How to hide restricted nginx subdomains?

Polizi8

6/23/23, 8:06 PM

To hide a restricted location, e.g.

location /secret/ {
 allow 10.0.0.0/24;
 deny all;
}

one could set

error_page 403 =404 /404.html;
error_page 404 /404.html;

to make impossible to distinguish a non-existing location (404) from a restricted one (403).

Is there a way to perform a similar spoof for subdomains?

I want https://admin.example.org/, which normally returns 403 if not visited via VPN, to show the same of https://nonexistingsubdomain.example.org/, e.g. a .html page with a redirect to https://example.org/.

0 + 0

nginx

subdomain

spoofing

hidden

http-status-code-403

Score:0

Server

Zhivko Zhelev

6/23/23, 8:35 PM

Usually the subdomain is a different DNS record and points to a IP address(server). In your case you can create a virtual host which will handle all requests to https://admin.example.com for ex. and setup permissions there.

Take a look at this article: https://www.digitalocean.com/community/tutorials/how-to-set-up-nginx-server-blocks-virtual-hosts-on-ubuntu-16-04

0 + 0

Polizi8

6/23/23, 10:23 PM

All subdomains already point to the same host in my case, so there is no way to tell which one are active by just performing a DNS query. However if one guesses https://admin.example.com/ he sees 403 and he understand that the subdomain is actually used.

Zhivko Zhelev

6/23/23, 11:19 PM

I mean to create a new virtual host for admin.example.com and after that with htaccess file you can setup rules to access and what to if user is not authorized.