it's either the first or the last (forgot which one). How to configure that virtual host is up to you; the simplest configuration would be to point its document root to an empty directory, and add a couple of access control directives to deny access to it from all IP addresses.
- derefr 4y agoI think this is the (only) place in the Nginx docs that mentions 444: https://nginx.org/en/docs/http/ngx_http_rewrite_module.html#return https://nginx.org/en/docs/http/ngx_http_rewrite_module.html#...
- jbverschoor 4y agoFail2van with some good nginx filters to ban scans works really well
- matoro 4y agoWith nginx I also set the return code to 444 on the default virtual host, this is not a real status code but instead tells nginx to kill any connections to this vhost at the TCP level.
- usr1106 4y agoI have used a default host with a self signed certificate and 444 for while. One advice was to make it support only the NULL cipher, but I did not succeed to do that, don't remember the details now. However, many scanners still end with a full 400. Either their implemenations are so bad or they intentionally send corrupted requests to try to exploit some vulnerability. I have not digged any deeper.
- zhfliz 4y agofor https, since 1.19.4 you can reject the tls handshake early https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_reject_handshake https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_...
- sbierwagen 4y agoReally? I see plenty of automated exploit attempts against my vhosts.