[Xitami] Reverse DNS lookup........ again

Brian {Hamilton Kelly} xitami@lists.xitami.org
Tue, 31 Dec 2002 19:17:44 GMT


In message <DAV55mtYfobcd6EH71200016ed7@hotmail.com> "RPO" writes:
> 
> Under the logging section of the main configuration file there is an option:
> "Translate IP address" - I would assume that is a DNS lookup on the IP
> address.  If that is not enough then you could also toy with the "Log File
> Format" - it gives you different options (maybe the extended one) that might
> do what you are looking for.  And 3rd, the "log file format string" might
> allow you to put a DNS/Hostname variable that writes the DNS name to the log
> file.

Finally, one should think VERY carefully about recording domain names
INSTEAD of IP addresses in a log file, because at least an IP address is
traceable, whereas a rogue client might also have faked reverse DNS set
up to camouflage the source and send you off on a wild goose chase.

In short, ALWAYS record the IP address, and also, if you wish, the domain
name into which rDNS translates this.  (However, of course, any decent
log analysis program would be able to perform that rDNS operation at any
later time: after all, this is not rocket science, and I recall doing
this on FTP servers that I was administering back in the 1980s, long
before TimB-L had invented the web.)

-- 
Brian {Hamilton Kelly}                                          bhk@dsl.co.uk
    "We can no longer stand apart from Europe if we would.  Yet we are
    untrained to mix with our neighbours, or even talk to them".
                                              George Macaulay Trevelyan, 1919