Ask Ubuntu General Room

Serg

9:02 PM

3 pm . . . I guess i gotta get ready and go

Kaz Wolfe

your router has an admin password?

that sounds like a bad idea. a firewall that blocks any sort of external connection to the router ACP sounds better

And, if you just use ssh to connect and have no ACP at all...

Serg

@KazWolfe I've ssh and telnet all disabled. The only way to connect is via the router's html page on LAN

Thomas Ward

@Zacharee1 sorry?

Serg

also admin password and username are non default. Good luck trying to brute it

Kaz Wolfe

good luck trying to bruteforce an RSA4096 key whilst being on our network.

Serg

9:06 PM

hehe , don't compare your university's network to a residential one

Kaz Wolfe

this is my personal network

Serg

ah, well congrats then

Byte Commander

Paranoid Wolfe?

Kaz Wolfe

i mean our WAPs are secured with default credentials, but you can only get to them from the management subnet.

Edity

LOL

Kaz Wolfe

9:11 PM

so... yeah

David

@KazWolfe Know's Imma hack him ^v^

Kaz Wolfe

good luck getting on the wifi in the first place

Zacharee1

@ThomasWard hack @Serg's router

Kaz Wolfe

then good luck getting on the management subnet

Thomas Ward

lurks in the corner with high-grade security

Kaz Wolfe

9:12 PM

then good luck literally doing anything

David

I'll just have my hackbot do it

Fabby

Good night all. Shutting down work computer and going to watch a movie with a big bag of crisps and a glass of rum & coke!

Nathan Osman

@Fabby Not on Netflix, you're not :D

David

LOLLLL

Thomas Ward

@NathanOsman is that down for you?

Fabby

9:13 PM

I like my stuff stored locally, thanks!

Nathan Osman

I don't use Netflix, but stuff is down, yeah.

Zacharee1

Netflix is fine

Thomas Ward

@NathanOsman it's up here.

Nathan Osman

@ThomasWard I ran into problems this morning with registry.npmjs.org but clever me was able to add an entry to /etc/hosts to work around the problem.

David

shudders Windows

Thomas Ward

9:14 PM

@NathanOsman mmm, well, Netflix IPs are cached in my two recursive resolvers on my network so...

Nathan Osman

GitHub just announced they've switched DNS providers.

Zacharee1

to?

Edity

oooo

Nathan Osman

@ThomasWard Fair enough.

@Zacharee1 They haven't said.

Kaz Wolfe

so... @David, try hacking me.

Nathan Osman

9:15 PM

status.github.com

David

Hackbot time

Nathan Osman

@KazWolfe Hackety hack hack...

Zacharee1

good idea I guess @NathanOsman

Kaz Wolfe

good luck

Edity

~~08:35 New Zealand Standard Time~~ We have migrated to an unaffected DNS provider. Some users may experience problems with cached results as the change propagates.

David

9:16 PM

Who's that from?

Edity

GitHub

Thomas Ward

github directly, @David

David

:o

Edity

@David ???

David

GitHub's completely ignoring this on social media lmfao

Thomas Ward

9:19 PM

social media's been torpedoed by the DDoS on DNS, too.

Nathan Osman

Maybe they can't access social media :P

Twitter, anyway.

David

tru

Is PoodleCorp Behind the Massive DDoS Attack on October 21? - Heavy.com j.mp/2eC9RsM #Anonymous

No they aren't

Kaz Wolfe

CALLED IT

David

But good try

user136984

DDoS? What's happening?

David

9:22 PM

How have you not heard

there's like an internet-wide-ddos happening

Serg

@ParanoidPanda in a nutshell somebody is dossing DynDNS

user136984

Oh, oh dear...

Serg

And it broke half the interwebs

David

Anonymous is avenging Julian Assange

user136984

I've been out all day.

Kaz Wolfe

9:23 PM

nobody is avenging anybody

Serg

GitHub, Amazon, Paypal , Spotify, AirBnB

Nathan Osman

In a quiet voice: my websites are still up!

Thomas Ward

whispers loudly MINE TOO!

Serg

I am more willing to bed it's Russians

Kaz Wolfe

people's websites are down?

Edity

9:23 PM

hope StackExchange doesn't crash

Kaz Wolfe

they're not going to

Nathan Osman

@ParanoidPanda here's the list: en.wikipedia.org/wiki/…

Thomas Ward

@Edity they did. It came back up in fifteen milliseconds.

it was the lag :P

Kaz Wolfe

unless AWS gets DDOS'd

Nathan Osman

AWS was partly affected.

