防止預設伺服器的最佳方法？

Question

我有很多虛擬主機，我想「關閉」預設虛擬主機，可以透過空白頁、錯誤頁，或一般最有效地使用 Nginx 資源的方式，同時只允許透過以下方式存取其他虛擬主機：預先定義的網域。

Answer 1

定義一個預設伺服器返回一個HTTP 444代碼：

server {
    listen      80 default_server;
    server_name _;
    return      444;
}

（傳回 4xx 錯誤代碼意味著客戶端可以將請求解釋為不成功的請求，而不是HTTP 200 空白頁面但完全有效相信我.)

對於連接埠 443 / SSL 請求，您可以使用 ssl_reject_handshake on

Answer 2

只需定義預設vhost 將指向帶有空白index.html 檔案的目錄。

server {
    listen       80 default_server;
    server_name  _ ;
    root /var/www/placeholder ; 
    index index.html;
}

並將空白索引放入 /var/www/placeholder

Answer 3

為什麼不直接否定一切

server {
    listen       80 default_server;
    server_name  _;

    location / {
        deny    all;
    }
}

Answer 4

這對於我在執行 nginx 的 Debian 10 (buster) 上的 HTTP 和 HTTPS 都有效1.18.0。

注意：我總是附加include /etc/nginx/sites-enabled/*;到使用/etc/nginx/sites-enabled` 資料夾並管理虛擬主機http的部分。/etc/nginx/nginx.conf/etc/nginx/sites-available

第 1 步：建立自簽章佔位符憑證

$ mkdir -p /usr/local/etc/ssl

$ cd /usr/local/etc/ssl

$ openssl req -new -x509 -days 1 -nodes -out default-cert.pem -keyout default-key.pem
Generating a RSA private key
.+++++
.........................+++++
writing new private key to 'default-key.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:

步驟2：建立預設虛擬主機

cat << EOF > /etc/nginx/sites-available/default
server {
    listen 80 default_server;
    listen 443 default_server ssl;

    return 444;

    ssl_ciphers aNULL;
    ssl_certificate /usr/local/etc/ssl/default-cert.pem;
    ssl_certificate_key /usr/local/etc/ssl/default-key.pem;
}
EOF

步驟 3：啟用預設虛擬主機

cd /etc/nginx/sites-enabled
ln -s ../sites-available/default default

第四步：重啟nginx