Re: [squid-users] squid hardening - weird behaviour

On Sat, Oct 13, 2007, devzero@web.de wrote:
> > You can compile with --disable-internal-dns. That builds a fast external
> > helper that calls gethostbyname() for squid and passes the results back
> > without blocking other requests.
>
> fantastic ! i recompiled with that option and afterwards the open port is gone automatically
> without touching the .conf and now being "replaced" by 5 dnshelper processes. i assume this
> won`t probably perform as good as before, but that doesn`t matter for me.

Just a few notes:

* its slow compared to internal dns;
* it may use your nsswitch config if you've got a hosts database in something other than
  DNS (people used to stick em in NIS, for example, which I believe is the kind of
  thing the dnshelper stuff is still around for;)
* what again was the reason you absolutely, positively have to use the external helper?
* finally, a DNS resolver like bind will cache just as well as using something like
  nscd with local get*host*() type calls.

adrian

-- 
- Xenion - http://www.xenion.com.au/ - VPS Hosting - Commercial Squid Support -
- $25/pm entry-level bandwidth-capped VPSes available in WA -