Bristol and Bath Linux: Oktober 2014

Send Bristol mailing list submissions to
bristol@mailman.lug.org.uk

To subscribe or unsubscribe via the World Wide Web, visit
https://mailman.lug.org.uk/mailman/listinfo/bristol
or, via email, send a message with subject or body 'help' to
bristol-request@mailman.lug.org.uk

You can reach the person managing the list at
bristol-owner@mailman.lug.org.uk

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Bristol digest..."

Today's Topics:

1. Re: Mysterious DNS problem (Zak Wilcox)
2. Re: Mysterious DNS problem (Y Martin)
3. Re: Mysterious DNS problem (Y Martin)
4. Re: Mysterious DNS problem (Dave Addison)
5. Re: Mysterious DNS problem (Y Martin)
6. Re: Mysterious DNS problem (Shane McEwan)
7. LUG Meeting this Saturday 25/10/14 (Sebastian)

----------------------------------------------------------------------

Message: 1
Date: Mon, 20 Oct 2014 17:31:56 +0100
From: Zak Wilcox <iwilcox@iwilcox.me.uk>
To: bristol@mailman.lug.org.uk
Subject: Re: [bristol] Mysterious DNS problem
Message-ID: <544538FC.9050201@iwilcox.me.uk>
Content-Type: text/plain; charset=windows-1252

On 20/10/14 17:01, Y Martin wrote:
> Mine just stays the same.

Just as a sanity check, what does "host -vv google.com" say? It should
mention the server it's using, in a line like "Received xxx bytes from
a.b.c.d#53 in 123 ms".

> Should I install resolvconf?

Don't worry about it if you don't have it.

> By the way, my grep -srx "10.24.0.1" is still running(!) Nothing yet..

If you know something like ping or "host -vv google.com" is using
10.x.x.x, but you don't know where from, strace can be handy. Something
like "strace -e open ping" or "strace -e open host -vvv google.com"
should list all the files a program opens while it runs. Check those.
Failing that, you could always make grep more targeted --- it's pretty
unlikely the IP is coming from anywhere but /etc or /var, so start there.

Also, wasn't it 10.42.x.x not 10.24.x.x ?

------------------------------

Message: 2
Date: Mon, 20 Oct 2014 17:21:52 +0000
From: Y Martin <ym2013@riseup.net>
To: Bristol and Bath Linux User Group <bristol@mailman.lug.org.uk>
Subject: Re: [bristol] Mysterious DNS problem
Message-ID: <544544B0.6040201@riseup.net>
Content-Type: text/plain; charset=ISO-8859-1

Zak Wilcox:
> On 20/10/14 17:01, Y Martin wrote:
>> Mine just stays the same.
>
> Just as a sanity check, what does "host -vv google.com" say? It should
> mention the server it's using, in a line like "Received xxx bytes from
> a.b.c.d#53 in 123 ms".
$ host -vv google.com
Trying "google.com"
;; connection timed out; no servers could be reached
>
>> Should I install resolvconf?
>
> Don't worry about it if you don't have it.
>
>> By the way, my grep -srx "10.24.0.1" is still running(!) Nothing yet..
>
> If you know something like ping or "host -vv google.com" is using
> 10.x.x.x, but you don't know where from, strace can be handy. Something
> like "strace -e open ping" or "strace -e open host -vvv google.com"
> should list all the files a program opens while it runs. Check those.
> Failing that, you could always make grep more targeted --- it's pretty
> unlikely the IP is coming from anywhere but /etc or /var, so start there.
There was nothing in /etc/ or /var/ ..thats odd

I will install strace manually and let you know the output of those
commands.
>
> Also, wasn't it 10.42.x.x not 10.24.x.x ?
Yes youre right. Sorry about that, I resent the email with the typos
corrected.
>
> _______________________________________________
> Bristol mailing list
> Bristol@mailman.lug.org.uk
> https://mailman.lug.org.uk/mailman/listinfo/bristol
>

------------------------------

Message: 3
Date: Mon, 20 Oct 2014 18:06:15 +0000
From: Y Martin <ym2013@riseup.net>
To: Bristol and Bath Linux User Group <bristol@mailman.lug.org.uk>
Subject: Re: [bristol] Mysterious DNS problem
Message-ID: <54454F17.9050709@riseup.net>
Content-Type: text/plain; charset=ISO-8859-1

This looks interesting:

