0

I'm using Debian 4.3.2-1 and Apache 2 on my production server. Watching the logs, I noticed Apache is resolving client's hostnames even with HostnameLookups Off in apache2.conf. I want to avoid these lookups so I'm guessing Apache is making this DNS query because I have mod_authz_host enabled. When I try to unlink this module, I get several modules complaining because they use the Order directive.

How is the clean way to go? Should I comment all Order directives like

Order allow,deny
Deny from all

Is this the only way to stop Apache from making DNS requests? I would like to deny access to .htaccess files and some rules like that.

1 Answer 1

1

mod_authz_host will only perform DNS lookups, if you actually use domain names in any Allow/Deny directive (and then this will happen irrespective of the HostnameLookups setting). So if you don't want those DNS lookups happening, get rid of the domain-name based authorisation config, if that's at all possible.

4
  • Does 'Allow from localhost' perform a lookup? I have only 'All', 'None' and localhost names in my directives. Thank you very much for your help. it's nice i can keep the module working.
    – odeceixe
    Jul 22, 2010 at 15:02
  • 1
    Most likely, yes, but this lookup won't be costly (assuming you have an entry for localhost in /etc/hosts). But if that bothers you, better use Allow from 127.0.0.1 instead (also add ::1 if you have IPv6 enabled).
    – earl
    Jul 22, 2010 at 15:46
  • thank you earl, i think my problem was LogFormat using %h, which to my surprise forces a dns lookup ignoring HostNameLookup. Wonder why debian's apache 2 has %h on default config when it's rarely needed... LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined i found it here betabug.ch/blogs/ch-athens/933
    – odeceixe
    Jul 22, 2010 at 18:56
  • I doubt that's really the problem. %h is in Apache's default LogFormat alongside HostnameLookups switched off. I also use %h on many of my hosts with hostname lookups turned off (mostly Apache 2.2.9 on Debian Lenny), and don't see any resolved IPs in my logfiles. But if using a different LogFormat fixes things for you, it's great.
    – earl
    Jul 22, 2010 at 20:59

You must log in to answer this question.