Nameserver change in Debian 7.3 on their own!

Discussion in 'General' started by Quaxth, Jan 17, 2014.

  1. Quaxth

    Quaxth Member

    Hi, some strange change wer happen, not once, not twice, 4 times already!

    I had set the Nameservers to Google's 8.8.8.8 and. 8.8.4.4 in either resolv.conf and ISPConfig Server Config and in resolve.conf that nameservers were changed 4 times already to the nameserver of my ISP!

    How such could happens? In ISPConfig there wasn't changes and they still stay at Google's nameservers!

    Any Idea? And how to prevent that such changes happens? Thanks.
     
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    Is this a virtual machine or a "real" server? Is the IP configured by dhcp or did you configure it in /etc/network/interfaces as static IP?
     
  3. Quaxth

    Quaxth Member

    10min ago I changed the Namservers to Google's Nameservers and now just checked again and they're back to my ISP's Nameservers!

    What the Hell is going on?
     
  4. Quaxth

    Quaxth Member

    It's a real server NOT VS!

    And this is Interfaces:

    Code:
    root@server:~# vi /etc/network/interfaces
    # This file describes the network interfaces available on your system
    # and how to activate them. For more information, see interfaces(5).
    
    # The loopback network interface
    auto lo
    iface lo inet loopback
    
    # The primary network interface
    #allow-hotplug eth0
    #iface eth0 inet dhcp
    auto eth0
    iface eth0 inet static
            address 192.168.1.100
            netmask 255.255.255.0
            network 192.168.1.0
            broadcast 192.168.1.255
            gateway 192.168.1.1
    
    
     
  5. Quaxth

    Quaxth Member

    I changed again to Google! will check after this post what happens:
     
  6. till

    till Super Moderator Staff Member ISPConfig Developer

    Hmm, then I've no idea at the moment how the resolv.conf could get changed. As a workaround, you can deny all changes in resolv.conf by setting it to immutable:

    chattr +i /etc/resolv.conf

    No user incl. root will be able to change that file again until you remove the protection with:

    chattr -i /etc/resolv.conf
     
    Last edited: Jan 17, 2014
  7. Quaxth

    Quaxth Member

    Thanks Till will apply the command and hopefully that will work! Let you know the outcome!
     
  8. Quaxth

    Quaxth Member

    As I execurte the command I get:

    Code:
    root@server:~# chattr +1 /etc/resolv.conf
    Usage: chattr [-RVf] [-+=AaCcDdeijsSu] [-v version] files...
    root@server:~#
    
    Is that correct? Thanks.
     
  9. till

    till Super Moderator Staff Member ISPConfig Developer

    sorry, I meant +i, not +1
     
  10. Quaxth

    Quaxth Member

    And now something interesting: in WinSCPI check the resolv.conf and the setting were back to my ISP's nameserver. So, this time I changed them in WinSCP, had to key in my root PW again and the changes were done. That even after I had used the command you gave me! From Terminal I could no open resolv.conf with vi!!

    That looks really not good at all!!
     
  11. Quaxth

    Quaxth Member

    OK, changed and get:

    Code:
    root@server:~# root@server:~# chattr +i /etc/resolv.conf
    -bash: root@server:~#: command not found
    root@server:~#
    
     
  12. Quaxth

    Quaxth Member

    Oops, a mistakes from I!!

    now resolv.conf is set as read only.
     
  13. Quaxth

    Quaxth Member

    Still: what could have trigger those changes to the Nameservers of MY ISP from Google's nameservers? That's something I really don't like! Unpredictable changes same like my server down some days ago are really something what never should happen!

    I also check the server for an infection from an bootable media and all were clean, nothing found! Same I'd done with HDD with the old server install, also totally clean!
     

Share This Page