$ strace -e open host -vvv google.com
open("/etc/ld.so.cache", O_RDONLY) = 3
open("/usr/lib/liblwres.so.80", O_RDONLY) = 3
open("/usr/lib/libdns.so.88", O_RDONLY) = 3
open("/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2", O_RDONLY) = 3
open("/usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0", O_RDONLY) = 3
open("/usr/lib/libbind9.so.80", O_RDONLY) = 3
open("/usr/lib/libisccfg.so.82", O_RDONLY) = 3
open("/usr/lib/libisc.so.84", O_RDONLY) = 3
open("/lib/x86_64-linux-gnu/libdl.so.2", O_RDONLY) = 3
open("/lib/x86_64-linux-gnu/libcap.so.2", O_RDONLY) = 3
open("/lib/x86_64-linux-gnu/libpthread.so.0", O_RDONLY) = 3
open("/usr/lib/x86_64-linux-gnu/libxml2.so.2", O_RDONLY) = 3
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY) = 3
open("/usr/lib/libGeoIP.so.1", O_RDONLY) = 3
open("/usr/lib/x86_64-linux-gnu/libkrb5.so.3", O_RDONLY) = 3
open("/usr/lib/x86_64-linux-gnu/libk5crypto.so.3", O_RDONLY) = 3
open("/lib/x86_64-linux-gnu/libcom_err.so.2", O_RDONLY) = 3
open("/usr/lib/x86_64-linux-gnu/libkrb5support.so.0", O_RDONLY) = 3
open("/lib/x86_64-linux-gnu/libkeyutils.so.1", O_RDONLY) = 3
open("/lib/x86_64-linux-gnu/libresolv.so.2", O_RDONLY) = 3
open("/lib/x86_64-linux-gnu/libz.so.1", O_RDONLY) = 3
open("/usr/lib/libisccc.so.80", O_RDONLY) = 3
open("/lib/x86_64-linux-gnu/libattr.so.1", O_RDONLY) = 3
open("/lib/x86_64-linux-gnu/liblzma.so.5", O_RDONLY) = 3
open("/lib/x86_64-linux-gnu/libm.so.6", O_RDONLY) = 3
open("/usr/share/locale/en_GB.UTF-8/libdst.cat", O_RDONLY) = -1 ENOENT
(No such file or directory)
open("/usr/share/locale/en_GB.UTF-8/LC_MESSAGES/libdst.cat", O_RDONLY) =
-1 ENOENT (No such file or directory)
open("/usr/share/locale/en/libdst.cat", O_RDONLY) = -1 ENOENT (No such
file or directory)
open("/usr/share/locale/en/LC_MESSAGES/libdst.cat", O_RDONLY) = -1
ENOENT (No such file or directory)
open("/usr/share/locale/en_GB.UTF-8/libisc.cat", O_RDONLY) = -1 ENOENT
(No such file or directory)
open("/usr/share/locale/en_GB.UTF-8/LC_MESSAGES/libisc.cat", O_RDONLY) =
-1 ENOENT (No such file or directory)
open("/usr/share/locale/en/libisc.cat", O_RDONLY) = -1 ENOENT (No such
file or directory)
open("/usr/share/locale/en/LC_MESSAGES/libisc.cat", O_RDONLY) = -1
ENOENT (No such file or directory)
open("/usr/lib/ssl/openssl.cnf", O_RDONLY) = 6
open("/usr/lib/x86_64-linux-gnu/openssl-1.0.0/engines/libgost.so",
O_RDONLY) = 6
open("/usr/share/locale/en_GB.UTF-8/libdns.cat", O_RDONLY) = -1 ENOENT
(No such file or directory)
open("/usr/share/locale/en_GB.UTF-8/LC_MESSAGES/libdns.cat", O_RDONLY) =
-1 ENOENT (No such file or directory)
open("/usr/share/locale/en/libdns.cat", O_RDONLY) = -1 ENOENT (No such
file or directory)
open("/usr/share/locale/en/LC_MESSAGES/libdns.cat", O_RDONLY) = -1
ENOENT (No such file or directory)
open("/etc/resolv.conf", O_RDONLY) = 6
Trying "google.com"
;; connection timed out; no servers could be reached
--- SIGTERM (Terminated) @ 0 (0) ---

$ strace -e open ping
open("/etc/ld.so.cache", O_RDONLY) = 3
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY) = 3
Usage: ping [-LRUbdfnqrvVaAD] [-c count] [-i interval] [-w deadline]
[-p pattern] [-s packetsize] [-t ttl] [-I interface]
[-M pmtudisc-hint] [-m mark] [-S sndbuf]
[-T tstamp-options] [-Q tos] [hop1 ...] destination

