Contents of /etc/hosts

Contents of /etc/hosts

[John Darrington]

[-- Attachment #1: Type: text/plain, Size: 3047 bytes --]

Further to discussions on #guix earlier this week ...

Some of us are concerned about what we currently have in /etc/hosts viz:

127.0.0.1 localhost gambrinus
::1       localhost gambrinus

(my machine is called "gambrinus")


This is a problem becuase it means that "hostname -f" returns the wrong thing.

Further, the man page for hostname (from the net-tools package) says:

   The  recommended  method  of  setting  the  FQDN  is  to make the hostname be
   an alias for the fully qualified name using /etc/hosts, DNS, or NIS.  For
   example, if the hostname was "ursula", one might have a line in /etc/hosts
   which reads:

   127.0.1.1    ursula.example.com ursula

However I would recommend 127.0.0.2 instead of 127.0.1.1 because RFC 3330
mentions that 127.0.0.0/8 is reserved for loopback, but the rest of
127.0.0.0/16 subject to allocation.


Many systems also have a file called /etc/hostname and  according to the hostname man page:

     /etc/hostname  Historically this file was supposed to only contain the
     hostname and not the full canonical FQDN.  Nowadays  most software is able
     to cope with a full FQDN here. This file is read at boot time by the system
     initialization  scripts to set the hostname.


Guix of course uses /etc/config.scm so we don't need /etc/hostname but there
might be some rougue programs which rely on it so perhaps we should have one.


When setting the name via the net-utils "hostname" utility,
HOST_NAME_MAX is the maximum length which can be passed to sethostname.
On Linux, this limit is 64


So security conscious programs (notably kerberos) will refuse to operate if
the forward and reverse DNS do not agree.


Some DHCP servers are configured to return the domain name which they
expect the host to use.

RFC 1034 \union 1123
stipulates that, labels may contain the characters [a-zA-Z0-9-] and \
may not start with - 

In services/base.scm we have:

(define host-name-service-type
  (shepherd-service-type
   'host-name
   (lambda (name)
     (shepherd-service
      (documentation "Initialize the machine's host name.")
      (provision '(host-name))
      (start #~(lambda _
                 (sethostname #$name)))
      (respawn? #f)))))

This will fail if /etc/config.scm has is too long, or has invalid characters.
So we should check it in system reconfigure.


So ... my recommendations:

1. We change /etc/hosts to read


 127.0.0.1 localhost.localdomain localhost 
 ::1       localhost.localdomain localhost

 127.0.0.2 gambrinus


2. We put some checks in guix system to ensure that the host-name field does not
 exceed 63 bytes (not characters) and that it conforms to the format of RFC1034


Any objections if I commit a patch to gnu/system.scm ??

J'

-- 
Avoid eavesdropping.  Send strong encrypted email.
PGP Public key ID: 1024D/2DE827B3 
fingerprint = 8797 A26D 0854 2EAB 0285  A290 8A67 719C 2DE8 27B3
See http://sks-keyservers.net or any PGP keyserver for public key.


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

Re: Contents of /etc/hosts

[Ludovic Courtès]

Hi!

John Darrington <john@darrington.wattle.id.au> skribis:

> So ... my recommendations:
>
> 1. We change /etc/hosts to read
>
>
>  127.0.0.1 localhost.localdomain localhost 
>  ::1       localhost.localdomain localhost
>
>  127.0.0.2 gambrinus

It’s not very useful to have “localhost.localdomain”, is it?  Also,
shouldn’t we keep the same address for both names?

Like:

  127.0.0.1 localhost
  ::1       localhost
  127.0.0.1 gambrinus
  ::1       gambrinus

Or am I missing something?

> 2. We put some checks in guix system to ensure that the host-name field does not
>  exceed 63 bytes (not characters) and that it conforms to the format of RFC1034

Sure, makes sense.

> Any objections if I commit a patch to gnu/system.scm ??

Send it first.  :-)

Thanks,
Ludo’.

Re: Contents of /etc/hosts

[John Darrington]

[-- Attachment #1: Type: text/plain, Size: 1715 bytes --]

On Wed, Oct 05, 2016 at 10:17:14PM +0200, Ludovic Court??s wrote:
     Hi!
     
