Hacker News Reader

Comment by cesarb | Hacker News Reader

That's why I recommend always pointing the default virtual host in the apache or nginx configuration to an empty static site, and making the real site visible only as a named virtual host (requiring the correct Host header), even when the server will be used only for a single site. Most of these automated exploit attempts will never send the correct Host header, and therefore will only see the default virtual host.

View on HN

With nginx I also set the return code to 444 on the default virtual host, this is not a real status code but instead tells nginx to kill any connections to this vhost at the TCP level.

I have used a default host with a self signed certificate and 444 for while. One advice was to make it support only the NULL cipher, but I did not succeed to do that, don't remember the details now.

However, many scanners still end with a full 400. Either their implemenations are so bad or they intentionally send corrupted requests to try to exploit some vulnerability. I have not digged any deeper.

for https, since 1.19.4 you can reject the tls handshake early https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_...

Could you give a pointer to more info on that? I couldn't find more details on such a setup while googling it.

When configuring apache or nginx, one of the virtual hosts you configure is the "default" virtual host, used when the Host header didn't match any of the virtual hosts. IIRC, on nginx, you explicitly say on the virtual host "this is the default", while on apache, it's either the first or the last (forgot which one).

How to configure that virtual host is up to you; the simplest configuration would be to point its document root to an empty directory, and add a couple of access control directives to deny access to it from all IP addresses.

I think this is the (only) place in the Nginx docs that mentions 444: https://nginx.org/en/docs/http/ngx_http_rewrite_module.html#...

Really? I see plenty of automated exploit attempts against my vhosts.

It works quite well when your hostname is private / not well known.

The bots show up within minutes of you getting a non-wildcard TLS cert because of the certificate transparency logs.

Fail2van with some good nginx filters to ban scans works really well

Reply on news.ycombinator.com