Understanding 0.0.0.0 in /etc/hosts

ldt

I'm a little confused about the meaning of the address 0.0.0.0 in Lab 35.2. Looking at the list of addresses in hosts.txt I get the impression that adding these to /etc/hosts should block them. But it doesn't. Taking adgrx.com as an example, I can ping it and its IP address is 144.217.74.222 and I can view it in a browser. After appending hosts.txt to /etc/hosts it pings at 127.0.0.1. But it still comes up in the browser, even after I clear the cache and do a hard reload. The ping at 127.0.0.1 I kind of get, but not completely. But I would expect to get a "page not found" in the browser. Can somebody explain this to me? Thanks. I'm using Firefox in a virtual Ubuntu 18.04.

GRO 108

It could be DNS caching. This can be setup as a service on the system or the browser could be using it's own.

There's some helpful info in this CentOS forum thread https://forums.centos.org/viewtopic.php?t=60089

lee42x

Setting an address to 0.0.0.0 in /etc/hosts will cause the site to be inaccessible as you mentioned.

In your environment, use the "host " command to check the IP address, if it resolves to 0.0.0.0 there will be no output from the "host" command. This will confirm you system is looking at the /etc/hosts file for name resolution as expected.
Mine looked like this:

lee@yoga:/tmp$ host adgrx.com
adgrx.com has address 144.217.74.222
lee@yoga:/tmp$ sudo sh -c "echo 0.0.0.0 adgrx.com >> /etc/hosts "
lee@yoga:/tmp$ host adgrx.com
lee@yoga:/tmp$

When I tried the text browser with the name resolving to 0.0.0.0 :

lee@yoga:/tmp$ elinks --dump http://adgrx.com
ELinks: Connection refused

Removing the entry from /etc/hosts and rerunning the web request and counting the number of lines of text returned:

lee@yoga:/tmp$ sudo awk -i inplace '!/0.0.0.0 adgrx.com/' /etc/hosts
lee@yoga:/tmp$ elinks --dump http://adgrx.com | wc -l
322

As you can see many lines of information were returned.

If your results are different then:
Are you using one of the Linux Foundation VM's ?

Lee

ldt

GRO 108:
Thanks for your suggestions.

student@ubuntu:~$ cat /etc/resolv.conf
nameserver 127.0.0.53
options edns0
search localdomain

Not sure what this means or how to go about clearing the DNS cache or even if it is possible. I'm pobably just being dense, but I found the CentOS discussion to be inconclusive. Also, see below, I have the same problem with an address that Firefox never would have had a chance to cache.

lee42x:
Playing around with your very helpful comments, I’m getting a mixed bag of results. I’ve tried this with a couple of virtual machines. I’m using VMware Workstation 15 Player. Ubuntu 18.04 is the Linux Foundation pre-built virtual machine. CentOS 8 I installed from its .iso file.

Ubuntu:
I double checked everything. Using “host” and “elinks” I get the same result you do before and after the /etc/hosts update. ("sudo apt install elinks" worked out of the box) However, Firefox still insists on loading the actual website page. I’ve cleared the cache and retyped adgrx.com (because it had redirected). Nothing seems to block it. I also tried another address, adperium.com, which never was in the Firefox cache and even though elinks returns “Connection refused”, Firefox gets the real web page from the Internet in both cases.

student@ubuntu:~/temp$ host adgrx.com
adgrx.com has address 144.217.74.222
student@ubuntu:~/temp$ elinks -dump adgrx.com
… lots of stuff …
student@ubuntu:~/temp$ host adperium.com
adperium.com has address 188.166.49.116
student@ubuntu:~/temp$ elinks -dump adperium.com
… lots of stuff …
student@ubuntu:~/temp$ sudo sh -c "cat hosts.txt >> /etc/hosts"
student@ubuntu:~/temp$ host adgrx.com
student@ubuntu:~/temp$ host adperium.com
student@ubuntu:~/temp$ elinks --dump adgrx.com
ELinks: Connection refused
student@ubuntu:~/temp$ elinks --dump adperium.com
ELinks: Connection refused

But Firefox, after clearing the cache, can reach both of these pages. On this machine I’ve never tried the adperium.com address, so it can’t be a cache problem. ???

CentOS 8:
yum can’t find elinks, so I don’t have this utility here. But what is weird here is that “host” returns the IP address 144.217.74.222 both before and after updating “/etc/hosts” with hosts.txt. But Firefox, after clearing the cache, now returns “unable to connect” as expected.