David

9:24 PM

RUNESCAPE XDD

Kaz Wolfe

@ThomasWard SO complained that APIs didn't work :D

Serg

DNS is very, very old and ancient , and it needs to be fixed

Edity

@ThomasWard impossible

Serg

having root servers ( which iirc are 7 around the world ) is bad juju

Thomas Ward

@Serg pretty sure most of the root servers are multicasted

Serg

9:26 PM

@ThomasWard which means ?

Thomas Ward

query goes to one of the listed 'root nameservers' and it actually goes to somewhere else

and no I don't mean mDNS

Nathan Osman

Wait, that's not the right article.

Thomas Ward

Multicast

In computer networking, multicast (one-to-many or many-to-many distribution) is group communication where information is addressed to a group of destination computers simultaneously. Group communication may either be application layer multicast or network assisted multicast, where the latter makes it possible for the source to efficiently send to the group in a single transmission. Copies are automatically created in other network elements, such as routers, switches and cellular network base stations, but only to network segments that currently contain members of the group. Network assisted multicast...

Serg

somewhere else ? Like where ? there's nothing higher in hierarchy than root DNS server

Nathan Osman

Chuck Norris's DNS server, for one.

(Sorry, I'm sure that wasn't helpful :P)

Edity

9:28 PM

EA deserves to get affected

Thomas Ward

there's 13 root nameservers

iana.org/domains/root/servers

Edity

One time I lost my data from a EA game

Thomas Ward

but i'm pretty certain there's backups beyond those 13 which can get switched into play

Kaz Wolfe

the DNS root servers won't go down

Thomas Ward

and those root nameservers are VERY unlikely to go down

Kaz Wolfe

9:29 PM

And if they do, I think all of the caches of everything hits and... yeah.

Edity

And then I e-mailed then they didn't gimme it back

Serg

unlikely but plausible

Kaz Wolfe

DNS IIRC is actually pretty hard to nuke completely from orbit.

Edity

screw you, EA.

Nathan Osman

@KazWolfe Caching is usually a problem but in this case it is a good thing.

Kaz Wolfe

9:29 PM

i mean, yeah, you can take down something like Dyn, but there are other DNS providers that won't be affected.

Thomas Ward

@KazWolfe EMP the planet and it'll go down, but short of that, yeah

Kaz Wolfe

You'd have to have a massive attack against a lot of providers to kill a complete TLD.

Or something high enough in the root to kill all of that TLD, but that's going to be really aggressively cached.

Thomas Ward

@KazWolfe or planetwide simultaneous EMP blasting

Kaz Wolfe

In fact, that sorta reminds me. Where does the .com TLD root server live? And how can I run my own BIND server as a nameserver?

Serg

OK, I gotta go, i suppose

bye for now

Kaz Wolfe

9:31 PM

i havent done much toying with DNS so...

Thomas Ward

@KazWolfe BIND as a nameserver is easy.

no idea where the TLD root zones exist

Kaz Wolfe

yeah, but i'm not included in any DNS tree.

Thomas Ward

ask IANA or the people owning those zone roots

@KazWolfe I run a group of 5 VPSes that are DNS nameservers for my websites

Kaz Wolfe

So how am I able to register my own domain within the .com tree is basically what i'm confused about.

Thomas Ward

@KazWolfe the path is [rootnameserver] -> TLD root zone -> Registrar-reported DNS nameservers for domain itself -> DNS nameserver for site(s)

for example

Kaz Wolfe

9:33 PM

ah.

Thomas Ward

[root] -> .net root -> dark-net.net -> ns{1,2,3,4,5}.dark-net.net -> [zone data for the domain is on each server]

Kaz Wolfe

so the registrar is responsible for keeping an up-to-date DNS record that points to me.

Thomas Ward

@KazWolfe no.

Kaz Wolfe

well, i should say something that tells the .net root that my NS are available at X.

Thomas Ward

@KazWolfe that'd be a hostname, or a hostname that's a Glue record

% dig @8.8.8.8 NS dark-net.net

; <<>> DiG 9.9.5-3ubuntu0.9-Ubuntu <<>> @8.8.8.8 NS dark-net.net
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32659
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;dark-net.net.			IN	NS

;; ANSWER SECTION:
dark-net.net.		7199	IN	NS	ns3.dark-net.net.
dark-net.net.		7199	IN	NS	ns5.dark-net.net.
dark-net.net.		7199	IN	NS	ns1.dark-net.net.

Kaz Wolfe

9:34 PM

yeah i get the tree hierarchy of stuff like that

Thomas Ward

ns{1,2,3,4,5} is defined by glue records at the registrar

Kaz Wolfe

so registrar glue.