Zak Wilcox:
> On 20/10/14 17:01, Y Martin wrote:
>> Mine just stays the same.
>
> Just as a sanity check, what does "host -vv google.com" say? It should
> mention the server it's using, in a line like "Received xxx bytes from
> a.b.c.d#53 in 123 ms".
>
>> Should I install resolvconf?
>
> Don't worry about it if you don't have it.
>
>> By the way, my grep -srx "10.24.0.1" is still running(!) Nothing yet..
>
> If you know something like ping or "host -vv google.com" is using
> 10.x.x.x, but you don't know where from, strace can be handy. Something
> like "strace -e open ping" or "strace -e open host -vvv google.com"
> should list all the files a program opens while it runs. Check those.
> Failing that, you could always make grep more targeted --- it's pretty
> unlikely the IP is coming from anywhere but /etc or /var, so start there.
>
> Also, wasn't it 10.42.x.x not 10.24.x.x ?
>
> _______________________________________________
> Bristol mailing list
> Bristol@mailman.lug.org.uk
> https://mailman.lug.org.uk/mailman/listinfo/bristol
>

------------------------------

Message: 4
Date: Mon, 20 Oct 2014 19:28:22 +0100
From: Dave Addison <dave@redmoor.org.uk>
To: Bristol and Bath Linux User Group <bristol@mailman.lug.org.uk>
Subject: Re: [bristol] Mysterious DNS problem
Message-ID: <1633533.GUeOydHDrB@phaedra>
Content-Type: text/plain; charset="us-ascii"

On Sunday 19 Oct 2014 12:46:52 Y Martin wrote:
> Hi Ian
>
> Thank you for your reply. Yes bitmask is a better implemention of
> encrypted communication because I believe in giving our Article 12 Human
> Right to privacy a healthy exercise (use 'em or lose 'em!)
>
> Sorry, I should have mentioned that I have uninstalled bitmask but the
> problem persists.
>
> So I am trying to find out what bitmask has changed in my DNS
> configuration and how to undo it :-(
>
> ohh dear, the price we pay for privacy!!!
>
> Sincerely,
>
> Yousef
>
Hi Yousef,

Reading the web page Ian linked to, it would appear that bitmask install rules
into the firewall to redirect DNS queries. The web page also lists the command
to disable this for debugging so it should be possible to check if this is the
problem

sudo bitmask-root firewall stop

Regards
Dave

------------------------------

Message: 5
Date: Mon, 20 Oct 2014 18:35:29 +0000
From: Y Martin <ym2013@riseup.net>
To: Bristol and Bath Linux User Group <bristol@mailman.lug.org.uk>
Subject: Re: [bristol] Mysterious DNS problem
Message-ID: <544555F1.5080506@riseup.net>
Content-Type: text/plain; charset=ISO-8859-1

There was a bitmask chain remaining but it was empty. Just to be safe I ran:
$ iptables -X bitmask
$ iptables -L -v

This now shows that the bitmask chain has been removed but DNS still
doesnt work :-( I wonder if I'm missing anything..

But perhaps youre right and I should reinstall bitmask to make use of:
$ bitmask-root firewall stop

What is it they say about the old cure?.. 'Hair of the dog that bit you'!

Dave Addison:
> On Sunday 19 Oct 2014 12:46:52 Y Martin wrote:
>> Hi Ian
>>
>> Thank you for your reply. Yes bitmask is a better implemention of
>> encrypted communication because I believe in giving our Article 12 Human
>> Right to privacy a healthy exercise (use 'em or lose 'em!)
>>
>> Sorry, I should have mentioned that I have uninstalled bitmask but the
>> problem persists.
>>
>> So I am trying to find out what bitmask has changed in my DNS
>> configuration and how to undo it :-(
>>
>> ohh dear, the price we pay for privacy!!!
>>
>> Sincerely,
>>
>> Yousef
>>
> Hi Yousef,
>
> Reading the web page Ian linked to, it would appear that bitmask install rules
> into the firewall to redirect DNS queries. The web page also lists the command
> to disable this for debugging so it should be possible to check if this is the
> problem
>
> sudo bitmask-root firewall stop
>
> Regards
> Dave
>
> _______________________________________________
> Bristol mailing list
> Bristol@mailman.lug.org.uk
> https://mailman.lug.org.uk/mailman/listinfo/bristol
>

------------------------------

Message: 6
Date: Mon, 20 Oct 2014 14:18:01 +0100
From: Shane McEwan <shane@mcewan.id.au>
To: bristol@mailman.lug.org.uk
Subject: Re: [bristol] Mysterious DNS problem
Message-ID: <54450B89.8040604@mcewan.id.au>
Content-Type: text/plain; charset=utf-8

On 17/10/14 20:36, Y Martin wrote:
> Im beginning to wonder if there is such a thing as DNS gods that I
> should have made some prayers and offerings to. Can anyone shine a light
> on things?

