Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #159620 > unrolled thread

Re: Whitelist security.debian.org

Back to article view | Back to linux.debian.user

Contents

  Re: Whitelist security.debian.org Greencopper <greencoppermine@gmail.com> - 2015-10-22 03:30 +0200
    Re: Whitelist security.debian.org Greencopper <greencoppermine@gmail.com> - 2015-10-22 03:50 +0200
      Re: Whitelist security.debian.org Pascal Hambourg <pascal@plouf.fr.eu.org> - 2015-10-22 09:40 +0200
        Re: Whitelist security.debian.org Sven Hartge <sven@svenhartge.de> - 2015-10-22 11:50 +0200
          Re: Whitelist security.debian.org Brian <ad44@cityscape.co.uk> - 2015-10-22 12:10 +0200
            Re: Whitelist security.debian.org Pascal Hambourg <pascal@plouf.fr.eu.org> - 2015-10-22 21:10 +0200
              Re: Whitelist security.debian.org Brian <ad44@cityscape.co.uk> - 2015-10-22 22:00 +0200
                Re: Whitelist security.debian.org Pascal Hambourg <pascal@plouf.fr.eu.org> - 2015-10-23 00:00 +0200

#159620 — Re: Whitelist security.debian.org

[Multipart message — attachments visible in raw view] — view raw

>> Doing a nslookup on the firewall and on the kids boxes provides the same IP
>> addresses for security.debian.org:
>>
>> # nslookup security.debian.org
>> Non-authoritative answer:
>> Name:   security.debian.org
>> Address: 212.211.132.32
>> Name:   security.debian.org
>> Address: 195.20.242.89
>> Name:   security.debian.org
>> Address: 212.211.132.250
>>
>> And those IPs are added to the whitelist. However, when APT is run:
>>
>> "Could not connect to security.debian.org:http: [IP: 149.20.20.6 80]"
>
> Always the same address ? Or does it change ?
>
>> Where does APT get this IP address from?
>
> /etc/hosts ?
> Any local DNS server ?

There is a local DNS server on the firewall, but that's where the
whitelisted IP address gets generated and the result of the nslookup
is the same whether performed on the box or on any other machine in
the house since they all use the same box.

No, there is nothing in /etc/hosts

Apt-get is getting different results from using "host" or "nslookup".

[toc] | [next] | [standalone]

#159621

[Multipart message — attachments visible in raw view] — view raw

This is actually getting very frustrating!

Doing a nslookup specifying the DNS server provides different results when
done minutes apart!

$ nslookup security.debian.org 208.67.222.222
Server:        208.67.222.222
Address:    208.67.222.222#53

Non-authoritative answer:
Name:    security.debian.org
Address: 149.20.20.6
Name:    security.debian.org
Address: 128.31.0.63
Name:    security.debian.org
Address: 128.61.240.73

Then a couple of minutes after:

nslookup security.debian.org 208.67.222.222
Server:        208.67.222.222
Address:    208.67.222.222#53

Non-authoritative answer:
Name:    security.debian.org
Address: 212.211.132.32
Name:    security.debian.org
Address: 212.211.132.250
Name:    security.debian.org
Address: 195.20.242.89

Most likely OpenDNS has some load balancing of their own perhaps forwarding
the request to different internal servers.

Perhaps the only solution is to fix a specific IP address for
security.debian.org in my local DNS server and then only use that!

On Thu, Oct 22, 2015 at 3:08 AM, Greencopper <greencoppermine@gmail.com>
wrote:

> >> Doing a nslookup on the firewall and on the kids boxes provides the same IP
> >> addresses for security.debian.org:
> >>
> >> # nslookup security.debian.org
> >> Non-authoritative answer:
> >> Name:   security.debian.org
> >> Address: 212.211.132.32
> >> Name:   security.debian.org
> >> Address: 195.20.242.89
> >> Name:   security.debian.org
> >> Address: 212.211.132.250
> >>
> >> And those IPs are added to the whitelist. However, when APT is run:
> >>
> >> "Could not connect to security.debian.org:http: [IP: 149.20.20.6 80]"
> >
> > Always the same address ? Or does it change ?
> >
> >> Where does APT get this IP address from?
> >
> > /etc/hosts ?
> > Any local DNS server ?
>
> There is a local DNS server on the firewall, but that's where the
> whitelisted IP address gets generated and the result of the nslookup
> is the same whether performed on the box or on any other machine in
> the house since they all use the same box.
>
> No, there is nothing in /etc/hosts
>
> Apt-get is getting different results from using "host" or "nslookup".
>
>

[toc] | [prev] | [next] | [standalone]

#159626

Greencopper a écrit :
> 
> Most likely OpenDNS has some load balancing of their own perhaps forwarding
> the request to different internal servers.
> 
> Perhaps the only solution is to fix a specific IP address for
> security.debian.org in my local DNS server and then only use that!

Or don't use OpenDNS servers.

[toc] | [prev] | [next] | [standalone]

#159633

Pascal Hambourg <pascal@plouf.fr.eu.org> wrote:
> Greencopper a écrit :
 
>> Most likely OpenDNS has some load balancing of their own perhaps
>> forwarding the request to different internal servers.
>> 
>> Perhaps the only solution is to fix a specific IP address for
>> security.debian.org in my local DNS server and then only use that!

> Or don't use OpenDNS servers.

Or don't try to build firewall rules based on DNS lookups.

Grüße,
Sven.

-- 
Sigmentation fault. Core dumped.