Thomas Ward

which is what's stored in the zone level TLD roots to know exactly where to point to

and then the registrar is configured to point my domain's DNS to the nameservers at ns{1-5}.dark-net.net which are stored in glue records

that said, let's say I use cloudflare

Kaz Wolfe

so when i tell my registrar that my nameserver is at ns1.kazwolfe.io, they add the glue records saying that "kazwolfe.io's nameserver is at ns1.kazwolfe.io", right?

Thomas Ward

I enter CloudFlare DNS name servers into the domain nameserver settings at the registrar

registrar reports to the root zone which nameservers I'm using

TLD root zone updated

@KazWolfe no and it's damned hard to explain

@KazWolfe you have to set up the glue records. At the registrar. Yourself.

the registrar then 'links' that information behind the scenes somewhere

Kaz Wolfe

9:37 PM

Yeah, I get that.

Thomas Ward

where exactly, I don't know

Kaz Wolfe

So there's a DNS entry somewhere on the registrar server that NSes over to me, basically, right?

Thomas Ward

assuming ns1.kazwolfe.io exists and you've configured kazwolfe.io as the nameservers, yes.

but the registrars forward that data up to the root zones

that's how they know where to point to

Kaz Wolfe

So, let's see if I get this.

I go my registrar and say "Hey, my nameserver is at ns1.kazwolfe.io"

They then add this to their controlled root DNS as an NS entry, which is then resolved.

I then have glues/whatevers set up such that I can resolve things.

Thomas Ward

"they" don't control the root DNS

Kaz Wolfe

9:39 PM

Thereby, making my path something like this:

Thomas Ward

they report it to whichever company/entity runs that root zone. but the rest is about accurate.

Kaz Wolfe

yeah, but basically that's the thing.

Thomas Ward

dnsviz.net/d/dark-net.net/dnssec shows the DNS delegation tree pretty usefully.

Kaz Wolfe

My domain name gets a NS entry in some authoritative DNS server somewhere

Thomas Ward

but the way the 'net' zone knows which DNS to point to is because the registrars report it

@KazWolfe yes.

Kaz Wolfe

9:40 PM

so basically whoever runs .io keeps a record of every .io and the respective nameservers.

Thomas Ward

mhm

Kaz Wolfe

and my domain has a NS entry in that.

Thomas Ward

same for .net .info, etc.

yep

Nathan Osman

I want to run the nameservers for .stupid

Just sayin'

Kaz Wolfe

And all the registrar does is tell whoever runs .io that "Hey, we have a new domain here, here's the NS, take it and deal with it pls"

Thomas Ward

9:41 PM

and then it's up to those nameservers to be configured correctly for the domain/zone

it gets more confusing when you have subdomain DNS delegation

Kaz Wolfe

so basically it's just NS records all the way down until someone finds an A record.

Thomas Ward

or a CNAME, or an AAAA, or the actual record type being searched for. Including but not limited to NS records.

@KazWolfe if you want to see the whole DNS query chain... dig +trace some-domain

Kaz Wolfe

okay so i see

Thomas Ward

% dig +trace @8.8.8.8 google.com

; <<>> DiG 9.9.5-3ubuntu0.9-Ubuntu <<>> +trace @8.8.8.8 google.com
; (1 server found)
;; global options: +cmd
.			1725	IN	NS	a.root-servers.net.
.			1725	IN	NS	b.root-servers.net.
.			1725	IN	NS	c.root-servers.net.
.			1725	IN	NS	d.root-servers.net.
.			1725	IN	NS	e.root-servers.net.
.			1725	IN	NS	f.root-servers.net.
.			1725	IN	NS	g.root-servers.net.
.			1725	IN	NS	h.root-servers.net.
.			1725	IN	NS	i.root-servers.net.
.			1725	IN	NS	j.root-servers.net.
.			1725	IN	NS	k.root-servers.net.

Kaz Wolfe

[root-server] -> ns.io -> digitalocean -> kazwolfe.io

Thomas Ward

9:44 PM

@KazWolfe assuming you're using DigitalOcean DNS, then yes.

Kaz Wolfe

well i am so...

that makes sense

Thomas Ward

yup

I used to use ZoneEdit, and then Gandi DNS. Got angry at the delay for DNS updates/propagation so started running my own DNS servers

Kaz Wolfe

so what do DNS servers like Google do?

Thomas Ward

recursive resolvers, possibly even authoritative.

they don't directly own any zones, they simply query the tree to get data for DNS requests

like the DNS server I run on my laptop. And the two recursive resolvers on my network here at home.

Kaz Wolfe

so it's something to prevent me from having to manually query for the entire chain, basically?

Thomas Ward

9:47 PM

Can't comment reliably either way

it may be better to consider it from the point of my resolvers on my network.

Kaz Wolfe

but if I, locally, am still querying things, why do these record servers exist?

Thomas Ward

@KazWolfe abiguous question?

@KazWolfe so you don't have to run your own and have to deal with individual caches on your system or having to generate a buttload more queries for DNS for each lookup?

Kaz Wolfe

But I can just query ., can't I?

Thomas Ward

@KazWolfe that gets you bupkes

@KazWolfe dig lists the 'root nameservers'

dig . just queries for the existence of an A record for .

which doesn't exist

Kaz Wolfe

i mean, the only thing i can see is if i'm querying things myself, I need to download all of the zones manually and parse through them.

Thomas Ward

9:50 PM

@KazWolfe DNS doesn't work that way

trust me

Kaz Wolfe

DNS is weird and confusing.

Thomas Ward

those trees I explained? Only the lookup trees.

You don't get the whole zones.

Neither do registrars.

Neither do the TLD zones. Nor the root nameservers.

Kaz Wolfe

So, again. If I have an authoritative IP address for ., why can't I just query down from there?

Thomas Ward

I think you should post a question about this on some site. Or better yet, ask ISC.

Fabby

If anyone wants to have a laugh at answer, click here

Nathan Osman

9:51 PM

...and it's over. At least for GitHub.

Byte Commander

Is that correct permissions for a server? askubuntu.com/a/840241/367990

Aaron Hall

Someone's been dos'ing github?

Byte Commander

@NathanOsman Looks like a potential well from quantum physics...

Thomas Ward

@AaronHall not directly

Nathan Osman

@ByteCommander 664 ain't gonna work for PHP :P

Thomas Ward

9:52 PM

DDoS on Dyn (a DNS provider)

Kaz Wolfe

@ByteCommander !!!!!

Thomas Ward

@NathanOsman it actually might

Nathan Osman

@ThomasWard Doesn't PHP refuse to execute files without the execute bit set?

Fabby

@ByteCommander -1

@ByteCommander starred!

Aaron Hall

robustness testing?

Thomas Ward

9:54 PM

looks at MediaWiki running under php5-fpm

@NathanOsman no?

Kaz Wolfe

@Fabby replied!

Fabby

@NathanOsman 644

Thomas Ward

@NathanOsman +x is needed on directories to traverse

not files, as PHP simply needs to read them.

@NathanOsman just like me calling python foo.py and having foo.py not be +x

Nathan Osman

@Fabby the answer said "664" - I was just quoting it.

Fabby

Ah, missed that!

Nathan Osman

9:55 PM

@ThomasWard Oh, I get that. I just thought there was extra logic in the PHP interpreter that caused it to bail if the bit was missing.

user136984

How can one install Arc on 16.10?

Byte Commander

@Fabby Are you sure your partitioning instructions (the glass and the water) are correct? I left a comment.

user136984

Ah, I see, it's the arc-theme package. Never mind! :D

Byte Commander

Also see my old answer there: askubuntu.com/a/659809/367990

Fabby

@bytecommander: water answer adapted.

Byte Commander

9:59 PM

Not about glasses of water, but illustrating the problem with cardboard boxes...

Fabby

:D

I'm going to dupe that one!

Byte Commander

@Fabby you forgot to shrink the glass again - or do we want a big glass?

good idea, VTCed.

bbl

Fabby

@ByteCommander he probably wants a big glass, but I'll adapt again!

user136984

Ah! I now have the Arc theme! It really is a great theme! :)

user136984

They should really include it by default.

Fabby

10:02 PM

Should swap partitions be on a primary partition or can they be in an extended one?

Meh, leaving as is! @ByteCommander

user136984

Well, goodnight folks! :)

Nathan Osman

Goodnight.

Fabby

10:21 PM

Can someone upvote this answer, because it's better then mine!

Serg

mobile.twitter.com/crymora/status/789523002362912768/video/1

funny

Fabby

starred!

Thomas Ward

@Fabby either or, I think

Fabby

Methinks too! ;)

How are ya?

As busy as before?

Or working as a security professional now?

Nathan Osman

10:40 PM

Update: Dyn reports 'incident has been resolved' after 3rd denial of service attack reported http://www.breakingnews.com/t/BgI1

Tweeted by BreakingNews on October 21, 2016 at 10:39 PM

It's over apparently.

IanC

10:56 PM

@Serg I'll take a look in a second at the code!

Transcript for