Default Page still accessible after a2dissite 000-default.conf

Question

I have a brand-new installation of Ubuntu 16.04 LTS Server (32bit) with enabled LAMP packages. Which means out of the box, it serves the typical Apache2 Ubuntu Default Page on port 80, located under /var/www/html/index.html.

One of the first things I did was to try and disable that page, using the venerable

sudo a2dissite 000-default.conf

command, which prompted me to do

service apache2 reload

which I also called with sudo.

To my surprise, after that, the site is still accessible: Re-loading and shift-reloading in Firefox still shows the page and I can see the requests in /var/log/apache2/other_vhosts_access.log.

Running the a2dissite command again shows Site 000-default already disabled and the directory /etc/apache2/sites-enabled/ is empty.

What am I doing wrong?

EDIT:

As for the suggestions by Julius Š., I also tried

sudo service apache2 restart

with the same result and checked my /etc/apache2/apache2.conf file, which shows <VirtualHost> only in some comments.

Regarding <Directory> entries, these are just the defaults in the file:

<Directory />
        Options FollowSymLinks
        AllowOverride None
        Require all denied
</Directory>

<Directory /usr/share>
        AllowOverride None
        Require all granted
</Directory>

<Directory /var/www/>
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
</Directory>

#<Directory /srv/>
#       Options Indexes FollowSymLinks
#       AllowOverride None
#       Require all granted
#</Directory>

Could it be some plugins searching in /var/www/ subfolders for suitable html files?

EDIT 2:

I also rebooted the machine, the site is still accessible.

Only stopping the service makes it become inaccessible. Since I plan to run other sites on it, I will eventually need to have it running, so I am really curious what's going on.

EDIT 3:

As I found in this answer on SO, the virtualhost settings from the config file can be displayed as follows:

. /etc/apache2/envvars
apache2 -S

...which in my case, outputs the following:

AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message
VirtualHost configuration:
ServerRoot: "/etc/apache2"
Main DocumentRoot: "/var/www/html"
Main ErrorLog: "/var/log/apache2/error.log"
Mutex mpm-accept: using_defaults
Mutex watchdog-callback: using_defaults
Mutex default: dir="/var/lock/apache2" mechanism=fcntl 
PidFile: "/var/run/apache2/apache2.pid"
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
User: name="www-data" id=33 not_used
Group: name="www-data" id=33 not_used

I got a bit suspicious about the DocumentRoot entry pointing to /var/www/html, so I did a

find |xargs grep DocumentRoot 2>/dev/null

within the /etc/apache2 folder, which led to the following:

./sites-available/default-ssl.conf:     DocumentRoot /var/www/html
./sites-available/000-default.conf: DocumentRoot /var/www/html

...so nothing in any of the *-enabled/ subfolders containing that string. I really wonder where Apache gets the DocumentRoot from when nothing seems to be enabled.

Answer 1

DocumentRoot has a default value that's used if it is not set. That would mean that Apache would serve out of some directory even if DocumentRoot was not set anywhere in the configuration.

For the upstream Apache source, that is /usr/local/apache/htdocs, but the Ubuntu packaging overrides that with --enable-layout=Debian. That is presumably why it continues to serve with /var/www/html as DocumentRoot. If you just want it to stop loading that page, make it inaccessible to the www-data user by changing permissions, or set DocumentRoot to some other directory.

Answer 2

I had some difficulties with muru's answer and found a different solution. Unlike fkraiem's comment, I wanted to setup a VPS for a non-port-80 secure proxy and added the virtual site conf file to do so.

Commenting out the Listen 80 line from /etc/apache2/ports.conf removed access to the default apache success page.

#Listen 80

Which is fine, assuming you have added Listen <secure-port-number> to the top of your virtual site conf file.

systemctl restart apache2 or possibly systemctl reload apache2 is then required as per usual.

Answer 3

Since I plan to run other sites on it ...

As soon as you create one or more virtual hosts (and keep the default host disabled), one of these virtual hosts will be taken as default host. Which of your vhosts is used in that case may appear a bit random, though it isn't really: enabled host configurations are read in alphabetical order and for each port (i.e., separately for port 80 and port 443 if you use the standard ports for http and https), the first virtual host encountered this way will play the role of default host.

So if you later have BBB.conf defining www.foo.example for port 80 and CCC.conf defining www.bar.example for port 443 and DDD.conf defining www.baz.example for both 80 and 443, then apache2 -S will tell you that www.foo.example is default for port 80 and www.bar.example is default for port 443. Unless the latter is equipped with a wildcard certificate, this may not be particularly useful, and the preference of www.foo.example for port 80 is probably unwanted (or if it is wanted, do not be surprised is later adding AAA.conf changes this).

Therefore my suggestion is to keep the default host (which has a config file name that is purposefully early in the alphabet) and change its content to display a useful default page or change permissions to it to display a useful error page. (Do not simply delete /var/www/html/index.html because by default that will leave you with a certainly unwanted directory listing as start page).