0

For easy allow or disallowing of dynamic IP-adresses you can add them as a hostname in a .htaccess file.

As I have read from: .htaccess allow from hostname?

it does a reverse lookup on the connecting ip address, seeing if the response matches the allowed name.

(Well, actually Apache is doing a double lookup, first a reverse lookup and then a forward lookup on the result of the reverse.)

This is the reason we are currently not using dynamic-ip hostnames in the .htaccess: this "sounds" quite heavy: 2 extra lookups for every request.

  • Is this indeed quite heavy, and would a reasonably busy server that is rather looking for less then more load get away with this :)? (e.g.: how does this 'load' compare to the rest? If a request is 1000 times more expensive then the lookups it might be negligible. otoh, it could be that final straw :) )
  • Are there other solutions? I can write a script that does a lookup of the hostname and put it in .htaccess files ofcourse, but this feels a bit like a hack.
Improve this question

2 Answers 2

Reset to default
1

Just using .htaccess itself is a performance-killer. When AllowOverrides is on in any fashion in the Apache global config, httpd has to look for a .htaccess file at every directory level of the URI on every request, in case there is something there it needs to read. This amounts to a lot of extra lstat() calls that add latency and increase the amount of work the server has to do. Maybe you're stuck with .htaccess because of a shared hosting setup, but then you can't really get "high performance" anyway... ;)

Setting aside that DNS isn't the greatest indicator, what is your goal in disallowing "dynamic" IP addresses? This would be something better suited to an application firewall-- something sitting in front of your Apache server(s) doing the IP inspection, possibly by checking a blacklist, possibly using a local DNS resolver.

Improve this answer
6
  • We are using .htaccess to block access to some deeper lying "poweruser only" directory-structures. So not all calls would go there luckily. To be more clear: we would use 1 or 2 dynamic adresses to especially ALLOW them, and the rest will be blocked. I don't know if and how this could be easily done by firewall, as we do not want customers to be blocked completely of course ;). We are not stuck in shared hosting btw.
    – Nanne
    Jun 21, 2011 at 6:40
  • OK, so move that config into the main httpd.conf inside a <Directory> directive (or use an Include if you need to programmatically update the file) and set "AllowOverride None" from / on down. That will eliminate one source of slowness at least.
    – eirescot
    Jun 24, 2011 at 14:42
  • You can use includes in a directory directive? For instance, if I have 2 "certain ip's only" directories, I could make one file that containts the AllowOverride etc and include that in several dirs? That would be great :) ..
    – Nanne
    Jun 24, 2011 at 16:42
  • Yes. See the context list for the Include directive: httpd.apache.org/docs/2.2/mod/core.html#include
    – eirescot
    Jun 26, 2011 at 11:51
  • Have you considered using authentication for these areas instead, since your audience for them is so limited?
    – eirescot
    Jun 26, 2011 at 12:16
0

Problem with hostnames is that server process hangs up while doing DNS lookup so the slower it is, the more it affects server. If you see no problems with more apache childs in memory it would not be a big deal (in extreme but not likely cases of very slow lookups you may even run out of MaxClients number), but if you are limited consider using script to update IPs in .htaccess it or something like that.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .