Today my Linux VPS on cluster 1 started showing strange behavior. It turned out that suddenly “localhost” resolved to some IP address somewhere in Vietnam (222.255.15.123).
After checking config files and ssh access logs, I couldn’t find anything out of the ordinary. Restarting the nscd daemon fixed the problem, which leads me to think that some kind of DNS poisoning attack was being used.
The installed package is “nscd-2.2.5-44”, which is no doubt ancient. Attempting to update a Red Hat 7.3 distro is a pain in the butt though, and being used to Debian myself isn’t much help
Was there ever a problem in nscd that could cause this, and is there some way to update the version without manually updating all kinds of libraries manually and getting version conflict galore?
Not really much of a way to update, I think that is actually ‘upgraded’ at the host node level to Centos 3 series, as they used the same kernel revisions it was doable.
This will really be best for Tanmaya to answer, but figured I’d mention that on the host level side, if you want to look for centos3 packages, that may do the trick as well.
I think the problem is close, but that can’t be the entire story… I noticed that the reverse DNS was indeed “localhost”. Triggering a reverse DNS lookup would be as easy as making a connection attempt over SSH, so that would be pretty easy to pull off.
It’s not quite as easy though, at least this doesn’t reproduce the problem:
[marcel@vps marcel]$ host 222.255.15.123
123.15.255.222.in-addr.arpa domain name pointer localhost.
[marcel@vps marcel]$ ping localhost
PING vps.mydomain (127.0.0.1) from 127.0.0.1 : 56(84) bytes of data.