     John Darrington <john@darrington.wattle.id.au> skribis:
     
     > So ... my recommendations:
     >
     > 1. We change /etc/hosts to read
     >
     >
     >  127.0.0.1 localhost.localdomain localhost 
     >  ::1       localhost.localdomain localhost
     >
     >  127.0.0.2 gambrinus
     
     It???s not very useful to have ???localhost.localdomain???, is it?  

Try doing this:  Put just a single line in your /etc/hosts: 
127.0.0.1 localhost
then run "hostname -d"

You will get the answer "(none)"

I'm sure that will break some applications!  

Now so long as there is also a canonical hostname in /etc/hosts this won't be
a problem.  But what about on my machine running bind?  Here all hostnames are
in the bind database and not in /etc/hosts (except for localhost).


     Also, shouldn???t we keep the same address for both names?
     
     Like:
     
       127.0.0.1 localhost
       ::1       localhost
       127.0.0.1 gambrinus
       ::1       gambrinus
     
     Or am I missing something?

Hmm.  I have never seen it done this way elsewhere, and I really wonder how some
services will react if they discover that 127.0.0.1 is not called "localhost"?  
Or that one address is known by two names.  I think it possible they might 
assume a security breach and refuse to work.  Kerberos is very fussy about such 
things.

J'

-- 
Avoid eavesdropping.  Send strong encrypted email.
PGP Public key ID: 1024D/2DE827B3 
fingerprint = 8797 A26D 0854 2EAB 0285  A290 8A67 719C 2DE8 27B3
See http://sks-keyservers.net or any PGP keyserver for public key.


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

Re: Contents of /etc/hosts

[Hartmut Goebel]

[-- Attachment #1: Type: text/plain, Size: 732 bytes --]

Am 05.10.2016 um 20:31 schrieb John Darrington:
>   (shepherd-service-type
>    'host-name
>    (lambda (name)
>      (shepherd-service

I suggest adding a comment here whether this is the bare hostname or the
FQDN.

>  127.0.0.2 gambrinus
Now what happens if you "ping gambrinus"?

-- 
Schönen Gruß
Hartmut Goebel
Dipl.-Informatiker (univ), CISSP, CSSLP, ISO 27001 Lead Implementer
Information Security Management, Security Governance, Secure Software
Development

Goebel Consult, Landshut
http://www.goebel-consult.de

Blog: http://www.goebel-consult.de/blog/feiertagsarbeit-bei-teletrust
Kolumne:
http://www.cissp-gefluester.de/2011-02-fleisige-datensammler-fur-lukratives-geschaeftsmodell-gesucht



[-- Attachment #2: Type: text/html, Size: 2033 bytes --]

Re: Contents of /etc/hosts

[Hartmut Goebel]

[-- Attachment #1.1: Type: text/plain, Size: 2319 bytes --]

Am 06.10.2016 um 02:57 schrieb John Darrington:
>        127.0.0.1 localhost
>        ::1       localhost
>        127.0.0.1 gambrinus
>        ::1       gambrinus
>      
>      Or am I missing something?
>
> Hmm.  I have never seen it done this way elsewhere, and I really wonder how some
> services will react if they discover that 127.0.0.1 is not called "localhost"?  
> Or that one address is known by two names.  I think it possible they might 
> assume a security breach and refuse to work. 

This should not be a problem. One could always add several entries for
the same IP-address. And "getent hosts 127.0.0.1" will return the first
entry in /etc/hosts AFAIKT.

I started digging through the man pages, but did not finish. It's a deep
maybe recursive mess of documentation where nothing is said about  Maybe
we need to refer to the gethostbyname(2) and gethostbyname(3)
documentation, which both are listed in "man hostname".

* gethostbyname(2) [1], uses uname[2], which returns what ever has been
set with sethostname (AFAICT) and always returns a single string.

* gethostbyname(3) [3] returns a structure capable to hold an name,
several aliases, and several addresses.

Nevertheless my conclusion is that any program should be able to handle
any ip-address and and hostname and must not rely on any assumtion
regarding these. (Exept perhaps to assume "localhost" is defined.)

[1] http://man7.org/linux/man-pages/man2/gethostname.2.html
[2] http://man7.org/linux/man-pages/man2/uname.2.html
[3] http://man7.org/linux/man-pages/man3/gethostbyname.3.html
[4] http://man7.org/linux/man-pages/man5/hosts.5.html

> Kerberos is very fussy about such things.

