Did the hosting location of the NZ debian mirror change?

Forums › Linux › Did the hosting location of the NZ debian mirror change?

eaglesd

71 posts

Master Geek
+1 received by user: 6

#293745 11-Feb-2022 11:16

Hi Everyone,

I'm trying to find out if the hosting location of the NZ Debian mirror at ftp.nz.debian.org changed in the last few years.

Long story short we believe we had an IP whitelist to allow our IoT devices to talk to this server but this is no longer working. One of the possibilities is that the hosting location changed. Is there a way to find out historical DNS records?

Inphinity

2780 posts

Uber Geek
+1 received by user: 1184

#2865303 11-Feb-2022 11:27

Believe it changed in early 2020, that's only one I recall (had a similar challenge as you, outbound rules), but have not been as involved in the last few years so if it's changed again I might not have noticed.

insane

3324 posts

Uber Geek
+1 received by user: 1006

ID Verified

Trusted

2degrees

Subscriber

#2865348 11-Feb-2022 12:03

Your FW rule would probably be the only way to tell, apart from contacting them. Some firewalls may retain logs of old connections so it could show up there too if you keep your logs that long.

Only other hint is the SOA on the zone file, however in this case it looks like they have some automation in place which is updating them as another of their records had 43 changes on a single day (assuming they are following standard naming conventions)

id 257

opcode QUERY

rcode NOERROR

flags QR RD RA

;QUESTION

ftp.nz.debian.org. IN SOA

;ANSWER ftp.nz.debian.org. 588 IN CNAME mirror.fsmg.org.nz.

;AUTHORITY fsmg.org.nz. 1800 IN SOA ns1.catalyst.net.nz. dns.catalyst.net.nz. 2022021001 10800 3600 604800 3600

;ADDITIONAL

But in this case, given it's one SOA for the whole sub zone t could have been for a change to ANY other record too, and not just ftp.

Good luck

eaglesd

71 posts

Master Geek
+1 received by user: 6

#2865369 11-Feb-2022 12:40

Thanks, in this case the whitelist is happening on the Telco APN so we don't have access to any of the logs. We've asked them to whitelist the current IP with the assumption that the IP is what changed.