Issues Regarding DNS and Apache HTTP Server

Available Languages: en | + fr | + ja | + ko | + tr

+ +

This page could be summarized with the statement: don't + configure Apache HTTP Server in such a way that it relies on DNS resolution + for parsing of the configuration files. If httpd requires DNS + resolution to parse the configuration files then your server + may be subject to reliability problems (ie. it might not start up), + or denial and theft of service attacks (including virtual hosts able + to steal hits from other virtual hosts).

A Simple Example
Denial of Service
The "main server" Address
Tips to Avoid These Problems

A Simple Example

+ + +

# This is a misconfiguration example, do not use on your server
+<VirtualHost www.example.dom>
+  ServerAdmin webgirl@example.dom
+  DocumentRoot "/www/example"
+</VirtualHost>

+ + +

In order for the server to function properly, it absolutely needs + to have two pieces of information about each virtual host: the + ServerName and at least one + IP address that the server will bind and respond to. The above + example does not include the IP address, so httpd must use DNS + to find the address of www.example.dom. If for some + reason DNS is not available at the time your server is parsing + its config file, then this virtual host will not be + configured. It won't be able to respond to any hits + to this virtual host.

+ +

Suppose that www.example.dom has address 192.0.2.1. + Then consider this configuration snippet:

+ +

# This is a misconfiguration example, do not use on your server
+<VirtualHost 192.0.2.1>
+  ServerAdmin webgirl@example.dom
+  DocumentRoot "/www/example"
+</VirtualHost>

+ + +

This time httpd needs to use reverse DNS to find the + ServerName for this virtualhost. If that reverse + lookup fails then it will partially disable the virtualhost. + If the virtual host is name-based then it will effectively be + totally disabled, but if it is IP-based then it will mostly + work. However, if httpd should ever have to generate a full + URL for the server which includes the server name (such as when a + Redirect is issued), then it will fail to generate a valid URL.

+ +

Here is a snippet that avoids both of these problems:

+ +

<VirtualHost 192.0.2.1>
+  ServerName www.example.dom
+  ServerAdmin webgirl@example.dom
+  DocumentRoot "/www/example"
+</VirtualHost>

+ +

Denial of Service

+ + +

Consider this configuration snippet:

+ +

<VirtualHost www.example1.dom>
+  ServerAdmin webgirl@example1.dom
+  DocumentRoot "/www/example1"
+</VirtualHost>
+<VirtualHost www.example2.dom>
+  ServerAdmin webguy@example2.dom
+  DocumentRoot "/www/example2"
+</VirtualHost>

+ + +

Suppose that you've assigned 192.0.2.1 to + www.example1.dom and 192.0.2.2 to + www.example2.dom. Furthermore, suppose that + example1.dom has control of their own DNS. With this + config you have put example1.dom into a position where + they can steal all traffic destined to example2.dom. To + do so, all they have to do is set www.example1.dom to + 192.0.2.2. Since they control their own DNS you can't stop them + from pointing the www.example1.dom record wherever they + wish.

+ +

Requests coming in to 192.0.2.2 (including all those where + users typed in URLs of the form + http://www.example2.dom/whatever) will all be served by + the example1.dom virtual host. To better understand why + this happens requires a more in-depth discussion of how httpd + matches up incoming requests with the virtual host that will + serve it. A rough document describing this is available.

The "main server" Address

+ + +

Name-based + virtual host support requires httpd to know + the IP address(es) of the host that httpd + is running on. To get this address it uses either the global + ServerName + (if present) or calls the C function gethostname + (which should return the same as typing "hostname" at the + command prompt). Then it performs a DNS lookup on this address. + At present there is no way to avoid this lookup.

+ +

If you fear that this lookup might fail because your DNS + server is down then you can insert the hostname in + /etc/hosts (where you probably already have it so + that the machine can boot properly). Then ensure that your + machine is configured to use /etc/hosts in the + event that DNS fails. Depending on what OS you are using this + might be accomplished by editing /etc/resolv.conf, + or maybe /etc/nsswitch.conf.

+ +

If your server doesn't have to perform DNS for any other + reason then you might be able to get away with running httpd + with the HOSTRESORDER environment variable set to + "local". This all depends on what OS and resolver libraries you + are using. It also affects CGIs unless you use + mod_env to control the environment. It's best + to consult the man pages or FAQs for your OS.

Tips to Avoid These Problems

+ + +

+ use IP addresses in + VirtualHost +
+ use IP addresses in + Listen +
+ ensure all virtual hosts have an explicit + ServerName +
create a <VirtualHost _default_:*> + server that has no pages to serve

Issues Regarding DNS and Apache HTTP Server

See also

A Simple Example

Denial of Service

The "main server" Address

Tips to Avoid These Problems

Comments