Yes, it is, forward and backward resolution must match. But this can be
done with a the hostname's non-loopback IP-address being in front of the
loopback entry. ASAIK


-- 
Schönen Gruß
Hartmut Goebel
Dipl.-Informatiker (univ), CISSP, CSSLP, ISO 27001 Lead Implementer
Information Security Management, Security Governance, Secure Software
Development

Goebel Consult, Landshut
http://www.goebel-consult.de

Blog: http://www.goebel-consult.de/blog/feiertagsarbeit-bei-teletrust
Kolumne:
http://www.cissp-gefluester.de/2011-02-fleisige-datensammler-fur-lukratives-geschaeftsmodell-gesucht



[-- Attachment #1.2: Type: text/html, Size: 4171 bytes --]

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 2430 bytes --]

Re: Contents of /etc/hosts

[John Darrington]

[-- Attachment #1: Type: text/plain, Size: 717 bytes --]

On Thu, Oct 06, 2016 at 11:24:57AM +0200, Hartmut Goebel wrote:
     Am 05.10.2016 um 20:31 schrieb John Darrington:
     >   (shepherd-service-type
     >    'host-name
     >    (lambda (name)
     >      (shepherd-service
     
     I suggest adding a comment here whether this is the bare hostname or the
     FQDN.
     
     >  127.0.0.2 gambrinus
     Now what happens if you "ping gambrinus"?
     
ICMP packets will be sent to the local host.

J'
     
     

-- 
Avoid eavesdropping.  Send strong encrypted email.
PGP Public key ID: 1024D/2DE827B3 
fingerprint = 8797 A26D 0854 2EAB 0285  A290 8A67 719C 2DE8 27B3
See http://sks-keyservers.net or any PGP keyserver for public key.


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

Re: Contents of /etc/hosts

[John Darrington]

On Thu, Oct 06, 2016 at 12:07:37PM +0200, Hartmut Goebel wrote:
     Am 06.10.2016 um 02:57 schrieb John Darrington:
     >        127.0.0.1 localhost
     >        ::1       localhost
     >        127.0.0.1 gambrinus
     >        ::1       gambrinus
     >      
     >      Or am I missing something?
     >
     > Hmm.  I have never seen it done this way elsewhere, and I really wonder how some
     > services will react if they discover that 127.0.0.1 is not called "localhost"?  
     > Or that one address is known by two names.  I think it possible they might 
     > assume a security breach and refuse to work. 
     
     This should not be a problem. One could always add several entries for
     the same IP-address. And "getent hosts 127.0.0.1" will return the first
     entry in /etc/hosts AFAIKT.


     
     I started digging through the man pages, but did not finish. It's a deep
     maybe recursive mess of documentation where nothing is said about  Maybe
     we need to refer to the gethostbyname(2) and gethostbyname(3)
     documentation, which both are listed in "man hostname".

Indeed it is a mess.  And be careful there are several versions of "hostname" program
in circulation.  One of them explicitly says that

127.0.1.1 canoncal-name.example.com canonical-name 

Is the recommended way to set the canoncial name and fqdn
     
     * gethostbyname(2) [1], uses uname[2], which returns what ever has been
     set with sethostname (AFAICT) and always returns a single string.

That is also my understanding.
     
     * gethostbyname(3) [3] returns a structure capable to hold an name,
     several aliases, and several addresses.

Yes.
     
     Nevertheless my conclusion is that any program should be able to handle
     any ip-address and and hostname and must not rely on any assumtion
     regarding these. (Exept perhaps to assume "localhost" is defined.)

Well behaved programs should not make such assumptions.  But I don't think
we should assume that all programs behave well .
     

Anyway I think we need to change what we currently have because it breaks
"hostname -f" (and possibly other things too)

J'

-- 
Avoid eavesdropping.  Send strong encrypted email.
PGP Public key ID: 1024D/2DE827B3 
fingerprint = 8797 A26D 0854 2EAB 0285  A290 8A67 719C 2DE8 27B3
See http://sks-keyservers.net or any PGP keyserver for public key.

Re: Contents of /etc/hosts

[Hartmut Goebel]

Am 08.10.2016 um 16:08 schrieb John Darrington:
>      >  127.0.0.2 gambrinus
>      Now what happens if you "ping gambrinus"?
>      
> ICMP packets will be sent to the local host.