The DNS god is a cruel and vengeful god. Prayers don't help.

It seems like the DNS server on your gateway isn't working or the
requests aren't getting out of your computer at all.

What do you get when you do:

dig google.com @8.8.8.8

and

dig google.com @192.168.1.123

Perhaps Bitmask has turned on some iptables on your machine that is
blocking outgoing DNS requests?

Shane.

------------------------------

Message: 7
Date: Mon, 20 Oct 2014 22:37:53 +0100
From: Sebastian <sebsebseb_mageia@gmx.com>
To: Bristol and Bath Linux User Group <bristol@mailman.lug.org.uk>,
Sebastian <sebsebseb_mageia@gmx.com>
Subject: [bristol] LUG Meeting this Saturday 25/10/14
Message-ID: <544580B1.3010006@gmx.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed

Hi

It is yet another one of our usual informal LUG meetings at the Knights
Templar Pub this Saturday:
http://www.jdwetherspoon.co.uk/home/pubs/the-knights-templar

Regulars and new people welcome, come along for a chat, or to show or
give away tech related things if wanting to as well for example.

If you are new I suggest not turning up until 1:30pm by the earliest
when someone else is likely to be there as well. People tend to leave
between 4pm and 5/5.30pm. We sit on the lower level at the back of the
pub in the left corner with the plugs, or near there instead if someone
else is already there.

Who other than myself is intending on coming this Saturday? I'll
probably be there about 2pm/3pm.

Regards

Sebastian

------------------------------

_______________________________________________
Bristol mailing list
Bristol@mailman.lug.org.uk
https://mailman.lug.org.uk/mailman/listinfo/bristol

End of Bristol Digest, Vol 573, Issue 4
***************************************

Bristol Digest, Vol 573, Issue 3

Send Bristol mailing list submissions to
bristol@mailman.lug.org.uk

To subscribe or unsubscribe via the World Wide Web, visit
https://mailman.lug.org.uk/mailman/listinfo/bristol
or, via email, send a message with subject or body 'help' to
bristol-request@mailman.lug.org.uk

You can reach the person managing the list at
bristol-owner@mailman.lug.org.uk

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Bristol digest..."

Today's Topics:

1. Slightly less mysterious DNS problem (Y Martin)
2. Re: Mysterious DNS problem (Zak Wilcox)
3. Re: Slightly less mysterious DNS problem (Martin Moore)
4. Re: Mysterious DNS problem (Y Martin)
5. Re: Mysterious DNS problem (Y Martin)

----------------------------------------------------------------------

Message: 1
Date: Mon, 20 Oct 2014 12:52:04 +0000
From: Y Martin <ym2013@riseup.net>
To: Bristol and Bath Linux User Group <bristol@mailman.lug.org.uk>
Subject: [bristol] Slightly less mysterious DNS problem
Message-ID: <54450574.3040509@riseup.net>
Content-Type: text/plain; charset=ISO-8859-1

Aha! Your last email gave me the idea to just do a packet capture and
analyse any DNS requests. I admit its not something Ive done properly
before, but it has unveiled that when I ping google.com (unsuccessfully
of cause), there are numerous DNS protocol queries to 10.42.0.1, which
is, as you said, a private network.

So what next? Unless you have a less crude idea, I will do a grep search
of my whole OS for the mischievous IP "10.42.0.1" to find where this
configuration is residing..

Yours hopefully,

Yousef

-------- Original Message --------
Subject: Re: [bristol] Mysterious DNS problem
Date: Mon, 20 Oct 2014 10:58:30 +0000
From: Y Martin <ym2013@riseup.net>
To: Bristol and Bath Linux User Group <bristol@mailman.lug.org.uk>

I couldnt get bitmask to work. Then I couldnt get my normal internet to
work so I uninstalled bitmask. But my normal internet is still not working.

I wonder if my DNS server is still specified as the bitmask VPN server
(rather than 8.8.8.8 for example). Is there anywhere else except for
/etc/resolve.conf that I should be looking?

