Re: [PLUG] Strange subdomain on running apt

"_http._tcp.us.archive.ubuntu.com" is a SRV record listing archive mirror servers. APT will try each mirror in order based on the preference and weight values it finds in the record.

host -t srv _http._tcp.us.archive.ubuntu.com
_http._tcp.us.archive.ubuntu.com has SRV record 2 0 80 ubuntu-mirror-3.ps5.canonical.com.
_http._tcp.us.archive.ubuntu.com has SRV record 0 0 80 ubuntu-mirror-1.ps6.canonical.com.
_http._tcp.us.archive.ubuntu.com has SRV record 0 0 80 ubuntu-mirror-2.ps6.canonical.com.
_http._tcp.us.archive.ubuntu.com has SRV record 0 0 80 ubuntu-mirror-3.ps6.canonical.com.
_http._tcp.us.archive.ubuntu.com has SRV record 2 0 80 ubuntu-mirror-1.ps5.canonical.com.
_http._tcp.us.archive.ubuntu.com has SRV record 2 0 80 ubuntu-mirror-2.ps5.canonical.com.

Seems perfectly cromulent to me.

Best regards,

//CMFM

On Sat, Mar 22, 2025 at 6:41 PM Michael Lazin via plug <plug@lists.phillylinux.org> wrote:

I realize that on default apt uses http and not https, there has been much discussion of this on the Debian lists, Debian still uses http and ftp for updates.

root@microlaser-IdeaPad-Slim-3-15IRU8:/home/microlaser# cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=24.04
DISTRIB_CODENAME=noble
DISTRIB_DESCRIPTION="Ubuntu 24.04.2 LTS"

This is what I am running. I do not trust this subdomain but when I block it, apt no longer works.

root@microlaser-IdeaPad-Slim-3-15IRU8:/home/microlaser# cat /etc/resolv.conf
nameserver 9.9.9.9

I hard coded quad9 into my resolv.conf with chattr+i, I realize this is unconventional but I have my reasons for doing this. I am using Cloudflare DOH in Firefox and it works as expected. Has anyone seen traffic like this when updating packages or just doing system updates? The subdomain in the photo looks weird to me and I am loath to allow it without verifying it is legit despite the fact the domain itself looks normal. Has anyone seen this subdomain when updating? I use Opensnitch because I think a zero trust attitude is healthy even when using Linux at home.

Michael Lazin

.. τὸ γὰρ αὐτὸ νοεῖν ἐστίν τε καὶ εἶναι.
___________________________________________________________________________
Philadelphia Linux Users Group -- http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion -- http://lists.phillylinux.org/mailman/listinfo/plug