Re: [PLUG] DNS, fsearch, systemd

[George Langford via plug <plug@lists.phillylinux.org>]

The late Dan Kominsky first brought up  dns cache poisoning in 2008, 
which I was able
to retrieve from my PLUG archive; Dan Goodin has carried the analysis 
further as
jeffv has brought up recently.
I've just found a class of mis-configured in-addr.arpa entries that 
ought to disrupt
DNS lookups. Here's a ferinstance: 162.213.255.128/25.
There's a misconfiguration in the in-addr.arpa index address for more 
than fifty of these
IPv4 addresses:
dig -x 162.213.255.156 ==> ;; ANSWER SECTION:
156.255.213.162.in-addr.arpa. 1200 IN CNAME 
156.128-25.255.213.162.in-addr.arpa.
156.128-25.255.213.162.in-addr.arpa. 7199 IN PTR 
server1.jobinterview.biz.

That misconfiguration ought to interfere with the resolution of 
server1.jobinterview.biz, but it doesn't.
Is that because I've looked up those addresses too many times ?

The miscofiguration appears to stem from the original setup/registration 
of the server,
as 128/25 is the correct CIDR block of the affected addresses. However, 
the injected
128-25 in 156.128-25.255.213.162.in-addr.arpa is in the wrong position 
of the reversed
order of IPv4 octets, as though the misconfiguration is deliberate.
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug