{"id":10055,"date":"2023-06-08T09:05:09","date_gmt":"2023-06-08T14:05:09","guid":{"rendered":"https:\/\/www.rushworth.us\/lisa\/?p=10055"},"modified":"2023-06-18T10:40:31","modified_gmt":"2023-06-18T15:40:31","slug":"maintaining-an-etc-hosts-record","status":"publish","type":"post","link":"https:\/\/www.rushworth.us\/lisa\/?p=10055","title":{"rendered":"Maintaining an \/etc\/hosts record"},"content":{"rendered":"\n

I encountered an oddity at work — there’s a server on an internally located public IP space. Because it’s public space, it is not allowed to communicate with the internal interface of some of our security group’s servers. It has<\/em> to use their public interface (not technically, just a policy on which they will not budge). I cannot just use a DNS server that resolves the public copy of our zone because then we’d lose access to everything else<\/em>, so we are stuck making an \/etc\/hosts entry. Except this thing changes IPs fairly regularly (hey, we’re moving from AWS to Azure; hey, let’s try CloudFlare; nope, that is expensive so change it back) and the service it provides is application authentication<\/em> so not something you want randomly falling over every couple of months.<\/p>\n\n\n\n

So I’ve come up with a quick script to maintain the \/etc\/hosts record for the endpoint. <\/p>\n\n\n

\n# requires: dnspython, subprocess\n\nimport dns.resolver\nimport subprocess\n\nstrHostToCheck = 'hostname.example.com' # PingID endpoint for authentication\nstrDNSServer = "8.8.8.8"         # Google's public DNS server\nlistStrIPs = []\n\n# Get current assignement from hosts file\nlistCurrentAssignment = [ line for line in open('\/etc\/hosts') if strHostToCheck in line]\n\nif len(listCurrentAssignment) >= 1:\n        strCurrentAssignment = listCurrentAssignment[0].split("\\t")[0]\n\n        # Get actual assignment from DNS\n        objResolver = dns.resolver.Resolver()\n        objResolver.nameservers = [strDNSServer]\n        objHostResolution = objResolver.query(strHostToCheck)\n\n        for objARecord in objHostResolution:\n                listStrIPs.append(objARecord.to_text())\n\n        if len(listStrIPs) >= 1:\n                # Fix \/etc\/hosts if the assignment there doesn't match DNS\n                if strCurrentAssignment in listStrIPs:\n                        print(f"Nothing to do -- hosts file record {strCurrentAssignment} is in {listStrIPs}")\n                else:\n                        print(f"I do not find {strCurrentAssignment} here, so now fix it!")\n                        subprocess.call([f"sed -i -e 's\/{strCurrentAssignment}\\t{strHostToCheck}\/{listStrIPs[0]}\\t{strHostToCheck}\/g' \/etc\/hosts"], shell=True)\n        else:\n                print("No resolution from DNS ... that's not great")\nelse:\n        print("No assignment found in \/etc\/hosts ... that's not great either")\n\n<\/pre><\/div>","protected":false},"excerpt":{"rendered":"
I encountered an oddity at work — there’s a server on an internally located public IP space. Because it’s public space, it is not allowed to communicate with the internal interface of some of our security group’s servers. It has to use their public interface (not technically, just a policy on which they will not …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[33,30],"tags":[100,1853,294,664],"class_list":["post-10055","post","type-post","status-publish","format-standard","hentry","category-coding","category-system-administration","tag-dns","tag-hosts-file","tag-linux","tag-python"],"_links":{"self":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/10055","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10055"}],"version-history":[{"count":2,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/10055\/revisions"}],"predecessor-version":[{"id":10089,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/10055\/revisions\/10089"}],"wp:attachment":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10055"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10055"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10055"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}