subdomain or invalid domain goes to wrong place

[baxterdmutt]

Hi, Please please help!
I have 3 domains. All under the admin user.
I have tried creating a subdomain (for roundcube webmail) and it always takes me to the first domain I created on Vestacp. It doesn't matter what the directory I use is it will always take me to the index page of example.com.
If I try and enter an invalid subdomain on example.com, example2.com or example3.com (ie bad_sub.example2.com) I'm always taken to example1.com/index.html
This is a problem because someone recently pointed their domain to my domain (without my permission) and VESTACP is serving up example.com To stop this I temporarily created a site with their domain name and pointed it to an empty domain.
This isn't a permanent solution. I wonder how many others might have this problem and have just never noticed.

Please help.

[baxterdmutt]

I wonder if this is a BUG because, I'm not he only one that noticed this:
viewtopic.php?f=11&t=17021

[baxterdmutt]

Ok, So this isn't a bug, but VESTA is poorly configured out of the box IMHO. There is no default website and so if someone points their site to my IP they would be served a page. This should not happen. An error page should have been served.

Apache serves the sites in alphabetic order of the .conf files. Putting a 000-default.conf and a 000-default.ssl.conf in the /etc/apcahe2/conf.d/ directory solves this problem on Debian8. The contents of the 2 files are only:
<VirtualHost your_ip:your_port>
DocumentRoot /var/web/html/
<Directory /var/web/html>
</Directory>
</VirtualHost>
Adjust your IP and your ports - one for SSL and one for non-SSL.
Any attempt to access a non existent hostname or subdomain will now results in a 404 error, as it should have.

[head]

if we use DocumentRoot /var/www/html/ instead of DocumentRoot /var/web/html/ we can use default Vesta page "It's alive". Nice and easy to customize.
But.
It works for http and doesn't for https - still trying to open other site. Any ideas?

[sysdop]

If you try to open another site it is because the configuration is duplicated, check in vesta.conf via /etc/httpd/conf.d or /etc/apache2/conf.d directory.