Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a redmine server running on ubuntu. I also host an svn repository on the same server.

The svn virtual directory has authorization restrictions per user, but I want to allow the redmine application to be able to access it without providing username.

So, I have put: "Allow from 10.10.10.10", which is the external IP of the server, and it works OK.

But I would like to put the real host name there, and not the external IP.

 
# dnsdpmainname
mydomain.com
# hostname
myserver.mydomain.com
# ping myserver
PING myserver.mydomain.com (10.10.10.10) ... works

BUT ..

# ping myserver.mydomain.com
PING myserver.mydomain.com (127.0.1.1) ... also works, but different IP

I have tried to use both myserver and myserver.mydomain.com in the "Allow from" directive, but none of this works.

I guess the problem is somewhere in the fact that myserver and myserver.mydomain.com resolve to different IPs - one to the external IP, and one of some internal.

Any idea how to fix this? I'd prefer to use a hostname in the Allow directive, and not the IP address (which in theory may change).

Thanks

share|improve this question

1 Answer 1

up vote 1 down vote accepted

127.0.0.1 is the so called loopback address which every host has and which doesn't change. Typically it has the associated hostname localhost. The only exception to this rule is when you have IPv6. Its defined localhost address is ::1, most of the time in addition to the IPv4 address.

You should make sure that the address is actually 127.0.0.1 and not the one you stated. While this works too, it will create some hard to debug issues. Have a look into your /etc/hosts file which configures these mappings. And just as a tip: you should never let actual server-names point to 127.0.0.1, only to external IPs. This makes things easier to run and to debug.

I personally have Redmine/ChiliProject typically setup with a special virtual host bound to localhost which provides the unauthenticated access. Another (probably even faster) alternative would be to not use http:// URLs in Redmine but to use file:// URLs and skip the webserver altogether here.

Having said all that, once you have your name resolution properly setup, you can state names in the Apache configuration. Though requires that the reverse-name resolution actually works, i.e. the system is able to resolve IP addresses back to names. This is the case for entries in '/etc/hosts` and for properly setup DNS servers.

If you do this however, you implicitly trust the DNS system to not lie to you which might not be the case. Generally, inserting IPs is the safer choice. And with a bit of documentation this shouldn't hurt too much. Public server IPs don't change that much :)

share|improve this answer
    
Thanks, but ... I'd like to use a real host name, so in case I move the redmine server somewhere else, it still has access w/o authorization. Also, I'm aware of 127.0.0.1, but it appears I have an entry for 127.0.1.1 in /etc/hosts as well (maybe this is ubuntu/webmin thing). So the question stays, how to use the real domain name, and not "localhost" or ip. –  Sunny Jun 22 '11 at 20:15
    
I appended my answer. The gist of it: don't. And you should really fix your /etc/hosts. Nobody expects a localhost IP of 127.0.1.1. This is probably a typo which will stab you in the back sometime. –  Holger Just Jun 22 '11 at 20:21
    
Gahh, looks like I'm wrong. Apache does a double lookup, first a reverse and then a forward. Only if both match, the host will be allowed. This calls for one more edit... –  Holger Just Jun 22 '11 at 20:23
    
The line "And just as a tip: you should never let actual server-names point to 127.0.0.1" is the saver here :). –  Sunny Jun 22 '11 at 20:26
    
Also, these are internally hosted servers, no public access, so no problems with the names. And the reverse lookup should help :). Thanks. –  Sunny Jun 22 '11 at 20:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.