Best wishes,

Yousef

Amias Channer:
> Hello Martin,
>
> Whats the DNS server specified at the VPN endpoint and why are you not
> using that ? i suspect the VPN endpoint is not allowing you to use a
> public DNS server because it almost certainly won't resolve hostnames for
> machines inside the VPN or any way to find them out and secondly to prevent
> leaking of DNS queries that could compromise the security of the VPN by
> disclosing where you are trying to get to.
>
> DNS is a public facing service so if you are using a private network you
> need private DNS.
>
> Cheers
> Amias
>
> On 20 October 2014 11:04, Y Martin <ym2013@riseup.net> wrote:
>
>> Hi Martin
>>
>> Sorry for the delay in getting back to you. Ive been a bit unwell. Here
>> is the output of 'route' and 'ifconfig':
>>
>> $ route
>> Kernel IP routing table
>> Destination Gateway Genmask Flags Metric Ref Use
>> Iface
>> default 192.168.1.123 0.0.0.0 UG 0 0 0
>> eth1
>> 192.168.1.0 * 255.255.255.0 U 0 0 0
>> eth1
>>
>> $ ifconfig
>> eth1 Link encap:Ethernet HWaddr 00:1c:ac:98:17:f2
>> inet addr:192.168.1.136 Bcast:192.168.1.255 Mask:255.255.255.0
>> inet6 addr: fe80::21c:acff:fe98:17f2/64 Scope:Link
>> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
>> RX packets:1687 errors:0 dropped:0 overruns:0 frame:0
>> TX packets:1594 errors:0 dropped:0 overruns:0 carrier:0
>> collisions:0 txqueuelen:1000
>> RX bytes:1868346 (1.7 MiB) TX bytes:378434 (369.5 KiB)
>> Interrupt:19 Base address:0xe000
>>
>> lo Link encap:Local Loopback
>> inet addr:127.0.0.1 Mask:255.0.0.0
>> inet6 addr: ::1/128 Scope:Host
>> UP LOOPBACK RUNNING MTU:16436 Metric:1
>> RX packets:2329 errors:0 dropped:0 overruns:0 frame:0
>> TX packets:2329 errors:0 dropped:0 overruns:0 carrier:0
>> collisions:0 txqueuelen:0
>> RX bytes:877136 (856.5 KiB) TX bytes:877136 (856.5 KiB)
>>
>>
>> 192.168.1.123 is my router which is attached to the ADSL router in the
>> house. 192.168.1.123 does have some iptables rules. I have tried my
>> internet without it but DNS still doesnt work. Another PC connected to
>> 192.168.1.123 works fine (DNS lookups, internet etc). But perhaps I
>> should take 192.168.1.123 out of the equation when posting outputs to
>> you to keep things simple.
>>
>> Best wishes,
>>
>> Yousef
>>
>>
>> Martin Habets:
>>> Hi,
>>>
>>> Check the output of route and ifconfig. Maybe you're encased in a VPN
>>> due to the bitmask thing (which I'm not familiar with).
>>>
>>> Martin
>>>
>>> On Fri, Oct 17, 2014 at 07:36:09PM +0000, Y Martin wrote:
>>>> Hi
>>>>
>>>> I've had a mysterious problem with DNS on my Debian PC not working for
>>>> over a week now and I havent been able to fix it :-(
>>>>
>>>> I was wondering if there is someone out there that can shine a light on
>>>> this mystery for me.
>>>>
>>>> It happened after I installed the VPN program called bitmask and this
>>>> bitmask wiki page makes me think it is the culpret:
>>>> https://bitmask.net/en/help/vpn/linux#dns
>>>> I lodged a bitmask bug report https://leap.se/code/issues/6197
>>>>
>>>> So I can ping IPs (eg. 8.8.8.8) but not URLs ("ping: unknown host
>>>> www.google.com").
>>>> ----------------------------------------------------------------------
>>>> Dig and nslookup dont seem to work:
>>>>
>>>> $ dig www.google.com
>>>> ; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> www.google.com
>>>> ;; global options: +cmd
>>>> ;; connection timed out; no servers could be reached
>>>>
>>>> $ nslookup www.google.com
>>>> ;; connection timed out; no servers could be reached
>>>> ----------------------------------------------------------------------
>>>> My /etc/nsswitch.conf seems fine:
>>>>
>>>> passwd: compat
>>>> group: compat
>>>> shadow: compat
>>>> hosts: files dns
>>>> networks: files
>>>> protocols: db files
>>>> services: db files
>>>> ethers: db files
>>>> rpc: db files
>>>> netgroup: nis
>>>> ----------------------------------------------------------------------
>>>> I thought dpkg restoring default settings might help but it didnt:
>>>>
>>>> dpkg-reconfigure isc-dhcp-client
>>>> dpkg-reconfigure bind9
>>>> ----------------------------------------------------------------------
>>>> iptables isnt dropping anything on port 53
>>>> ----------------------------------------------------------------------
>>>>
>>>> By the way, my /etc/resolve.conf is:
>>>> nameserver 192.168.1.123 #this is my router
>>>>
>>>> but Ive tried:
>>>> nameserver 8.8.8.8 #still doesnt work :-(
>>>>
>>>> ----------------------------------------------------------------------
>>>>
>>>> Im beginning to wonder if there is such a thing as DNS gods that I
>>>> should have made some prayers and offerings to. Can anyone shine a light
>>>> on things?
>>>>
>>>> Yours hopefully,
>>>>
>>>> Yousef
>>>>
>>>> _______________________________________________
>>>> Bristol mailing list
>>>> Bristol@mailman.lug.org.uk
>>>> https://mailman.lug.org.uk/mailman/listinfo/bristol
>>>
>>> _______________________________________________
>>> Bristol mailing list
>>> Bristol@mailman.lug.org.uk
>>> https://mailman.lug.org.uk/mailman/listinfo/bristol
>>>
>>
>> _______________________________________________
>> Bristol mailing list
>> Bristol@mailman.lug.org.uk
>> https://mailman.lug.org.uk/mailman/listinfo/bristol
>>
>>
>>
>> This body part will be downloaded on demand.

