How to prevent host header attack in Ubuntu Server 14.04?

Question

If we send a request from any host like example.com our server gives back a HTTP 1.1 200 OK response status.

In correct condition it should show either 302, 400 or 404 error message (not found response) status. At current condition it is showing 200 OK response message, when its send through our host like xx.xxx.xx.xx.

For example, if we sent this request:

GET /web/ HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:51.0) Gecko/20100101 Firefox/51.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Connection: close
Upgrade-Insecure-Requests: 1

We get this response:

HTTP/1.1 200 OK
Date: Thu, 02 Mar 2017 15:23:20 GMT
Server: figi_Server
X-Frame-Options: deny
Strict-Transport-Security: 1
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Frame-Options: sameorigin
X-XSS-Protection: 1; mode=block

Note:

1. OS: Ubuntu 14.04.
2. Web server: Apache 2.2.
3. Virtual machine running both.

Answer 1

First, this is not an attack against your server because no harm is done on the server. And, it is not specific to Ubuntu Server version whatever but is specific to the web server and its configuration, i.e. in your case nginx with unknown configuration.

By default the web server has no idea which names are valid for your system. You have to explicitly configure which names are valid and what the server should do if no host header was given or none of the configured host headers was given. With nginx as used on your system this means to configure virtual hosts for all the names you want to accept, configure a default server to reject all requests to unknown names and maybe configure a similar server in case you want to specifically deal with empty host names.
For more details see the nginx documentation, specifically the part about "How to prevent processing requests with undefined server names".