[toc] | [prev] | [next] | [standalone]

#159634

On Thu 22 Oct 2015 at 11:44:41 +0200, Sven Hartge wrote:

> Pascal Hambourg <pascal@plouf.fr.eu.org> wrote:
> > Greencopper a écrit :
>  
> >> Most likely OpenDNS has some load balancing of their own perhaps
> >> forwarding the request to different internal servers.
> >> 
> >> Perhaps the only solution is to fix a specific IP address for
> >> security.debian.org in my local DNS server and then only use that!
> 
> > Or don't use OpenDNS servers.
> 
> Or don't try to build firewall rules based on DNS lookups.

Or amend sources.list to not require DNS. 149.20.20.6 is schein; use
villa if preferred.

  deb ftp://149.20.20.6/debian-security jessie/updates main

[toc] | [prev] | [next] | [standalone]

#159649

Brian a écrit :
> On Thu 22 Oct 2015 at 11:44:41 +0200, Sven Hartge wrote:
> 
>> Pascal Hambourg <pascal@plouf.fr.eu.org> wrote:
>>> Greencopper a écrit :
>>  
>>>> Most likely OpenDNS has some load balancing of their own perhaps
>>>> forwarding the request to different internal servers.
>>>>
>>>> Perhaps the only solution is to fix a specific IP address for
>>>> security.debian.org in my local DNS server and then only use that!
>>>
>>> Or don't use OpenDNS servers.
>>
>> Or don't try to build firewall rules based on DNS lookups.
> 
> Or amend sources.list to not require DNS. 149.20.20.6 is schein; use
> villa if preferred.
> 
>   deb ftp://149.20.20.6/debian-security jessie/updates main

I don't second that suggestion because it has several drawbacks.
- It cancels the redundancy provided by security.debian.org.
- It does not work with HTTP, so you have to use FTP which is harder to
manage by firewalls.
- If one day this one address does not serve as a Debian security mirror
any more, you're stuck.
- Changing a mirror forces APT to reload all the package list at the
next update. This can be annoying with a low speed link.

I was serious when suggesting not tu use OpenDNS. Why use it if you have
your own local recursive DNS cache ?

[toc] | [prev] | [next] | [standalone]

#159652

On Thu 22 Oct 2015 at 20:51:03 +0200, Pascal Hambourg wrote:

> Brian a écrit :
> > On Thu 22 Oct 2015 at 11:44:41 +0200, Sven Hartge wrote:
> > 
> >> Pascal Hambourg <pascal@plouf.fr.eu.org> wrote:
> >>> Greencopper a écrit :
> >>  
> >>>> Most likely OpenDNS has some load balancing of their own perhaps
> >>>> forwarding the request to different internal servers.
> >>>>
> >>>> Perhaps the only solution is to fix a specific IP address for
> >>>> security.debian.org in my local DNS server and then only use that!
> >>>
> >>> Or don't use OpenDNS servers.
> >>
> >> Or don't try to build firewall rules based on DNS lookups.
> > 
> > Or amend sources.list to not require DNS. 149.20.20.6 is schein; use
> > villa if preferred.
> > 
> >   deb ftp://149.20.20.6/debian-security jessie/updates main
> 
> I don't second that suggestion because it has several drawbacks.
> - It cancels the redundancy provided by security.debian.org.

True. It pins down getting security updates fron a designated IP.

> - It does not work with HTTP, so you have to use FTP which is harder to
> manage by firewalls.

I could not get http to work; don't know why. Any ideas?

> - If one day this one address does not serve as a Debian security mirror
> any more, you're stuck.

Correct. So, use

   deb ftp://schein.debian.org/debian-security jessie/updates main
   deb ftp://villa.debian.org/debian-security jessie/updates main

Untested, so your objection could still stand.

> - Changing a mirror forces APT to reload all the package list at the
> next update. This can be annoying with a low speed link.

Probably not relevant for the OP. But a reasonable point.
 
> I was serious when suggesting not tu use OpenDNS. Why use it if you have
> your own local recursive DNS cache ?

You could be right, I'll not argue that at length. unbound returns

; <<>> DiG 9.9.5-12-Debian <<>> security.debian.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23557
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 3, AUTHORITY: 3, ADDITIONAL: 1

  ;; OPT PSEUDOSECTION:
  ; EDNS: version: 0, flags:; udp: 4096
  ;; QUESTION SECTION:
  ;security.debian.org.           IN      A

  ;; ANSWER SECTION:
  security.debian.org.    300     IN      A       195.20.242.89
  security.debian.org.    300     IN      A       212.211.132.250
  security.debian.org.    300     IN      A       212.211.132.32

  ;; AUTHORITY SECTION:
  security.debian.org.    28800   IN      NS      geo1.debian.org.
  security.debian.org.    28800   IN      NS      geo3.debian.org.
  security.debian.org.    28800   IN      NS      geo2.debian.org.

  ;; Query time: 430 msec
  ;; SERVER: 127.0.0.1#53(127.0.0.1)
  ;; WHEN: Thu Oct 22 20:26:22 BST 2015
  ;; MSG SIZE  rcvd: 153

Traceroutes to the machines in the ANSWER SECTION lead today to wieck.
villa and lobos respectively.

I'm also not inclined to second the suggestion but, failing sorting out
his firewall, it can work for the OP.

[toc] | [prev] | [next] | [standalone]

#159655

Brian a écrit :
> On Thu 22 Oct 2015 at 20:51:03 +0200, Pascal Hambourg wrote:
> 
>> Brian a écrit :
>>>
>>>   deb ftp://149.20.20.6/debian-security jessie/updates main
> 
>> - It does not work with HTTP, so you have to use FTP which is harder to
>> manage by firewalls.
> 
> I could not get http to work; don't know why. Any ideas?

HTTP virtual host setup, I guess. /dists, /pool or /debian-security seem
to only exist in the security.debian.org virtual host on these servers.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web