I have a pretty simple apache2 setup on a personal server - i.e. very little customization in the configuration file except for allow/deny rules, and I just upgraded Ubuntu versions from 8.04 - 8.10 on the machine in question. However, despite keeping the apache configuration files during the upgrade, apache now gives me "403 fobidden" if I try to access a formerly accessible web page, unless I use the local host. If I change

Allow from hostname.domain.local


Allow from 192.168.1.xxx

in the apache configuration file for the directory I'm requesting, I can access the page without a hitch.

Unfortunately my Apache skill set is not very advanced. Can anyone offer any suggestions as to why this might be happening?

Here's a few things we've tried:

  • nslookup by hostname an ip address from the affected computer (I get the expected results)
  • php -r 'echo gethostbyaddr("")."\n";' This command replied with a hostname

Ok, I found the problem: It has to do with the avahi-daemon: see bug 80900 If I disable the daemon, apache works fine. There may be a configuration file I can edit, too, but for now disabling the daemon is all I can take time to do. I'll update this question if I find a better answer!

  • 1
    avahi does MDNS. You can disable host resolution using MDNS by editting /etc/nsswitch.conf and removing mdns from the host line. – David Pashley Jun 27 '09 at 0:02

Apache's mod_access provides the "Allow from..." functionality.

For "Allow from " requirements, mod_access will do:

  • a reverse DNS lookup (IP address to hostname) on the client IP
  • a forward DNS lookup (hostname from the first lookup, to IP address)

If the reverse and forward lookups succeed and are consistent (matching hostname/IP), and the hostname in the "Allow from" part is the same (or is a suffix), you should be allowed acess.

Since your "Allow from" statement works with the IP address, but not hostname, it may be DNS related.

From your webserver, you should be able to do:

  1. dig -x 192.168.1.xxx, giving the PTR result of hostname.domain.local (or a hostname with this as a suffix)
  2. dig hostname.domain.local (or the hostname from 1.), giving the IP address as in 1.

Identifying which files/nameservers (/etc/hosts and /etc/resolv.conf, /etc/nsswitch.conf?) would be the first place to start debugging if the DNS results are not as you expect.

  • Thanks for Answering Tom! The answers to dig are normal - I got the correct host name for the first request and the proper ip address for the second. Any other suggestions? – jobu1324 Jun 26 '09 at 22:57
  • I see you found the problem, well done :) – Tommeh Jun 26 '09 at 23:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.