0

Ubuntu 12.04 LTS.

Hi, when I ping two specific domain names (I'll just call them foo.net and foo.org) they both resolve to my localhost. I am on my home network and resolve.conf has 127.0.0.1 as name server. It's also only my host that has this problem, my VMs and brothers machine don't resolve the name at all.

Also, when I type foo.net or foo.org into my browser, it sends me to my local apache server root. I tried other random names but only those two are resolving to localhost, everything else seems to work normal.

/etc/hosts and /etc/resolv.conf look normal, although I'm not an expert on either. Dig shows the correct DNS server and the answer comes out to my loopback address. Tracepath completes at localhost with one hop.

Not sure what's going on.

5
  • A lot of sites were recently mysteriously re-assigned to localhost, Google, or similar. Most likely - as you probably have, uhm, "good reason" not to share the links, these sites were among them.
    – user98085
    Jun 14, 2013 at 12:28
  • What are the outputs of dnsdomainname and hostname?
    – douggro
    Jun 14, 2013 at 12:28
  • ping foo.net or foo.org ....show you the ip ..check the ip
    – Qasim
    Jun 14, 2013 at 12:30
  • @FEichinger If those sites were one of those that were re-assigned to localhost, would I have the same behavior on other machines pinging those sites? It's only affecting my host machine but not my VMs.
    – jorzo
    Jun 15, 2013 at 0:29
  • @douggro Output of dnsdomainname is blank, and output hostname is my correct hostname.
    – jorzo
    Jun 15, 2013 at 0:32

1 Answer 1

2

This isn't a security problem. It's perfectly possible for anyone to set up any domain name and have its A record point to 127.0.0.1, or a CNAME to localhost or localhost.localdomain.

If you have a security problem, it is due to an assumption that others cannot do this. Nothing should rely on this assumption, since they can.

A DNS entry can point to anything.

5
  • Aren't there any tools that let us check if the answer we got is from files or the dns? I'm starting with ubuntu so I don't know.
    – Kitet
    Jun 14, 2013 at 12:34
  • @Kitet You can never really rely on this. It's better to keep all requests at a low level of trust..
    – nanofarad
    Jun 14, 2013 at 12:38
  • Checking where you got the answer from would be fragile security indeed. Perhaps it would help if you edited your question to explain why exactly this is a problem for you, and then the community can suggest how you should be designing your system securely given your situation. Jun 14, 2013 at 12:52
  • @RobieBasak But my dns server is just my home router and when I do a tracepath to those domain names, it stops with one hop at localhost and doesn't leave my home network.
    – jorzo
    Jun 15, 2013 at 0:40
  • @RobieBasak Nevermind my previous comment. I think I understand now. Is it because some DNS server on the internet is just responding with an answer of 127.0.0.1 so my host ends up pinging itself? Thanks for the answer.
    – jorzo
    Jun 15, 2013 at 1:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.