<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Thanks for bearing with me, Richard.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Maybe we know what’s wrong now (though I still don’t get it entirely, since as I said, the search entry will be generated by the DHCP client.) But that’s not
the point.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">So, back to the original question: What can I do to abort this behavior, and stop sending network requests to the wrong room?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> richardvoigt@gmail.com [mailto:richardvoigt@gmail.com]
<br>
<b>Sent:</b> Wednesday, December 05, 2012 9:39 AM<br>
<b>To:</b> Lovelady, Dennis E.<br>
<b>Cc:</b> dnsmasq-discuss@lists.thekelleys.org.uk<br>
<b>Subject:</b> Re: [Dnsmasq-discuss] DNS - preventing escalation to external<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">It's the "search Z.com" entry getting involved.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I don't believe that dnsmasq ever rewrites /etc/resolv.conf Other software might, such as your DHCP client.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">As far as *.Z.com resolving, there's nothing that requires DNS to be a static table of pre-existing names. It's a client-server lookup, and the server can use any arbitrary algorithm for generating a response, not limited to a table lookup.
Zone transfers wouldn't match, but I guess records could be hidden from zone transfer regardless, or zone transfer could be entirely refused.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Wed, Dec 5, 2012 at 7:32 AM, Lovelady, Dennis E. <<a href="mailto:dlovelady1@dtcc.com" target="_blank">dlovelady1@dtcc.com</a>> wrote:<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Thank you, Richard:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><br>
Yes, no doubt, /etc/resolv.conf on all these systems contains:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">nameserver 192.168.158.2</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">search Z.com</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">domain Z.com</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">So are you suggesting that I remove one of these from those /etc/resolv.conf entries? Interesting,
I hadn’t thought to do that. But even if I do that, won’t the domain-needed and domain= entries from dnsmasq.conf override that? (In fact, won’t they cause overwrite of the /etc/resolv.conf file in most cases?) Or what are you suggesting?</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Is it my best bet to remove the domain= and domain-needed entries from dnsmasq.conf? I hadn’t thought
to do that either, but now it seems worth a try… I’d still like to hear other suggestions, though. Maybe something I can/should do in my hosted DNS entries?</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I would like to understand how a specific name (like myhostess or
<a href="http://myhostess.Z.com" target="_blank">myhostess.Z.com</a>) can resolve to a generic name like Z.com. I thought DNS strictly avoids that; not true?</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Thanks,</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Dennis</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">
<a href="mailto:richardvoigt@gmail.com" target="_blank">richardvoigt@gmail.com</a> [mailto:<a href="mailto:richardvoigt@gmail.com" target="_blank">richardvoigt@gmail.com</a>]
<br>
<b>Sent:</b> Tuesday, December 04, 2012 5:11 PM<br>
<b>To:</b> Lovelady, Dennis E.<br>
<b>Cc:</b> <a href="mailto:dnsmasq-discuss@lists.thekelleys.org.uk" target="_blank">
dnsmasq-discuss@lists.thekelleys.org.uk</a><br>
<b>Subject:</b> Re: [Dnsmasq-discuss] DNS - preventing escalation to external</span><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Sounds like a search suffix is getting involved: After failing to find myhostess. your resolver looks for
<a href="http://myhostess.X.com" target="_blank">myhostess.X.com</a>. which finds the alias. /etc/resolv.conf should contain the directives which control search suffix.<o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt"> <o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">On Tue, Dec 4, 2012 at 4:44 PM, Lovelady, Dennis E. <<a href="mailto:dlovelady1@dtcc.com" target="_blank">dlovelady1@dtcc.com</a>> wrote:<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I run a domain, which I’ll call Z.com. There are two offices (<a href="http://atl.Z.com" target="_blank">atl.Z.com</a>,
<a href="http://tam.Z.com" target="_blank">tam.Z.com</a>). There is also a <a href="http://www.Z.com" target="_blank">
