I encountered an oddity at work — there’s a server on an internally located public IP space. Because it’s public space, it is not allowed to communicate with the internal interface of some of our security group’s servers. It has to use their public interface (not technically, just a policy on which they will not budge). I cannot just use a DNS server that resolves the public copy of our zone because then we’d lose access to everything else, so we are stuck making an /etc/hosts entry. Except this thing changes IPs fairly regularly (hey, we’re moving from AWS to Azure; hey, let’s try CloudFlare; nope, that is expensive so change it back) and the service it provides is application authentication so not something you want randomly falling over every couple of months.
So I’ve come up with a quick script to maintain the /etc/hosts record for the endpoint.
# requires: dnspython, subprocess
import dns.resolver
import subprocess
strHostToCheck = 'hostname.example.com' # PingID endpoint for authentication
strDNSServer = "8.8.8.8" # Google's public DNS server
listStrIPs = []
# Get current assignement from hosts file
listCurrentAssignment = [ line for line in open('/etc/hosts') if strHostToCheck in line]
if len(listCurrentAssignment) >= 1:
strCurrentAssignment = listCurrentAssignment[0].split("\t")[0]
# Get actual assignment from DNS
objResolver = dns.resolver.Resolver()
objResolver.nameservers = [strDNSServer]
objHostResolution = objResolver.query(strHostToCheck)
for objARecord in objHostResolution:
listStrIPs.append(objARecord.to_text())
if len(listStrIPs) >= 1:
# Fix /etc/hosts if the assignment there doesn't match DNS
if strCurrentAssignment in listStrIPs:
print(f"Nothing to do -- hosts file record {strCurrentAssignment} is in {listStrIPs}")
else:
print(f"I do not find {strCurrentAssignment} here, so now fix it!")
subprocess.call([f"sed -i -e 's/{strCurrentAssignment}\t{strHostToCheck}/{listStrIPs[0]}\t{strHostToCheck}/g' /etc/hosts"], shell=True)
else:
print("No resolution from DNS ... that's not great")
else:
print("No assignment found in /etc/hosts ... that's not great either")