*Something* Keeps Overwriting /etc/hosts at Boot Time

I’ve never experienced this problem before so I don’t really know if it’s a bug, a feature, or my own darned fault but I’ve tried everything I can think of, still something keeps overwriting /etc/hosts. I’ve tried changing it manually through /etc/hosts and /etc/HOSTNAME, disabling AppArmor, tried fixing it through yast Hostnames and Network Settings, tried refreshing ncsd, I even poked around in /etc/sysconfig to see if there was anything obvious going on in there; literally everything I can think of short of a fresh install but still something keeps overwriting this file. My IP is assigned statically so I do not have “Set hostname through DHCP” enabled. My hostname keeps changing from a .com tLD to a “.site” tLD.

I need my hostname to be within the same domain as my outgoing SMTP server “with a .com tLD” or else all my outgoing mail bounces. This is very annoying behavior having to manually set my hostname every time I reboot so I can send mail through my SMTP server. Any and all suggestion are more than welcome so I don’t have to loose any more hair over this.

Current OS is openSUSE 12.3 with all the latest updates.

Are you using DHCP or not?

Are you using ifup or Network manager?

Thank you for your reply. To reiterate, I am not using DHCP at all, which is why this is such a odd case. Also, it’s probably worth mentioning that I am using ifup and not using NetworkManager at all. I apologize if I wasn’t clear about that before, I hope this helps. :slight_smile:

I don’t recall “/etc/hosts” being changed, except due to something that I do. And the only things I do that change it are either edit the file, or tell Yast network settings to assign the hostname to localhost.

It might help if you could tell us what is changing in “/etc/hosts”. Perhaps make a copy of the file. Then, after the next change, use the “diff” command


diff -u /etc/hosts.backup /etc/hosts

and post the output here with code tags (use the “#” button in the edit box to generate code tags).

Knowing what has changed might give somebody a clue as to what is doing the changing.

Good point sir, here are differences, it basically just keeps going back to it’s previous settings on boot:

— /etc/hosts 2013-11-30 17:19:54.833292852 -0800

+++ hosts 2013-11-30 17:17:24.532270542 -0800

@@ -20,4 +20,7 @@

ff02::1 ipv6-allnodes

ff02::2 ipv6-allrouters

ff02::3 ipv6-allhosts

-0.0.0.0 leviathan.hyperspire.com leviathan

+172.24.24.25 Leviathan.Hyperspire.site Leviathan

+172.24.24.25 Leviathan.Hyperspire.site Leviathan

+172.24.24.0 Leviathan.hyperspire.site Leviathan

+0.0.0.0 Leviathan.hyperspire.site Leviathan

The line I do want:
-0.0.0.0 leviathan.hyperspire.com leviathan

The lines that are changed on boot:
+172.24.24.25 Leviathan.Hyperspire.site Leviathan
+172.24.24.25 Leviathan.Hyperspire.site Leviathan
+172.24.24.0 Leviathan.hyperspire.site Leviathan
+0.0.0.0 Leviathan.hyperspire.site Leviathan

In my experience, I’ve never heard of anything changing the hosts file on boot unless DHCP is enabled with the “Change hostname by DHCP” option set. This is very strange behavior indeed.

My thoughts:
If it keeps going back to the original settings, then surely those settings must be stored somewhere. If I find out where, I can change those and force it to keep the settings that I want. I’ve just never heard of anything like this before. Is there some place it would possibly backup/store the settings in /etc/hosts? My little excursion into /etc/sysconfig didn’t really reveal anything useful… perhaps somewhere in /usr/share?

There’s probably a backup copy of the old file somewhere in “/etc”. If you can’t guess the name, maybe the “grep” command will help you find it.

You are probably running some software that is making the change – perhaps some kind of routing daemon or masquerading software or VPN software.

Beyond that, I can’t guess. Perhaps someone else will be familiar with these kinds of changes.

Now that you mention it, I am running Cisco’s VPN software to tunnel through my Cisco router. Thanks for the input, at least now I have more possible solutions I can look at :slight_smile:

Found it! The backup file is in /etc/hosts.ac. It’s whatever program controls the AC’s that’s the culprit here. Awesome, hah! Take that anomalous problem!

On 2013-12-01 02:56, nrickert wrote:

> Beyond that, I can’t guess. Perhaps someone else will be familiar with
> these kinds of changes.

No, but I know of a trick with apparmour which can identify the process
that changes a file. If you are interested I’ll dig it out after some
sleep - it is 3 AM here, and I don’t remember where exactly I wrote it.


Cheers / Saludos,

Carlos E. R.
(from 12.3 x86_64 “Dartmouth” at Telcontar)

Just in case anyone else runs across this problem:

<spotter> on this IRC log seems to confirm that it is indeed Cisco’s AnyConnect VPN client that is causing this unusual behavior: http://irclogs.ubuntu.com/2011/11/23/%23ubuntu.txt

It would appear the problem is not specific to any one particular Linux distribution, as Ubuntu and openSUSE are about as different as night and day; as far as Linux distributions are concerned that is.