Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using Debian 4.3.2-1 and Apache 2 on my production server. Watching the logs, I noticed Apache is resolving client's hostnames even with HostnameLookups Off in apache2.conf. I want to avoid these lookups so I'm guessing Apache is making this DNS query because I have mod_authz_host enabled. When I try to unlink this module, I get several modules complaining because they use the Order directive.

How is the clean way to go? Should I comment all Order directives like

Order allow,deny
Deny from all

Is this the only way to stop Apache from making DNS requests? I would like to deny access to .htaccess files and some rules like that.

share|improve this question

1 Answer 1

mod_authz_host will only perform DNS lookups, if you actually use domain names in any Allow/Deny directive (and then this will happen irrespective of the HostnameLookups setting). So if you don't want those DNS lookups happening, get rid of the domain-name based authorisation config, if that's at all possible.

share|improve this answer
    
Does 'Allow from localhost' perform a lookup? I have only 'All', 'None' and localhost names in my directives. Thank you very much for your help. it's nice i can keep the module working. –  odeceixe Jul 22 '10 at 15:02
    
Most likely, yes, but this lookup won't be costly (assuming you have an entry for localhost in /etc/hosts). But if that bothers you, better use Allow from 127.0.0.1 instead (also add ::1 if you have IPv6 enabled). –  earl Jul 22 '10 at 15:46
    
thank you earl, i think my problem was LogFormat using %h, which to my surprise forces a dns lookup ignoring HostNameLookup. Wonder why debian's apache 2 has %h on default config when it's rarely needed... LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined i found it here betabug.ch/blogs/ch-athens/933 –  odeceixe Jul 22 '10 at 18:56
    
I doubt that's really the problem. %h is in Apache's default LogFormat alongside HostnameLookups switched off. I also use %h on many of my hosts with hostname lookups turned off (mostly Apache 2.2.9 on Debian Lenny), and don't see any resolved IPs in my logfiles. But if using a different LogFormat fixes things for you, it's great. –  earl Jul 22 '10 at 20:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.