0

I'm using Debian 4.3.2-1 and Apache 2 on my production server. Watching the logs, I noticed Apache is resolving client's hostnames even with HostnameLookups Off in apache2.conf. I want to avoid these lookups so I'm guessing Apache is making this DNS query because I have mod_authz_host enabled. When I try to unlink this module, I get several modules complaining because they use the Order directive.

How is the clean way to go? Should I comment all Order directives like

Order allow,deny
Deny from all

Is this the only way to stop Apache from making DNS requests? I would like to deny access to .htaccess files and some rules like that.

1

mod_authz_host will only perform DNS lookups, if you actually use domain names in any Allow/Deny directive (and then this will happen irrespective of the HostnameLookups setting). So if you don't want those DNS lookups happening, get rid of the domain-name based authorisation config, if that's at all possible.

  • Does 'Allow from localhost' perform a lookup? I have only 'All', 'None' and localhost names in my directives. Thank you very much for your help. it's nice i can keep the module working. – odeceixe Jul 22 '10 at 15:02
  • 1
    Most likely, yes, but this lookup won't be costly (assuming you have an entry for localhost in /etc/hosts). But if that bothers you, better use Allow from 127.0.0.1 instead (also add ::1 if you have IPv6 enabled). – earl Jul 22 '10 at 15:46
  • thank you earl, i think my problem was LogFormat using %h, which to my surprise forces a dns lookup ignoring HostNameLookup. Wonder why debian's apache 2 has %h on default config when it's rarely needed... LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined i found it here betabug.ch/blogs/ch-athens/933 – odeceixe Jul 22 '10 at 18:56
  • I doubt that's really the problem. %h is in Apache's default LogFormat alongside HostnameLookups switched off. I also use %h on many of my hosts with hostname lookups turned off (mostly Apache 2.2.9 on Debian Lenny), and don't see any resolved IPs in my logfiles. But if using a different LogFormat fixes things for you, it's great. – earl Jul 22 '10 at 20:59

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.