Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Local hostnames without root/admin

news.ycombinator.com

Post reply on HN
Print view View original

31–35 of 35 posts

Re: Ask HN: Local hostnames without root/admin

#31

Post by 2bluesc »

You can use the linker to preload `nss_wrapper`[0] and overwrite anything using `nss`.

Here's an example:

  > cat hosts
  198.51.100.33 test.tld
  2001:db8::33 test.tld
  198.51.100.12 test4.tld
  2001:db8::12 test6.tld

  > LD_PRELOAD=/nix/store/sw2r0gpi9c9rsvqgvi4906yxh948ydsv-nss_wrapper-1.1.16/lib/libnss_wrapper.so NSS_WRAPPER_HOSTS=hosts getent ahosts test.tld
  198.51.100.33   DGRAM  test.tld
  198.51.100.33   STREAM test.tld
  2001:db8::33    DGRAM
  2001:db8::33    STREAM

  > LD_PRELOAD=/nix/store/sw2r0gpi9c9rsvqgvi4906yxh948ydsv-nss_wrapper-1.1.16/lib/libnss_wrapper.so NSS_WRAPPER_HOSTS=hosts getent ahosts test4.tld
  198.51.100.12   DGRAM  test4.tld
  198.51.100.12   STREAM test4.tld

  > LD_PRELOAD=/nix/store/sw2r0gpi9c9rsvqgvi4906yxh948ydsv-nss_wrapper-1.1.16/lib/libnss_wrapper.so NSS_WRAPPER_HOSTS=hosts getent ahosts test6.tld
  2001:db8::12    DGRAM  test6.tld
  2001:db8::12    STREAM test6.tld

  > LD_PRELOAD=/nix/store/sw2r0gpi9c9rsvqgvi4906yxh948ydsv-nss_wrapper-1.1.16/lib/libnss_wrapper.so NSS_WRAPPER_HOSTS=hosts curl -v test.tld
  * Host test.tld:80 was resolved.
  * IPv6: 2001:db8::33
  * IPv4: 198.51.100.33
  *   Trying [2001:db8::33]:80...
  *   Trying 198.51.100.33:80...
[0] https://cwrap.org/nss_wrapper.html

Re: Ask HN: Local hostnames without root/admin

#32

Post by 2bluesc »

GoblinSlayer wrote: post #21

If your programs use glibc, it supports hosts overrides in an environment variable, forgot which.

`HOSTALIASES` lets you alias hostnames, but not map hostnames to IPs.

Docs at `man gethostbyname`

https://man7.org/linux/man-pages/man3/gethostbyname.3.html

Re: Ask HN: Local hostnames without root/admin

#33

Post by bawolff »

galaxy_gas wrote: post #15
bawolff wrote: post #14

Earlier quoted context omitted.

> https://en.wikipedia.org/wiki/DNS_rebinding protection will stop this from working "hopefully" ;) Does anyone actually ban 127 resolution to stop dns rebinding? I feel like that would probably break a lot of things while not actually preventing dns rebinding.

https://docs.google.com/document/d/1QQkqehw8umtAgz5z0um7THx-... is in Beta channel now

As far as i understand, that does not ban resolving dns addresses to localhost.
Post reply on HN