0

Ubuntu 12.04 LTS.

Hi, when I ping two specific domain names (I'll just call them foo.net and foo.org) they both resolve to my localhost. I am on my home network and resolve.conf has 127.0.0.1 as name server. It's also only my host that has this problem, my VMs and brothers machine don't resolve the name at all.

Also, when I type foo.net or foo.org into my browser, it sends me to my local apache server root. I tried other random names but only those two are resolving to localhost, everything else seems to work normal.

/etc/hosts and /etc/resolv.conf look normal, although I'm not an expert on either. Dig shows the correct DNS server and the answer comes out to my loopback address. Tracepath completes at localhost with one hop.

Not sure what's going on.

  • A lot of sites were recently mysteriously re-assigned to localhost, Google, or similar. Most likely - as you probably have, uhm, "good reason" not to share the links, these sites were among them. – user98085 Jun 14 '13 at 12:28
  • What are the outputs of dnsdomainname and hostname? – douggro Jun 14 '13 at 12:28
  • ping foo.net or foo.org ....show you the ip ..check the ip – Qasim Jun 14 '13 at 12:30
  • @FEichinger If those sites were one of those that were re-assigned to localhost, would I have the same behavior on other machines pinging those sites? It's only affecting my host machine but not my VMs. – jorzo Jun 15 '13 at 0:29
  • @douggro Output of dnsdomainname is blank, and output hostname is my correct hostname. – jorzo Jun 15 '13 at 0:32
2

This isn't a security problem. It's perfectly possible for anyone to set up any domain name and have its A record point to 127.0.0.1, or a CNAME to localhost or localhost.localdomain.

If you have a security problem, it is due to an assumption that others cannot do this. Nothing should rely on this assumption, since they can.

A DNS entry can point to anything.

  • Aren't there any tools that let us check if the answer we got is from files or the dns? I'm starting with ubuntu so I don't know. – Kitet Jun 14 '13 at 12:34
  • @Kitet You can never really rely on this. It's better to keep all requests at a low level of trust.. – hexafraction Jun 14 '13 at 12:38
  • Checking where you got the answer from would be fragile security indeed. Perhaps it would help if you edited your question to explain why exactly this is a problem for you, and then the community can suggest how you should be designing your system securely given your situation. – Robie Basak Jun 14 '13 at 12:52
  • @RobieBasak But my dns server is just my home router and when I do a tracepath to those domain names, it stops with one hop at localhost and doesn't leave my home network. – jorzo Jun 15 '13 at 0:40
  • @RobieBasak Nevermind my previous comment. I think I understand now. Is it because some DNS server on the internet is just responding with an answer of 127.0.0.1 so my host ends up pinging itself? Thanks for the answer. – jorzo Jun 15 '13 at 1:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.