How do I serve *nothing* on a server's bare IP with Apache2 virtual hosts?

Question

I am hosting several project sites on a machine running Apache. Of course I am using virtual hosts and they work as expected. However, currently accessing the bare IP of the machine yields the first virtual host alphabetically (as to be expected). I am having trouble with malicious actors randomly (probably iterating) to my machine's IP and spamming login pages or otherwise trying to cause trouble. I would like to serve nothing to anyone who attempts to connect to the machine's IP.

I have tried a virtual host named "000-nodomain.conf" that serves a directory with a blank index.html on port 80. However I would like to eliminate the directory and have the server just respond itself with nothing and not worry about reading from disk. In the most ideal case I would want the server to refuse requests entirely that don't have a domain name, though I'm not sure if that's possible.
As a side issue, without an SSL certificate for my IP (expensive!) anyone who attempts to access the bare IP over port 443 still get served a real site as it is the first virtual host that matches port 443. Is it possible to run a "normal" http virtual host on port 443? I don't care about the end user experience for anyone who connects via bare IP, but it cannot affect any other site being served.

Answer 1

You are on the right lines with adding in an extra Virtual host to act as a default site. For security you should make sure to deny everything to this virtual host (with no exceptions):

<directory "/">
  Require all denied
</directory>

This will result in a 403 Access Denied for everything the client tries.

And it wouldn't hurt to make the document root not exist:

DocumentRoot "/does_not_exist"

This will still allow a tiny bit of disk access as Aapche will need to look for /does_not_exist, but in the event of a DOS attack that would get cached and should not affect system performance.

It certainly shouldn't allow any information to escape from your system.

---

Look into fail2ban. Specifically you should setup your default virtual host to write to a different access log file. Then you can setup fail2ban to monitor this and block any would-be attackers through the firewall. That should prevent them trying anything past the first few requests to the bare IP.

---

Regarding what to do for port 443 on the "bare IP" virtual host. Theoretically you can serve regular HTTP over any port, including port 443. However many HTTP clients will trip up on this. I think it would actually be better to generate a self-signed certificate (with whatever subject you feel like, even your IP). This lets a client expecting an HTTP server over SSL to behave correctly.

I would not re-use the certificate of any of your actual sites; this would give an attacker (bot) more information about the sites you host and may be used for them to retry with the "correct" domain name.