Hacker Read top | best | new | newcomments | leaders | about | bookmarklet login

The patch available doesn’t patch the issue for non domain joined machines or Linux hosts the last time I checked. To do that you need to manually set a registry key.

See step 3a in the following link for a guide on how to set the registry key. https://support.microsoft.com/en-ca/help/4557222/how-to-mana...



sort by: page size:

Customers are already filling up our support inbox, so same here. They can access nic.io

Any quick fix ideas I can get to a customer without technical command-line experience? Changing DNS or modifying hosts file is not really an option.


Can you explain the problem a bit more? The article mentioned their setup, and how they fixed the problem, but didn't exactly specify the problem.

I run multiple subnets on one broadcast domain, although not with Linux, and haven't noticed any issues with host reachability, so what am I missing?


"works"

They closed this super-critical bug despite not fixing it, claiming they're making the right decision in their implementation when they in fact misread the spec

https://github.com/systemd/systemd/issues/2514

Yeah, that's right, with resolved you cannot connect to other machines on your local network by specifying their simple names, because it blackholes those requests, and there's nothing you can do about it.


i intend to look again this evening - i may well have made a mistake, but i couldn't understand what was happening (i am on linux, restarted firefox, and also restarted nscd; i didn't modify hosts, but did add a master record for the domain to my local network's name server - "host" and firefox were, apparently, inconsistent) (i was so surprised i went into the code and checked it was using a name and not a numerical address...)

Part of the problem is that NETBIOS allowed _ in hostnames but forbade - and Microsoft didn’t address the incompatibility by doing any hostname character translation between the Internet and NETBIOS worlds.

I don't think it has anything to do with DNS rebinding, but it seems like it would have a lot to do with having unauthenticated RPC services bound to localhost.

I'd bet it was network access. It's a bizarre and common problem (I see more people commenting on the issues all the time) which you can kind of fix by forcing 8.8.8.8 or a different nameserver into /etc/resolv.conf but it's unclear to me why this doesn't work out of the box.

> The simple fix is to replace it with '.dell.com', but they didn't do that.

That would be, if it were not for...

$ dig localhost.dell.com

; <<>> DiG 9.9.5-3ubuntu0.5-Ubuntu <<>> localhost.dell.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56836 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4000 ;; QUESTION SECTION: ;localhost.dell.com. IN A

;; ANSWER SECTION: localhost.dell.com. 462 IN A 127.0.0.1


Thanks for highlighting this.

This fix is to demonstrate more sophisticated fixes, and it does require human input to determine the correct domain and IP config. We are introducing in the product for the ability for humans to add additional context pre-fix generation, provide feedback to generate a new fix after it's been generated and edit the proposed fix. Users have asked for these tools because of scenarios that require more insight.


Much appreciated! For those not using luci:

    --- /etc/config/dhcp   2022-09-12 14:50:14.763209067 +0900
    +++ /etc/config/dhcp   2022-09-12 14:49:55.655208527 +0900
    @@ -1,6 +1,6 @@
    
     config dnsmasq
    -       option domainneeded '1'
    +       option domainneeded '0'
            option boguspriv '1'
            option filterwin2k '0'
            option localise_queries '1'

Shame, that used to be the old trick to get windows to resolve local domains

Not sure if I understand the issue completely but if you have problem with the dynamic IP addresses in LAN and don't want to fix the addresses you can use .local domains (this works in Apple and Linux worlds, in Windows you need LLMNR), i.e. connect to yourhostname.local instead of 192.168.x.somerandomnumber.

Correction:

Replace 127.0.0.1 with an appropriate address for computers on the LAN, e.g., RFC 1918 192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12.


Thanks, I didn't pay enough attention to that.

A simple fix is to run some `iptable` commands in the discovery service and allow only the servers listed in `announce/services` to connect.


SNI is supposed to fix the SSL + virtual hosts problem, but XP doesn't support it, unfortunately.

http://en.wikipedia.org/wiki/Server_Name_Indication

http://en.wikipedia.org/wiki/Transport_Layer_Security#Suppor...


Sure thing. It was just so weird before that they had implemented the NPN extension into their ServerHello, but only advertised http/1.1. Its possible I'm just in a big A/B testing group, but unlikely. Really should have a way to poll hostnames and look for changes like this

Weird, I asked our TS admin to disable "override local DNS" and he claimed the option was disabled out, seemingly due to magic DNS being enabled or something. I'll see if I can get access myself to try and change it. Thank you for the reply!

Back in 2014 I was trying to set up a Linux machine and bind it to the active directory domain at work. The active directory domain was a .local domain, but avahi Daemon thanks any packet that's bound for a DOT local address is addressed to it. So it would swallow up all the packets that were headed to the domain controller, look at them, think they were weird and not understand them and then drop them on the floor. From my perspective it looked like the firewall just hated me.

It was like a week or two later until I finally went to my friend and said I must be stupid but I can't do this it's not working and he just disabled the avahi daemon and everything started working again.

Blarg.


It turns out the ifconfig command does not provide any default subnet mask parameters. That is done inside the kernel. Changing the kernel would break backwards compatibility.

https://github.com/openbsd/src/blob/0970cb57551e0e8df6688f8a...

https://github.com/torvalds/linux/blob/cb8e59cc87201af93dfbb...

next

Legal | privacy