------------------------------

Message: 2
Date: Mon, 20 Oct 2014 14:21:37 +0100
From: Zak Wilcox <iwilcox@iwilcox.me.uk>
To: bristol@mailman.lug.org.uk
Subject: Re: [bristol] Mysterious DNS problem
Message-ID: <54450C61.5030909@iwilcox.me.uk>
Content-Type: text/plain; charset=windows-1252

On 20/10/14 11:58, Y Martin wrote:
> Is there anywhere else except for
> /etc/resolve.conf that I should be looking?

Yes, resolv.conf is often split up now so that individual applications
can insert and remove bits; typically /etc/resolvconf/* or somewhere
similar in /var/run. But it looks to me like your issue is probably:

https://leap.se/code/issues/5691

...as your exhaustive grep has probably told you by now.

------------------------------

Message: 3
Date: Mon, 20 Oct 2014 14:31:50 +0100
From: "Martin Moore" <martinm@it-helps.co.uk>
To: "'Bristol and Bath Linux User Group'" <bristol@mailman.lug.org.uk>
Subject: Re: [bristol] Slightly less mysterious DNS problem
Message-ID:
<!&!AAAAAAAAAAAYAAAAAAAAAKj9cIcGbghBrTUmzEdhwwrCgAAAEAAAANw0NL25evxDjD7tOGT3lAwBAAAAAA==@it-helps.co.uk>

Content-Type: text/plain; charset="us-ascii"

May just need to flush summat - if you haven't a reboot may be quickest....

Martin

-----Original Message-----
From: bristol-bounces@mailman.lug.org.uk
[mailto:bristol-bounces@mailman.lug.org.uk] On Behalf Of Y Martin
Sent: 20 October 2014 13:52
To: Bristol and Bath Linux User Group
Subject: [bristol] Slightly less mysterious DNS problem

Aha! Your last email gave me the idea to just do a packet capture and
analyse any DNS requests. I admit its not something Ive done properly
before, but it has unveiled that when I ping google.com (unsuccessfully of
cause), there are numerous DNS protocol queries to 10.42.0.1, which is, as
you said, a private network.

So what next? Unless you have a less crude idea, I will do a grep search of
my whole OS for the mischievous IP "10.42.0.1" to find where this
configuration is residing..

Yours hopefully,

Yousef

-------- Original Message --------
Subject: Re: [bristol] Mysterious DNS problem
Date: Mon, 20 Oct 2014 10:58:30 +0000
From: Y Martin <ym2013@riseup.net>
To: Bristol and Bath Linux User Group <bristol@mailman.lug.org.uk>

I couldnt get bitmask to work. Then I couldnt get my normal internet to work
so I uninstalled bitmask. But my normal internet is still not working.

I wonder if my DNS server is still specified as the bitmask VPN server
(rather than 8.8.8.8 for example). Is there anywhere else except for
/etc/resolve.conf that I should be looking?