[student@localhost temp]$ host adgrx.com
adgrx.com has address 144.217.74.222
[student@localhost temp]$ host adperium.com
adperium.com has address 188.166.49.116
[student@localhost temp]$ sudo sh -c "cat hosts.txt >> /etc/hosts"
[sudo] password for student:
[student@localhost temp]$ host adgrx.com
adgrx.com has address 144.217.74.222
[student@localhost temp]$ host adperium.com
adperium.com has address 188.166.49.116
[student@localhost temp]$ ping adgrx.com
PING adgrx.com (127.0.0.1) 56(84) bytes of data.
64 bytes from localhost (127.0.0.1): icmp_seq=1 ttl=64 time=0.061 ms
[student@localhost temp]$ ping adperium.com
PING adperium.com (127.0.0.1) 56(84) bytes of data.
64 bytes from localhost (127.0.0.1): icmp_seq=1 ttl=64 time=0.055 ms

But Firefox now returns “Connection refused” for both of these pages. ???

So I’m getting different results from the two OSs but neither one of the is exactly what I expected.

luisviveropena

Hi @ldt ,

1.- I did a test on Ubuntu 18.04 from the command line, with the "host" command and it worked. So, for Ubuntu 18.04, is it only the browser that's not working as expected?

2.- For installing elinks on CentOS 8 I did the following:

[root@centos8server ~]# dnf search elinks
Last metadata expiration check: 1 day, 15:14:50 ago on Mon 03 Aug 2020 07:42:21 AM -05.
No matches found.
[root@centos8server ~]# dnf repolist 
repo id                            repo name
AppStream                          CentOS-8 - AppStream
BaseOS                             CentOS-8 - Base
extras                             CentOS-8 - Extras

That's all the repos enabled by default. But "elinks" is in the PowerTools one. So let's use it:

[root@centos8server ~]# dnf --enablerepo=PowerTools install elinks
CentOS-8 - PowerTools                            71 kB/s | 1.9 MB     00:27    
Last metadata expiration check: 0:00:23 ago on Tue 04 Aug 2020 10:59:03 PM -05.
Dependencies resolved.
================================================================================
 Package       Architecture  Version                    Repository         Size
================================================================================
Installing:
 elinks        x86_64        0.12-0.58.pre6.el8         PowerTools        916 k

Transaction Summary
================================================================================
Install  1 Package

Total download size: 916 k
Installed size: 2.9 M
Is this ok [y/N]: y
Downloading Packages:
elinks-0.12-0.58.pre6.el8.x86_64.rpm             45 kB/s | 916 kB     00:20    
--------------------------------------------------------------------------------
Total                                            43 kB/s | 916 kB     00:21     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1 
  Installing       : elinks-0.12-0.58.pre6.el8.x86_64                       1/1 
  Running scriptlet: elinks-0.12-0.58.pre6.el8.x86_64                       1/1 
  Verifying        : elinks-0.12-0.58.pre6.el8.x86_64                       1/1 
Installed products updated.

Installed:
  elinks-0.12-0.58.pre6.el8.x86_64                                              

Complete!

You can check on the available repos on CentOS 8 here:

https://wiki.centos.org/AdditionalResources/Repositories

Many regards,
Luis.

lee42x

Please confirm the contents of /etc/resolv.conf (cat /etc/hosts) and the "hosts" entry from /etc/nsswitch.conf ( grep hosts /etc/nsswitch).
Thanks Lee

ldt

luis:
1)-Yes, on Ubuntu the only problem is with the browser so I'm going to let that one go. I think Firefox does some of its own dns work but I'm not going to spend any time looking into that.

2)-I got elinks working on CentOS 8. Thanks for your help. Love the tool.

3)-My remaining problem is that on CentOS 8, host returns the actual URL both with and without 0.0.0.0. That is:

[student@localhost temp]$ host adgrx.com
adgrx.com has address 144.217.74.222
[student@localhost temp]$ sudo sh -c "cat hosts.txt >> /etc/hosts"
[sudo] password for student: 
[student@localhost temp]$ host adgrx.com
adgrx.com has address 144.217.74.222
[student@localhost temp]$ cat /etc/hosts | grep adgrx.com
0.0.0.0 adgrx.com

This I still don't understand.

lee42x:

[student@localhost temp]$ cat /etc/resolv.conf
# Generated by NetworkManager
search localdomain
nameserver 192.168.211.2

[student@localhost temp]$ grep hosts /etc/nsswitch.conf
#     hosts: files dns
#     hosts: files dns  # from user file
# Valid databases are: aliases, ethers, group, gshadow, hosts,
hosts:      files dns myhostname

Not sure what I'm looking for here or what this means.

lee42x

I can help there, line 5 contains the name server to use for name
resolution.
Line 10 says look in the file, /etc/hosts first then ask the dns name server.

Lee

lee42x

ldt, Luis,

I can confirm that CentOS-8 is not behaving as expected for this lab. The "host" program does not appear to be looking in the /etc/hosts file for name resolution, effectively ignoring the /etc/nsswitch order of resolution and using only dns services.

Many things need to be verified before declaring a bug, so for now please be aware.

Lee