www.Z.com</a> hosted outside these networks, and the Hosting Provider provides an alias to that, known simply as “Z.com.” All pretty simple.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Since each office is independent, I have kept a simple DNSMASQ configuration, which you can see below. (There were attempts to set up
<a href="http://atl.Z.com" target="_blank">atl.Z.com</a> and <a href="http://tam.Z.com" target="_blank">
tam.Z.com</a> in each office’s DNSMASQ configuration, but these were met with difficulties now forgotten. I think the difficulty was an issue with web server not coming up. If it’s important to resolution, I will pursue again and report the issues, but let’s
get to the heart of the topic.)<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Everything works OK until an incorrect hostname (or the name of a host that happens to be down) is referenced in either office. For example, if I type “ssh myhostess” and there
is no “myhostess” on the current network, then the name is magically resolved to the
<a href="http://www.Z.com" target="_blank">www.Z.com</a> address, and I get the password prompt from there. Not what I’d want; I’d prefer the lookup to fail - which would then fail the ssh command - but I don’t see a way to make that happen.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Is there something I can do in this configuration to cause, for example,
<a href="http://lists.thekelleys.org.uk" target="_blank">lists.thekelleys.org.uk</a> to be resolved externally, but to keep the Z.com stuff between the walls? And would this in fact be squared away by pursuing the
<a href="http://atl.Z.com" target="_blank">atl.Z.com</a> (etc.) concept? (I fear that would not resolve this.) I could remove the alias to simply Z.com, and that might do it, but I’d prefer not to do that, and anyway I’m not sure why it would fix this.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I have the following DNS configuration in each office. The dhcp-boot is not used at present, so may not be quite up to snuff.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p>domain-needed<o:p></o:p></p>
<p>bogus-priv<o:p></o:p></p>
<p>expand-hosts<o:p></o:p></p>
<p>domain=Z.com<o:p></o:p></p>
<p>dhcp-range=192.168.158.10,192.168.158.109,7d<o:p></o:p></p>
<p>dhcp-host=88:87:17:12:69:4d,canon-8120<o:p></o:p></p>
<p>dhcp-host=00:23:8b:8a:ad:70,aspire<o:p></o:p></p>
<p>dhcp-host=00:26:F2:DB:95:0C,stora-0<o:p></o:p></p>
<p>dhcp-host=C0:3F:0E:BC:43:B9,stora-2<o:p></o:p></p>
<p>dhcp-host=e0:91:f5:7c:7c:56,stora-3<o:p></o:p></p>
<p>dhcp-option=option:router,192.168.158.1<o:p></o:p></p>
<p>dhcp-boot=pxelinux.0<o:p></o:p></p>
<p>dhcp-boot=aspire-lucid/pxelinux.0<o:p></o:p></p>
<p>dhcp-match=set:gpxe,175 # gPXE sends a 175 option.<o:p></o:p></p>
<p>enable-tftp<o:p></o:p></p>
<p>tftp-root=/home/tftpd<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt"><br>
_____________________________________________________________ <br>
DTCC DISCLAIMER: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify us immediately and delete the email
and any attachments from your system. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.<br>
_______________________________________________<br>
Dnsmasq-discuss mailing list<br>
<a href="mailto:Dnsmasq-discuss@lists.thekelleys.org.uk" target="_blank">Dnsmasq-discuss@lists.thekelleys.org.uk</a><br>
<a href="http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss" target="_blank">http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss</a><o:p></o:p></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><br>
_____________________________________________________________ <br>
DTCC DISCLAIMER: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify us immediately and delete the email
and any attachments from your system. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
_______________________________________________<br>
Dnsmasq-discuss mailing list<br>
<a href="mailto:Dnsmasq-discuss@lists.thekelleys.org.uk">Dnsmasq-discuss@lists.thekelleys.org.uk</a><br>
<a href="http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss" target="_blank">http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss</a><o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>
<BR>_____________________________________________________________
<FONT size=2><BR>
DTCC DISCLAIMER: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify us immediately and delete the email and any attachments from your system. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.</FONT>