Best wishes,

Yousef

Amias Channer:
> Hello Martin,
>
> Whats the DNS server specified at the VPN endpoint and why are you not
> using that ? i suspect the VPN endpoint is not allowing you to use a
> public DNS server because it almost certainly won't resolve hostnames
> for machines inside the VPN or any way to find them out and secondly
> to prevent leaking of DNS queries that could compromise the security
> of the VPN by disclosing where you are trying to get to.
>
> DNS is a public facing service so if you are using a private network
> you need private DNS.
>
> Cheers
> Amias
>
> On 20 October 2014 11:04, Y Martin <ym2013@riseup.net> wrote:
>
>> Hi Martin
>>
>> Sorry for the delay in getting back to you. Ive been a bit unwell.
>> Here is the output of 'route' and 'ifconfig':
>>
>> $ route
>> Kernel IP routing table
>> Destination Gateway Genmask Flags Metric Ref Use
>> Iface
>> default 192.168.1.123 0.0.0.0 UG 0 0 0
>> eth1
>> 192.168.1.0 * 255.255.255.0 U 0 0 0
>> eth1
>>
>> $ ifconfig
>> eth1 Link encap:Ethernet HWaddr 00:1c:ac:98:17:f2
>> inet addr:192.168.1.136 Bcast:192.168.1.255
Mask:255.255.255.0
>> inet6 addr: fe80::21c:acff:fe98:17f2/64 Scope:Link
>> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
>> RX packets:1687 errors:0 dropped:0 overruns:0 frame:0
>> TX packets:1594 errors:0 dropped:0 overruns:0 carrier:0
>> collisions:0 txqueuelen:1000
>> RX bytes:1868346 (1.7 MiB) TX bytes:378434 (369.5 KiB)
>> Interrupt:19 Base address:0xe000
>>
>> lo Link encap:Local Loopback
>> inet addr:127.0.0.1 Mask:255.0.0.0
>> inet6 addr: ::1/128 Scope:Host
>> UP LOOPBACK RUNNING MTU:16436 Metric:1
>> RX packets:2329 errors:0 dropped:0 overruns:0 frame:0
>> TX packets:2329 errors:0 dropped:0 overruns:0 carrier:0
>> collisions:0 txqueuelen:0
>> RX bytes:877136 (856.5 KiB) TX bytes:877136 (856.5 KiB)
>>
>>
>> 192.168.1.123 is my router which is attached to the ADSL router in
>> the house. 192.168.1.123 does have some iptables rules. I have tried
>> my internet without it but DNS still doesnt work. Another PC
>> connected to
>> 192.168.1.123 works fine (DNS lookups, internet etc). But perhaps I
>> should take 192.168.1.123 out of the equation when posting outputs to
>> you to keep things simple.
>>
>> Best wishes,
>>
>> Yousef
>>
>>
>> Martin Habets:
>>> Hi,
>>>
>>> Check the output of route and ifconfig. Maybe you're encased in a
>>> VPN due to the bitmask thing (which I'm not familiar with).
>>>
>>> Martin
>>>
>>> On Fri, Oct 17, 2014 at 07:36:09PM +0000, Y Martin wrote:
>>>> Hi
>>>>
>>>> I've had a mysterious problem with DNS on my Debian PC not working
>>>> for over a week now and I havent been able to fix it :-(
>>>>
>>>> I was wondering if there is someone out there that can shine a
>>>> light on this mystery for me.
>>>>
>>>> It happened after I installed the VPN program called bitmask and
>>>> this bitmask wiki page makes me think it is the culpret:
>>>> https://bitmask.net/en/help/vpn/linux#dns
>>>> I lodged a bitmask bug report https://leap.se/code/issues/6197
>>>>
>>>> So I can ping IPs (eg. 8.8.8.8) but not URLs ("ping: unknown host
>>>> www.google.com").
>>>> -------------------------------------------------------------------
>>>> --- Dig and nslookup dont seem to work:
>>>>
>>>> $ dig www.google.com
>>>> ; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> www.google.com ;; global
>>>> options: +cmd ;; connection timed out; no servers could be reached
>>>>
>>>> $ nslookup www.google.com
>>>> ;; connection timed out; no servers could be reached
>>>> -------------------------------------------------------------------
>>>> ---
>>>> My /etc/nsswitch.conf seems fine:
>>>>
>>>> passwd: compat
>>>> group: compat
>>>> shadow: compat
>>>> hosts: files dns
>>>> networks: files
>>>> protocols: db files
>>>> services: db files
>>>> ethers: db files
>>>> rpc: db files
>>>> netgroup: nis
>>>> -------------------------------------------------------------------
>>>> --- I thought dpkg restoring default settings might help but it
>>>> didnt:
>>>>
>>>> dpkg-reconfigure isc-dhcp-client
>>>> dpkg-reconfigure bind9
>>>> -------------------------------------------------------------------
>>>> --- iptables isnt dropping anything on port 53
>>>> -------------------------------------------------------------------
>>>> ---
>>>>
>>>> By the way, my /etc/resolve.conf is:
>>>> nameserver 192.168.1.123 #this is my router
>>>>
>>>> but Ive tried:
>>>> nameserver 8.8.8.8 #still doesnt work :-(
>>>>
>>>> -------------------------------------------------------------------
>>>> ---
>>>>
>>>> Im beginning to wonder if there is such a thing as DNS gods that I
>>>> should have made some prayers and offerings to. Can anyone shine a
>>>> light on things?
>>>>
>>>> Yours hopefully,
>>>>
>>>> Yousef
>>>>
>>>> _______________________________________________
>>>> Bristol mailing list
>>>> Bristol@mailman.lug.org.uk
>>>> https://mailman.lug.org.uk/mailman/listinfo/bristol
>>>
>>> _______________________________________________
>>> Bristol mailing list
>>> Bristol@mailman.lug.org.uk
>>> https://mailman.lug.org.uk/mailman/listinfo/bristol
>>>
>>
>> _______________________________________________
>> Bristol mailing list
>> Bristol@mailman.lug.org.uk
>> https://mailman.lug.org.uk/mailman/listinfo/bristol
>>
>>
>>
>> This body part will be downloaded on demand.

