Have disabled apache site config file 000-default.conf, but it still seems active. Why?

Question

I added a file mysite.conf to my apache sites-available folder with the correct settings, then enabled it and reloaded apache, and it isn't working. I want to disable the default site config as defined in 000-default.conf to see if that fixes the problem.

To achieve this I ran:

cd /etc/apache2/sites-available/
sudo a2dissite 000-default.conf
service apache2 reload

and everything appeared to work ok, however when I load mysite.com in my browser, I'm still seeing the default index.html file in /var/www/html/ (as indicated in 000-default.conf) even though I have enabled the site config file for my domain as follows:

<VirtualHost *:80>
        ServerName www.mysite.com
        ServerAlias mysite.com

        ServerAdmin webmaster@localhost
        DocumentRoot /var/www/mysite.com

        ErrorLog ${APACHE_LOG_DIR}/error_mysite.log
        CustomLog ${APACHE_LOG_DIR}/error_access_mysite.log combined

</VirtualHost>

I have a file /var/www/mysite.com/index.php that I expect should have been loaded instead.

Answer 1

Just as a matter of explanation for future users.

Your 000-default.conf file is a catch-all site and should be left alone. It is good for security. It can be frustrating when a site configuration does not work and the default site is served. I get it. Still, leave it alone. Many people are unaware of why the default site exists. Here is a bit of an explanation.

When Apache receives a request, it tries to match it to a configuration it knows about. So any request for example.com will look for a example.com.conf with a proper configuration. If there is no match, the 000-default.conf site is used. If a request for bogussite.com is seen and it does not exist on the server, then the 000-default.conf file is served. This is especially useful for IP address only requests. And we all hate those!! However, if there is an error in example.com.conf it is still possible that the 000-default.conf site is served making the exact reason why and how the configuration is failing a bit confusing and very frustrating.

I gave some sample configurations from a live server here: Virtualhost config: routing and wildcard usage

Push comes to shove, these should always work. You can cut and paste them exactly then make the necessary changes or modify your existing file(s). Your option. It is easy to go cross-eyed on this so be careful. We have all done it so you will not be alone.

@HighlyIrregular makes this point in his comments which should live.

You can always check the configuration in a shell session using...

$ apachectl configtest

... which should help troubleshoot issues.

You will need to create your new/additional site(s) in your /etc/apache2/site-available/ directory using a file format similar to example.com.conf. You will also want to make sure that /etc/apache2/apache2.conf has Include sites-enabled/ or something similar as one of the last lines.

When a change to any configuration file is made, Apache has to be restarted. Apache caches configurations in memory and changes will not be seen until it is restarted. On rare occasions, a restart does not work as expected. In this case, to rule this out as an issue, you will want to reboot your server. It is very possible that valid configurations are not seen when restarted. Not sure why. However, with a reboot, Apache is forced to re-cache the configuration files. It is like getting a bigger hammer. Well worth a try sometimes.

Answer 2

I agree with user 'closetnoc' who replied at [2015-Aug-2 00:24:36Z] in response to the original post that wrote "The 000-default.conf site is a catch-all for any request the server does not have a configuration file for".

And, I think we can make use of such 'catch-all site' as a last resort to safeguard and to enhance the overall security.

The thing I tried to do is still allow the site '000-default.conf' to be activated, but make its configuration a little bit different that to constantly drop ALL requests WITHOUT sending response and then immediately CLOSE THE CONNECTION for all prohibited access, so that nothing is responded/revealed to the attempting requestor.

Here is my '000-default.conf' file, for your reference:

<VirtualHost *:80>
    # ServerName whatsoever
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/html

    ErrorLog ${APACHE_LOG_DIR}/default_error.log
    CustomLog ${APACHE_LOG_DIR}/default_access.log combined

    <Location />
        <RequireAny>
            # Example for 'Block all':
            # Require ip 0.0.0.0/32
            Require all denied

            # Example for 'White list':
            # Require ip 172.217.24.37/32
        </RequireAny>
    </Location>

    SecRuleEngine On
    SecRule RESPONSE_STATUS "403" "phase:4,id:1,drop"
</VirtualHost>

Be reminded to install the 'ModSecurity' module so that the directives 'SecRuleEngine' and 'SecRule' can be accepted. If you require additional assistance and reference on the topic of 'ModSecurity' module, suggest you search the Internet.

Hope the above helps!

Answer 3

I have run a production Apache on FreeBSD since 1995 and recently was installing a LAMP Apache on Debian and ran across this a2dissite 000-default.conf command and so did some research. Personally, I wouldn't run it or do it this way.

I would just open the httpd.conf file and go through make changes to match your "default" site and this would be my main production site. IP addresses and hostnames should both work. If this server instance is also running HTTPS it would also contain the location of SSL certs.

In my case I have some vhosts defined in vhosts.conf and the first one there has to be the default, and is a copy of the main httpd.conf without the comments. <VirtualHost _default_:*> ServerName, ServerAlias, UseCannonicalName, ServerAdmin, DirectoryIndex, DocumentRoot, Directory, Alias, FilesMatch, and ScriptAlias. If this is running HTTPS it would also contain the location of SSL certs inside the VirtualHost container. After that define more virtual host containers each with different ServerName, ServerAliases, contact, directory, and SSL info.

I run a high volume web server that has been attacked many times so I increase the minspare maxspare, maxclients values on the not SSL instance of Apache and decrease the values on the SSL port 443 instance of apache. I copy httpd.conf to a new SSL.conf, change the port to 443 and run it with lower maxspare maxclients values as /usr/local/sbin/httpd -DNOHTTPACCEPT -f /usr/local/www/conf/SSL.conf. This is started from a perl script run from a cron every 5 minutes that won't start processes again if already running (it is an old hack but it works great). I put my SSL cert directory info in the main SSL.conf. Then I run vhosts with SSL with a ssl-vhost.conf file with the default <VirtualHost _default_:443> followed by other <VirtualHost *:443> SSL vhosts.

My advise is to configure manually so everything is configured exactly how you need it without any settings you haven't explicitly set and so not vulnerable in any ways you don't know about.