Kicksecure /etc/hostname /etc/hosts

nurmagoz · December 26, 2020, 5:33pm

whenever you type sudo something it says:

sudo: unable to resolve host localhost.localdomain: Name or service not known

Patrick · December 27, 2020, 9:37am

Confirmed bug. Workaround:

sudo hostname localhost

Patrick · December 29, 2020, 3:17pm

Apparently there is no real default hostname. By Debian default, /etc/hostname and /etc/hosts is not managed by any package. For Debian installations that file is generated by Debian installer.

I thought by writing localhost into /etc/hostname during Kicksecure build process could be avoided to have /etc/hostname or /etc/hosts managed by any package in Kicksecure. And then later user can just customize it if needed. But that does not work…

Even though /etc/hosts by default (as created by grml-debootstrap)…

github.com

grml/grml-debootstrap/blob/master/chroot-script#L430


      
                   b='2'
                 else
                   # shellcheck disable=SC2086
                   echo root:"$a" | chpasswd $CHPASSWD_OPTION
                   unset a
                   unset b
                 fi
               done
            fi
          }
          # }}}
          
          # set up /etc/hosts {{{
          hosts() {
            if ! [ -f /etc/hosts ] ; then
               cat > /etc/hosts << EOF
          127.0.0.1       localhost
          ::1             localhost ip6-localhost ip6-loopback
          ff02::1         ip6-allnodes
          ff02::2         ip6-allrouters
          EOF

Already contains:

127.0.0.1       localhost

Other VM creation tools (example: grml-debootstrap(8)) set /etc/hostname to something (example: grml).

I wonder where Debian is getting the .localdomain part from anyhow? It is nowhere to be found in folder /etc.

https://lists.debian.org/debian-devel/2005/10/msg00387.html

Git HEAD: Host's hostname leaks into system being installed

opened 06:51PM - 20 Feb 15 UTC

hartwork

help wanted

Even without custom pre/chroot/post scripts, there are places where the host's h…ostname (i.e. the one of the machine executing grml-deboostrap) leaks into the system being installed. The consequences are: - A "broken" postfix setup - Information disclosure These are step to reproduce on the shell: ``` $ sudo grml-debootstrap --hostname hostname-leak-demo --vmfile --target hostname-leak-demo.img --password .... --release wheezy $ mkdir hostname-leak-demo.d $ sudo kpartx -a -p p hostname-leak-demo.img $ mount /dev/mapper/loop1p1 hostname-leak-demo.d $ sudo mount /dev/mapper/loop........p1 hostname-leak-demo.d $ sudo chroot hostname-leak-demo.d /bin/fgrep -Rl "$(hostname)" /etc/ 2>/dev/null /etc/aliases.db /etc/lvm/backup/hidden1 /etc/lvm/backup/hidden2 /etc/ssh/ssh_host_rsa_key.pub /etc/ssh/ssh_host_ecdsa_key.pub /etc/ssh/ssh_host_dsa_key.pub /etc/postfix/main.cf ``` I'm currently experimenting with a workaround. The idea is to add a script `/usr/local/sbin/hostname` with content ``` #! /bin/bash cat /etc/hostname ``` It does seem to help for postfix, but it's not waterproof, e.g. SSH public keys keep leaking. PS: I'm running grep inside the chroot since absolute symlinks go to the host system, otherwise.

nurmagoz · December 30, 2020, 3:28am

solved (message gone) by:

go to /etc/hosts

change:

127.0.0.1 localhost

to

127.0.0.1 localhost.localdomain localhost

[Ref]

Patrick · December 30, 2020, 2:37pm

I don’t want to add this by default. Not sure you suggested that but in case if anyone interprets it as such as suggestion, here’s why.

This long thread and who knows where it even started looks rather complicated:

https://lists.debian.org/debian-devel/2005/10/threads.html#00194

Might argue somewhere against .localdomain such as here:

https://lists.debian.org/debian-devel/2005/10/msg00387.html

Since some modification must be shipped anyhow, and since there is no generic default / convention for default host name, can as well as also add a “proper” hostname, i.e. not localhost.

Will probably use same settings in Kicksecure as in Whonix. I.e. default hostname host.

github.com

Whonix/whonix-base-files/blob/master/etc/hosts.whonix

## Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

#### meta start
#### project Whonix
#### category networking and dns
#### description
## Debian default /etc/hosts + Anonymity Distribution specific additions.
##
## Currently only <code>127.0.0.1 host.localdomain host</code> gets added.
#### meta end

## Anonymity Distribution /etc/hosts

## Defaults
127.0.0.1       localhost
::1             localhost ip6-localhost ip6-loopback
fe00::0         ip6-localnet
ff00::0         ip6-mcastprefix
ff02::1         ip6-allnodes

This file has been truncated. show original

I.e. package kicksecure-base-files effectively shipping files:

/etc/hostname
/etc/hosts

Unless there are better suggestions for default hostname / hosts file / implementation details.

Patrick · January 1, 2021, 9:02pm

Now I remember why I didn’t want to add files /etc/hostname and /etc/hosts into packages. This is because for Kicksecure we’ll be needing to rely distro morphing installation method for the server use case for a while. Users using VPS will probably have no other chance than telling their VPS provider to install Debian and then sudo apt install kicksecure-cli. In that case, the installed packages shouldn’t modify the server’s existing /etc/hostname and /etc/hosts. Therefore for Kicksecure builds, these files need to be auto generated during the build process so that these aren’t managed by any packages.

nurmagoz · January 2, 2021, 3:00pm

But many of the VPS now providing freedom of uploading your own distro
ISO, So not really every host provider this applies to it.

Patrick via Whonix Forum:

Patrick · January 3, 2021, 6:47am

I see. I didn’t notice or overlooked that. Good to know.

Patrick · August 19, 2022, 12:38pm

Inside a Kicksecure VM…

cat /etc/hostname

localhost

Looks correct.

cat /etc/hosts

127.0.0.1 localhost
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

Looks also correct.

dsudo test

No output as expected (no error message), also ok.

hostname

localhost.localdomain

This is wrong.

Why is that? Related to network manager, DHCP?

Patrick · August 19, 2022, 12:41pm

Related to network manager…

Quote NetworkManager.conf(5) — network-manager — Debian bookworm — Debian Manpages

hostname-mode

Set the management mode of the hostname. This parameter will affect only the transient hostname. If a valid static hostname is set, NetworkManager will skip the update of the hostname despite the value of this option. An hostname empty or equal to ‘localhost’, ‘localhost6’, ‘localhost.localdomain’ or ‘localhost6.localdomain’ is considered invalid.

Bingo.

Patrick · August 19, 2022, 12:56pm

This will be fixed after updates.

(The following file will solve it.)

github.com

Kicksecure/kicksecure-network-conf/blob/master/etc/NetworkManager/conf.d/20_kicksecure-network-conf.conf

## Copyright (C) 2022 - 2022 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

## fixes `hostname` showing `localhost.localdomain` instead of `localhost`
## which can lead to issues.
##
## The hostname is set to `localhost` in `/etc/hostname` already in VMs anyhow.
## However, NetworkManager considers that an invalid hostname and therefore changes it.
## Therefore NetworkManager hostname management is disabled here.
##
## There is no indication that this is security critical.
## The user is free to undo this setting.
##
## This is useful in redistributed (downloadable) Kicksecure VMs.
## This might not be needed or useful in different VMs (such as on a VPS) or
## the host operating system.
##
## https://forums.whonix.org/t/kicksecure-etc-hostname-etc-hosts/10919
[main]
hostname-mode=none