Me fool. of course it does: the loopback interface has netmask /8
)defined in RFC 990 https://tools.ietf.org/html/rfc990

But for IPv6 the loopback interface has ::1/128, this ::2 would not got
there.

So if we follow your proposal adding "127.0.0.2 gambrius" to /etc/hosts,
we could not contently doe this for IPv6.

-- 
Regards
Hartmut Goebel

| Hartmut Goebel          | h.goebel@crazy-compilers.com               |
| www.crazy-compilers.com | compilers which you thought are impossible |

Re: Contents of /etc/hosts

[John Darrington]

[-- Attachment #1: Type: text/plain, Size: 1011 bytes --]

On Sun, Oct 09, 2016 at 11:12:58AM +0200, Hartmut Goebel wrote:
     Am 08.10.2016 um 16:08 schrieb John Darrington:
     >      >  127.0.0.2 gambrinus
     >      Now what happens if you "ping gambrinus"?
     >      
     > ICMP packets will be sent to the local host.
     
     Me fool. of course it does: the loopback interface has netmask /8
     )defined in RFC 990 https://tools.ietf.org/html/rfc990
     
     But for IPv6 the loopback interface has ::1/128, this ::2 would not got
     there.
     
     So if we follow your proposal adding "127.0.0.2 gambrius" to /etc/hosts,
     we could not contently doe this for IPv6.
     
IPv6 is something I'm not really familiar with.  Presumably there is an 
equivalent way to do this in IPv6 ?

J'
     

-- 
Avoid eavesdropping.  Send strong encrypted email.
PGP Public key ID: 1024D/2DE827B3 
fingerprint = 8797 A26D 0854 2EAB 0285  A290 8A67 719C 2DE8 27B3
See http://sks-keyservers.net or any PGP keyserver for public key.


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

Re: Contents of /etc/hosts

[Hartmut Goebel]

Am 09.10.2016 um 11:56 schrieb John Darrington:
>      But for IPv6 the loopback interface has ::1/128, this ::2 would not got
>      there.
>      
>      So if we follow your proposal adding "127.0.0.2 gambrius" to /etc/hosts,
>      we could not contently doe this for IPv6.
>      
> IPv6 is something I'm not really familiar with.  Presumably there is an 
> equivalent way to do this in IPv6 ?

I don't think we can use somehting like "::2 gamrius" for IPv6. I did
not find documentation for this when In did a short Internet search but:

* According to some sources, the loopback interface address is ::1/128,
which would be the same as 127.0.0.1/32. Thus this loopback is a kind of
point-to-point interface in IPv6, where as in IPv4 it "accepts" a /8
network.

*  "/sbin/ip -6 route" says:

      unreachable ::/96 dev lo  metric 1024  error -113 pref medium

   So when sending a packet to ::2 this will simply be discard.

-- 
Regards
Hartmut Goebel

| Hartmut Goebel          | h.goebel@crazy-compilers.com               |
| www.crazy-compilers.com | compilers which you thought are impossible |

Re: Contents of /etc/hosts

[Ludovic Courtès]

Hello!

John Darrington <john@darrington.wattle.id.au> skribis:

> On Wed, Oct 05, 2016 at 10:17:14PM +0200, Ludovic Court??s wrote:
>      Hi!
>      
>      John Darrington <john@darrington.wattle.id.au> skribis:
>      
>      > So ... my recommendations:
>      >
>      > 1. We change /etc/hosts to read
>      >
>      >
>      >  127.0.0.1 localhost.localdomain localhost 
>      >  ::1       localhost.localdomain localhost
>      >
>      >  127.0.0.2 gambrinus
>      
>      It???s not very useful to have ???localhost.localdomain???, is it?  
>
> Try doing this:  Put just a single line in your /etc/hosts: 
> 127.0.0.1 localhost
> then run "hostname -d"
>
> You will get the answer "(none)"

Right.

But “localhost.localdomain” is kinda pointless no?  I’ve checked a few
systems and I’ve never seen that.  Typical desktop GNU/Linux installs
don’t have an FQDN and “hostname -d” doesn’t return one; that’s fine.

I think the current default is OK, but we should allow people to specify
an FQDN when there’s a meaningful one.

Thoughts?

Ludo’.