DHCP client leaks hostname "amnesia"
1. Boot Tails 1.1.
2. Install Wireshark.
3. Monitor the network until a periodic
DHCP refresh is done.
4. Click on the "DHCP Request" packet
going out to the local router/gateway/dhcp-server.
In the data in the packet one can see:
Message type: Boot Request (1)
Option: (12) Host Name
Host Name: amnesia
In earlier Tails versions the hostname was not leaked, so this is a regression.
Prevent dhclient from sending the hostname over the network (Closes: #7688).
First, we have to use the "keyfile" NetworkManager plugin only; that is, we
disable the "ifupdown" one:
- it's needed, because the only the "keyfile" plugin supports setting
dhcp-send-hostname to false, while the "ifupdown" plugin retrieves the
hostname to send from /etc/hostname;
- it's OK, because we actually don't use the functionality provided by the
"ifupdown" plugin (that is, reading from /etc/network/interfaces -- that
only configures the loopback connection in Tails, which is itself ignored by
Second, we configure the NetworkManager "keyfile" plugin to not send the
hostname over DHCP by default. Likely this can be overridden on
a per-connection basis.
Third, we tell dhclient itself not to send the hostname. This is needed because
NetworkManager runs dhclient with the `-cf /var/run/nm-dhclient-eth0.conf`
option, and generates that file by concatenating `/etc/dhcp/dhclient.conf`
with its own settings.
#3 Updated by intrigeri over 4 years ago
(All that follows is valid on Wheezy. Not checked anything newer yet.)
NetworkManager runs dhclient with the
-cf /var/run/nm-dhclient-eth0.conf option. That file contains
send host-name "amnesia"; # added by NetworkManager, and is created by the
nm_dhcp_dhclient_create_config function in
src/dhcp-manager/nm-dhcp-dhclient-utils.c. Each connection has a
dhcp-send-hostname setting (docs/api/html/ref-settings.html) that defaults to TRUE.
On the short term, simply commenting out the line that adds the line we don't want should be enough.
As suggested on https://mail.gnome.org/archives/networkmanager-list/2014-January/msg00011.html, if using the "keyfile" plugin only (that is, after disabling the "ifupdown" one), adding this to
/etc/NetworkManager/NetworkManager.conf seems to resolve the problem:
- I'm not sure what would be the consequences of disabling the "ifupdown" plugin. My understanding of https://wiki.gnome.org/Projects/NetworkManager/SystemSettings leads me to think it's a complete no-op in our case, but this should be tested more thoroughly.
- One also has to patch the system-wide
dhclient.conf, since it contains
send host-name = gethostname();, and its content is merged into the NM-generated dhclient config file.
- I've not sniffed the network to confirm that doing all of the above is enough.
#5 Updated by intrigeri over 4 years ago
- Feature Branch set to bugfix/7688-no-dhcp-send-hostname
- Type of work changed from Research to Code
Implemented the solution described above. The generated dhclient.conf looks good. Left to do:
sniff the network to confirm that the hostname is not sent over DHCP(#7712); verify that it works for a manually added (e.g. Wi-Fi) network connection too(#7712); verify that the resulting ISO generally works fine: passes the automated test suite; verify that this solution also works on Jessie: works fine on current sid, verified with Wireshark; write design documentation.