I would suggest you to read my answer of the question I need rules to drop some malicious Apache, where is explained how to download and configure OWASP ModSecurity Core Rule Set 3.x
.
However, here is simple example of the rule that you are asking for:
# Deny requests without a host header
#
SecRule &REQUEST_HEADERS:Host "@eq 0" \
"id:160, phase:2, log, drop, deny, status:403, \
tag:'requests-without-host-header'"
The most important thing in the above rule is the parameter phase:2
, thus the access will be denied before the response, but you will be able to white-list the rule at certain circumstances (if you need that) on phase:1
. You can use nolog
, also the final result of drop
, deny
and status:403
is almost identical and you can decide to leave only one of these three arguments.
Checkout rule id:160
in my repository pa4080/www-security-assistant
for more complex example. Also you may want to read the section Missing/Empty Host Header
in REQUEST-920-PROTOCOL-ENFORCEMENT
from SpiderLabs/owasp-modsecurity-crs 3.x
.
sudo a2dissite default
or comment all directive inside virtualhost defined in '/etc/apache2/sites-available/default.conf'. After restart your apache.