Now hopefully, host name resolution is something we're relatively familiar with.
It's where we can go through and resolve a hostname such as
www.pluralsight.com to an IP address that we need to connect to.
This can be done by using the /etc/hosts file.
We generally then check that first before moving on to our
domain and name servers on the internet, DNS.
Now it's my opinion that this default, checking the /etc/hosts first
and then DNS, is actually the wrong way around.
I feel we should be checking DNS first and then the /etc/hosts file. To show
you why I feel this way and the problems that can occur, we're going to move
out through to our command line. Working on our openSUSE system, we're going
to be investigating our name resolution and the purpose of the
/etc/nsswitch.conf. So here we are working on our openSUSE system, and you
can see I've already gained root privileges. We're going to take a look at
how our name resolution is working by looking in our back ends, the
/etc/hosts, and DNS. Now really, to be able to show you something practical
to work with, we're going to go through and install some extra software.
We're going to begin by putting in a command line browser, so w3m, but
additionally, I'm adding in the apache2 web server.
We want another web server that we can go to other
than just our public web servers.
So, I'm going to go through and install all of these
utilities. It won't take long.
But then once we've got that installed, we should be able to go through and
take a check on our web server. So we've only installed it.
It won't have started on openSUSE, but if we check the status of apache2, we can
see then that it's not currently running. It's not enabled.
So we can go through and run our normal trick with systemctl of then
enabling our service, so it starts on system boot, and ‑‑now, so it
starts now. We can go back and, of course, check our status, so this
is all looking pretty good.
If I clear the screen though,
we can also check to see that the port is open, so we're looking
for port 80, and port 80 is up and running.
So we've got a web server, and maybe a web server that we wouldn't necessarily
want to visit all of the time, but we can get extra traffic.
First of all, we're going to need a little bit of content.
Now that default content should live in the /srv/www/htdocs
subdirectory and should be called index.html.
Once we hit the big Enter key, our web page is going
to be there waiting for visitors.
Oh, and look here, our first visitor, w3m localhost,
and we've got the Hello page showing.
So everything is as we would expect because nothing
is amiss with our configuration.
If I go through and take a look at maybe going through to the
Pluralsight website, so pluralsight.com, and as we go through and take
a look at this, well, we can see then that we're getting a web page of
sorts coming back. Okay, we don't get all of the graphics. It's a
command line browser after all,
but we're certainly getting the Pluralsight website. Now, at this stage, we
might be wondering what all of the fuss is about because everything seems to
be working, but all we've done is put on a website.
But the problem is, if I go through and take a look
at the default configuration,
if I read the hosts setting from /etc/nsswitch.conf, my Name Services Switch,
.conf, for our host entries, we read our local files first.
The problem with that is that you could be set at your desktop and
somebody then could have a website running that has scripts that
execute within your browser and write entries through to your
localhost file. If that was the case,
you might find that every website that you visit is exactly the same
website. And when I go through and take a look at my host file,
there's nothing wrong with this host file at the moment. It's
pretty clean. But if you look at a host file that perhaps had been
attacked by some form of browser script,
you might find it has many entries that are all pointing through
to the exact same IP address. And I can kind of give you a
demonstration of how this could happen.
I'm going to do it manually, but if I go through and echo
127.0.0.1, so this would be the IP address of the website
we didn't really want to visit.
We visit www.pluralsight.com, and our browser then writes an entry to our
hosts file that points to the unsavory website. There you go.
We've got an attack that has just been made. Now when I go through and
take a look at www.pluralsight.com, we're probably not going to see
Pluralsight. We see our Hello page. Now of course, we might be a little
bit perplexed by this, but probably every website that we're going to is
going to be attacked by the same script and an entry being added to our
hosts file. We can prevent this happening by changing our host century.
And just look at what we can do with vim as a text editor just out of
interest.
If I go through and put vim and then + and a /, we are looking for a text.
If I go + and a number, we're looking for a line number,
I can then go through and say, look, lines beginning with hosts: and
then making reference to our /etc/nsswitch.conf.
We just hit Enter, but we can then get taken through to
exactly the line that we want to be, the first matching
line where it starts with hosts.
So a really nice shortcut for using vim.
We want to go through and change the order here.
So in place of checking our files first, we check our DNS
first, go and save the changes, and now as we go back and
revisit our pluralsight.com website,
we're going to find that we do go to Pluralsight because
we read the DNS entry before we get to the incorrect
entries, so www.pluralsight.com.
As we take a look at that,
it certainly looks like the Pluralsight website. It's certainly not
my Hello website, but we haven't lost anything.
I can still browse to local entry so long as those
local entries aren't also in DNS.
So here we've got openSUSE, just the name opensuse. That was in
my hosts file, and we can see the website.
So everything is working the way that it should, and we're not
going to be exposed to those sorts of attacks where somebody is
writing entries to our local host file.
Now to quickly finish off, let's go through and just
take a look at our /etc/hosts file.
Of course, we put our incorrect entry there, and it is still
there. Now of course, it's no longer effective.
But looking at a shortcut with vim,
we can go through and put vim. We can go through and look for a
particular line, but I'm going to put everything in quotes because I
want to include some extra commands at the end.
We can go through and specify that we're looking for a line that contains,
let's say plural.
Just put the end in because we're going to put some commands after this.
The commands I can put in then become d to delete the
line and then x to save and exit.
These are all ex commands. Close off our quotes, and then
go through and take a look at our file.
So escape and dot will bring up our /etc/hosts. We've gone into vim,
we've edited our file and saved it, even without us knowing. If
I go through and rerun that tail command,
we can see now that I've deleted the matching line. How cool is that?