1

I have an Apache Web Server running some virtual hosts, site1.com and site2.com.

What do I do with requests to the server's IP address?

Is it safe to allow requests by IP or do I need block, redirect or what?

Looking my error.log I see:

[Tue Dec 12 12:30:45.211539 2017] [:error] [pid 1681] [client 18x.x1.xx1.xx1:55060] [client 18x.x1.xx1.xx1] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "793"] [id "920350"] [rev "2"] [msg "Host header is a numeric IP address"] [data "3x.x1.xx1.xx1"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "3x.x1.xx1.xx1"] [uri "/img/icon_menu_00A3E0.svg"] [unique_id "Wi-gsrgergegraRlUMAAAAE"], referer: `http://3x.x1.xx1.xx1/css/style.css`

The message I am concerned about is: msg "Host header is a numeric IP address".

migrated from security.stackexchange.com Dec 13 '17 at 10:55

This question came from our site for information security professionals.

  • "what i do with requests by ip address?" - is this a valid request? If so which site should it resolve? This depends on the use case for the server / "it's safe allow requests by ip" - Its no less safe than accepting requests with a domain as long as you know the behaviour. Would a legitimate user ever be attempting to access your site by IP? – Hector Dec 12 '17 at 13:21
  • Tks for atention @Hector, the use is a simple web application, the context is one web host with some virtualhosts with single ip, the regular users come from domain, but im not sure, what i do with request from IP and who could need access by IP... – MagicHat Dec 12 '17 at 13:37
  • if there is no use case for it i'd suggest disabling it. Alternatively if there is a primary site have it redirect to that - which helps out anyone trying to work out what an IP is. – Hector Dec 12 '17 at 13:48
  • @Hector i gona edit my question, for cleary my real doubt... – MagicHat Dec 12 '17 at 14:34
  • I'm tempted to close this as "primarily opinion based." You can do several things including blocking or redirecting. There is no right answer, it is completely up to your personal taste. At first, HTTP wasn't even host aware. It was served only based on the path. The Host heading was added in later versions of the HTTP protocol. As such, HTTP servers usually serve the main default site when there is no host header, or when the host header doesn't match one of the configured virtual hosts. Under Apache, the first configured vhost is this default one. – Stephen Ostermiller Dec 13 '17 at 12:31
2

If you have multiple virtual hosts / sites on the same server then you should either block any direct request for the server's IP address or serve some other "default" (noindex) web page, not associated with the existing sites on the server.

It wouldn't really make sense to redirect the request when you have several different sites on the server. Which site would you redirect to? And why?

These requests are not coming from real users (at least not real users you care about) or bots that are of any importance.

However, if you only have a single virtual host / site on this IP address then it makes sense to redirect, as there is no ambiguity as to which site should be served.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.