_______________________________________________
Bristol mailing list
Bristol@mailman.lug.org.uk
https://mailman.lug.org.uk/mailman/listinfo/bristol

------------------------------

Message: 4
Date: Mon, 20 Oct 2014 16:01:45 +0000
From: Y Martin <ym2013@riseup.net>
To: Bristol and Bath Linux User Group <bristol@mailman.lug.org.uk>
Subject: Re: [bristol] Mysterious DNS problem
Message-ID: <544531E9.8010604@riseup.net>
Content-Type: text/plain; charset=ISO-8859-1

I dont have resolvconf installed. Also, with
https://leap.se/code/issues/5691, their /etc/resolve.conf keeps being
changed. Mine just stays the same.

Should I install resolvconf?

By the way, my grep -srx "10.24.0.1" is still running(!) Nothing yet..

Zak Wilcox:
> On 20/10/14 11:58, Y Martin wrote:
>> Is there anywhere else except for
>> /etc/resolve.conf that I should be looking?
>
> Yes, resolv.conf is often split up now so that individual applications
> can insert and remove bits; typically /etc/resolvconf/* or somewhere
> similar in /var/run. But it looks to me like your issue is probably:
>
> https://leap.se/code/issues/5691
>
> ...as your exhaustive grep has probably told you by now.
>
> _______________________________________________
> Bristol mailing list
> Bristol@mailman.lug.org.uk
> https://mailman.lug.org.uk/mailman/listinfo/bristol
>

------------------------------

Message: 5
Date: Mon, 20 Oct 2014 16:21:54 +0000
From: Y Martin <ym2013@riseup.net>
To: Bristol and Bath Linux User Group <bristol@mailman.lug.org.uk>
Subject: Re: [bristol] Mysterious DNS problem
Message-ID: <544536A2.9040706@riseup.net>
Content-Type: text/plain; charset=ISO-8859-1

Please disregard my last message.. two typos!! It actually meant to read:

I dont have resolvconf installed. Also, with
https://leap.se/code/issues/5691, their /etc/resolv.conf keeps being
changed. Mine just stays the same.

Should I install resolvconf?

By the way, my grep -srx "10.42.0.1" is still running(!) Nothing yet..

Y Martin:
> I dont have resolvconf installed. Also, with
> https://leap.se/code/issues/5691, their /etc/resolve.conf keeps being
> changed. Mine just stays the same.
>
> Should I install resolvconf?
>
> By the way, my grep -srx "10.24.0.1" is still running(!) Nothing yet..
>
>
> Zak Wilcox:
>> On 20/10/14 11:58, Y Martin wrote:
>>> Is there anywhere else except for
>>> /etc/resolve.conf that I should be looking?
>>
>> Yes, resolv.conf is often split up now so that individual applications
>> can insert and remove bits; typically /etc/resolvconf/* or somewhere
>> similar in /var/run. But it looks to me like your issue is probably:
>>
>> https://leap.se/code/issues/5691
>>
>> ...as your exhaustive grep has probably told you by now.
>>
>> _______________________________________________
>> Bristol mailing list
>> Bristol@mailman.lug.org.uk
>> https://mailman.lug.org.uk/mailman/listinfo/bristol
>>
>
>
> _______________________________________________
> Bristol mailing list
> Bristol@mailman.lug.org.uk
> https://mailman.lug.org.uk/mailman/listinfo/bristol
>

------------------------------

_______________________________________________
Bristol mailing list
Bristol@mailman.lug.org.uk
https://mailman.lug.org.uk/mailman/listinfo/bristol

End of Bristol Digest, Vol 573, Issue 3
***************************************