Score:2

Rejecting requests to subdomains not explicitly configured

my flag

I am hosting a couple of site on my apache:

  • domain-x.com
  • domain-y.com
  • test.domain-y.com

Each site has its own file in sites-available. Domain-y serves to sites, one with domain-y.com and the other with test.domain-y.com.

domain-x:

<VirtualHost *:80>
  ServerName domain-x.com
  Redirect permanent / https://domain-x.com/
</VirtualHost>

<VirtualHost <ip>:443>
    DocumentRoot /var/www/<folder>
    ServerName domain-x.com
    ServerAlias "domain-x.com" "www.domain-x.com"
</VirtualHost>

domain-y:

<VirtualHost *:80>
  ServerName domain-y.com
  Redirect permanent / https://domain-y.com/
</VirtualHost>

<VirtualHost <ip>:443>
    DocumentRoot /var/www/<folder>
    ServerName domain-y.com
    ServerAlias "domain-y.com" "www.domain-y.com"
</VirtualHost>

test.domain-y.com

<VirtualHost *:80>
  ServerName test.domain-y.com
  Redirect permanent / https://test.domain-y.com/
</VirtualHost>

<VirtualHost <ip>:443>
    DocumentRoot /var/www/<folder>
    ServerName test.domain-y.com
    ServerAlias "test.domain-y.com" "www.test.domain-y.com"
</VirtualHost> 

This works fine but I would like to disable the test.domain-y.com if not needed and display a 404. If I remove the site using a2dissite and call the subdomain site "test.domain-y.com", the domain "domain-y.com" is shown instead without 404.

So I understood that I need a catch all, so I created a 00-catch.all.conf that holds these statements:

<VirtualHost *:80>
 ServerName null
 ServerAlias *
 Redirect 404 /
</VirtualHost>

<VirtualHost *:8080>
 ServerName null
 ServerAlias *
 Redirect 404 /
</VirtualHost>

<VirtualHost *:443>
 ServerName null
 ServerAlias *
 Redirect 404 /
</VirtualHost>

But if I enable the catch all then still the subdomain site is available.

Any hint?

Thanks

Score:0
iq flag

First you gonna have to make sure that catch-all is the last virtual host that Apache checks, if it is named 00-catch.all.conf as you did it should be okay, then we have to check that your catch-all virtual host covers all the necessary ports, the 80 and 443 for HTTP and HTTPS, respectively.

<VirtualHost *:80>
 ServerName default
 ServerAlias *
 Redirect 404 /
</VirtualHost>

<VirtualHost *:443>
 ServerName default
 ServerAlias *
 SSLEngine on
 SSLCertificateFile "/etc/apache2/ssl/default.crt"
 SSLCertificateKeyFile "/etc/apache2/ssl/default.key"
 Redirect 404 /
</VirtualHost>

then I assume you have a default SSL certificate for your server to handle the HTTPS requests, replace etc/apache2/ssl/default.crt and /etc/apache2/ssl/default.key with it.

AntonSack avatar
my flag
Hi, sorry that I could not answer earlier. I tried that but still, the disabled site is accessible.
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.