Some misspelled SSH hosts are resolved to 127.0.0.1 equivalent

Question

I have a Fedora 25 machine. Sometimes I misspell a hostname for SSH. Then I do ssh examle.com. For some reason, I then get connected to my machine (localhost) via SSH. I notice this because if there are SSH_ variables in the environment, my shell prompt shows that.

Right now at home, I get a clean hostname resolution error. What could be the cause of this on occasion? Some local DNS server just resolving everything it does not know to 127.0.0.1?

StrictHostKeyChecking no

host juqueen
hostname juqueen.fz-juelich.de
user hbn28e
controlpath ~/.ssh/controlmasters/%r@%h:%p
controlmaster auto
controlpersist 15m


host judac
hostname judac.fz-juelich.de
user hbn28e
controlpath ~/.ssh/controlmasters/%r@%h:%p
controlmaster auto
controlpersist 15m

host martin-ueding.de
hostname martin-ueding.de
user ssh-444717-mu
StrictHostKeyChecking yes

host hiskp
hostname plato.itkp.uni-bonn.de                                                                                        
user ueding                                                                                                            

host chaos                                                                                                             
hostname chaos.stw-bonn.de                                                                                             
user mu                                                                                                                

host gateway.cb.uni-bonn.de                                                                                            
ForwardAgent yes                                                                                                       
hostname gateway.cb.uni-bonn.de                                                                                        
user ueding                                                                                                            
checkhostip yes                                                                                                        
controlpath ~/.ssh/controlmasters/%r@%h:%p                                                                             
controlmaster auto                                                                                                     
controlpersist 15m                                                                                                     

host qbig                                                                                                              
ForwardAgent yes                                                                                                       
#hostname gateway.cb.uni-bonn.de                                                                                       
ProxyCommand ssh gateway.cb.uni-bonn.de "nc qbig %p"                                                                   
user ueding                                                                                                            
checkhostip yes                                                                                                        
controlpath ~/.ssh/controlmasters/%r@%h:%p                                                                             
controlmaster auto                                                                                                     
controlpersist 15m                                                                                                     

host gsp.fz-juelich.de                                                                                                 
hostname gsp.fz-juelich.de                                                                                             
identityfile ~/.ssh/id_gsp_owncloud                                                                                    

host martin-welsh                                                                                                      
hostname martin-welsh.fritz.box                                                                                        

host martin-shire                                                                                                      
hostname martin-shire.fritz.box                                                                                        

host martin-friese
hostname martin-friese.fritz.box
#hostname 192.168.188.71

host root@martin-welsh
user root
hostname martin-welsh.local

host martin-criollo
hostname 192.168.188.21
user shell
port 2222

host martin-falabella
hostname martin-falabella.fritz.box
port 2222

host cip
hostname cip-pool.physik.uni-bonn.de
user s6mauedi

---

At home, I have an AVM FRITZ!Box router. That does some DNS magic and lets you resolve names in the local network. So I can do ssh martin-friese.fritz.box from another computer and get a connection to the laptop. This nicely works without any Avahi/Zeroconf/Bonjour stuff and therefore also supports Windows and Android right away. The address http://fritz.box gets resolved to the router's web interface (192.168.???.1).

At the university, my computer still has the hostname martin-friese.fritz.box. Perhaps this got baked into my Fedora installation a little too deep. I guess I should rather have martin-friese and let the FRITZ!Box DNS bake in the .fritz.box when I am at home.

When I now try to resolve a non-existing hostname, I get this:

$ host this-does-not-exist
this-does-not-exist.fritz.box has address 127.0.53.53                                                                  
this-does-not-exist.fritz.box mail is handled by 10 your-dns-needs-immediate-attention.box.

An internet search on your-dns-needs-immediate-attention tells me that the .box TLD is now a valid domain and that therefore there is a clash of my DNS with the global DNS.

The output of dig does not really help me.

$ dig this-does-not-exist

; <<>> DiG 9.10.4-P5-RedHat-9.10.4-4.P5.fc25 <<>> this-does-not-exist                                                  
;; global options: +cmd                                                                                                
;; Got answer:                                                                                                         
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 10457                                                             
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1                                                

;; OPT PSEUDOSECTION:                                                                                                  
; EDNS: version: 0, flags:; udp: 4096                                                                                  
;; QUESTION SECTION:                                                                                                   
;this-does-not-exist.           IN      A                                                                              

;; AUTHORITY SECTION:                                                                                                  
.                       10800   IN      SOA     a.root-servers.net. nstld.verisign-grs.com. 2017013000 1800 900 604800 86400

;; Query time: 13 msec                                                                                                 
;; SERVER: 131.220.226.3#53(131.220.226.3)                                                                             
;; WHEN: Mo Jan 30 16:51:54 CET 2017                                                                                   
;; MSG SIZE  rcvd: 123

So I guess I just need to change my hostname to martin-friese without the .fritz.box? Or should I change it to friese.martin-ueding.de, I own the domain but the registrar does not know anything about my laptop.

Answer 1

The 127.0.53.53 is a safeguard introduced with new gTLDs, call WCIP (Wildcarded Controlled Interruption Program), see https://www.icann.org/resources/pages/name-collision-2013-12-06-en

And if you look inside https://www.icann.org/sites/default/files/ci-monitoring/citld-complete.csv, you will see that the new .box gTLD was in this case between 2016-11-11 and 2017-02-08 for all SLDs under it (wildcard).

In your ssh configuration, the host part is whatever token you want, it is purely local. However for the hostname you should put there a name that can be resolved on the computer on which the ssh configuration is. The DNS resolution is governed on UNIX system by the content of /etc/resolv.conf which will, among other things, specify which nameservers will be queried for recursive queries as well as potential suffixes to add if you use a name with too few dots in it (see search, domain and ndots options).

friese.martin-ueding.de does currently successfully resolve to 134.119.45.68 so as long as this resolution stays and hoping it is the correct IP, you should be able to do ssh friese.martin-ueding.de from anywhere and be successful on the transport level to establish connection (before speaking about authentication of course).

And by the way, based on whois, fritz.box is not an existing domain currently. A lot of "fun" would happen when someone registers it in the future.