Source
r/sysadmin•
dVnt

Apple OS X & DNS: Why do Macs steal DNS names?

Can anyone help me better understand why Macs commonly show up with the FQDN's of other machines in our organization? Example Scenario Below.

I used to think it was a problem with the way IP address leases we conveyed, but Macs will also steal FQDNs from other subnets, so I guess it isn't that simple.

I'm still fuzzy on all the intricate details of DNS and how respective platforms deal with it. Any direction or advice is much appreciated!

Example Scenario:

  • Apple OS X 10.5.8 bound to AD (2003)
  • I'm manually installing Kaseya agents on a cart of laptops.

The first one installs and shows up in Kaseya's agent list with the correct name. e.g. BHS-C11-01. BHS-C11-01 is the name in the "Computer Name:" field of the Sharing pane in System Prefences. The machine was bound to AD with the name BHS-Floater-0232.

The second one installs and shows up in Kaseya's agent list as KES-RM19, which is neither the name displayed in the Sharing pane of System Preferences nor the name the computer was bound to AD with. KES-RM19 is a PC computer in an entirely different building, on an entirely different subnet.

This phenomenon has also been causing problems with ARD administration for years. A machine will flip back and forth between two DNS names with such frequency that you cannot reliable schedule tasks.

I could go on and on, but I think I'll stop here and wait for questions if anyone is interested.

Edit: OK, so I did discover that the hostname which I was assuming was from another subnet actually isn't. The owner of that computer has an account listed as being in my building after all, the hostname of hsi/her computer just wasn't changed when they moved. (which is no surprise)

Posted Dec 1, 2011, 4:58 PM UTC · edited

622
bshacklett•

By default, when a Windows computer is assigned a DHCP address, it sends a DNS registration request to its DNS server, which registers an A and a PTR record for it. These dynamic DNS records do not expire when the lease expires; they stick around waiting for DNS scavenging to kick in.

The best information I could find regarding the method that OS X sets its hostname has this to say:

In Mac OS X 10.4.x Server (and the client version I believe [and possibly earlier versions], by default your hostname is determined dynamically. This is controlled by the following line in the file /etc/hostconfig:

HOSTNAME=-AUTOMATIC-

(note that in my Mac OS X 10.4.10 client this line is absent from /etc/hostconfig so I assume that absence defaults to automatic as well). If you want to your hostname to be static, just change -AUTOMATIC- to whatever fully qualified hostname you want like foo.example.com. When the hostname is determined automatically, the OS steps through this list of possibilities and goes with the first valid name found:

The name provided by the DHCP or BootP server for the primary IP address The first name returned by a reverse DNS (address-to-name) query for the primary IP address The local hostname (set in the Sharing pane of System Preferences) The name localhost

If your PTR records are not being cleaned up before the lease expires, it's possible for a Mac to grab that IP address via DHCP while the PTR record is still active, thus causing it to take the hostname of the Windows machine that previously leased the address.

I would look into the HOSTNAME option in /etc/hostconfig to see what options you have. Unfortunately, the default configuration seems to be pretty junky and DNS scavenging is just a royal pain in the ass to get set up just right.

5
multivacac•

I am not an expert on Macs but with nix type non MS dns servers I believe they generally don't allow the clients themselves to update the dns for security reasons, instead the dhcp server is setup with a key and the permissions to update dns when it gives out a lease.

I remember somewhere there's an option for having the dhcp server update dns for specific clients, generally for older clients that can't do it themselves, but that might work for the non windows computers on your network.

2
bshacklett•

MS DNS servers actually function pretty similar to Bind in this case, requiring secure updates by default; it's the clients that differ by updating DNS on their own rather than leaving it to the DHCP server.

You can configure the DHCP server to force it to perform DNS updates at multiple levels. Get properties on a scope or a reservation, then click the DNS tab and there are two options here that do the job.

I don't understand why they had their clients update DNS directly, because it removes a lot of centralized control from the situation. A DHCP server knows when the lease expires and can delete the DNS records accordingly. The client isn't going to be on the network to do the same job.

2
packysauceLinux/Windows Admin•

From what I can tell, my Macs will take their hostname from a reverse DNS lookup based on whatever interface changed most recently. I know that if I hardwire my Mac it gets its correct name, but if I go wireless it'll change over to "wifi-XXX" or some other random pool name.

Are you using DHCP just letting them get a pool address or are you statically assigning DHCP addresses? Or are you just using static IPs?

3
jaded_adminbitter and jaded•

Yes we've had the reverse DNS issue make sure you're reverse records are being cleaned up.

Also, make sure you're naming your macs correctly when you type in hostname from a terminal prompt it should return FQDN not somename.local.

2
packysauceLinux/Windows Admin•

Our MAC <-> IP <-> Hostname mapping is all tied together REAL hard so there's basically no way to have any problem if you're on a VLAN without dynamic IP assignment (unlike our guest networks, etc).

2
dVntOP•

DHCP pool.

But our Macs will pickup the hostnames of machines from other DHCP Pools -- other subnets.

/Twilightzonemusic

1
packysauceLinux/Windows Admin•

Are they picking a name that has any connection to the IP address it has? Any DNS updates going on?

2
dVntOP•

I have thought so in the past, but the phenomenon I encountered today was a Mac that stole a hostname from a machine on a different subnet. It is possible that this machine is a laptop and that the person at this building visited mine within a relevant span of time though...

1
packysauceLinux/Windows Admin•

do ComputerName, LocalHostName, and HostName from scutil all match up?

2
fatbastard79•

Are you sure you're looking at this from the correct angle? Macs have a tendency to hold on to an IP address no matter what DHCP or DNS may tell it, even if the IP it's requesting is already taken. I've fought that quite a bit. What may be happening is that when your mac is requesting an IP, the DHCP is trying to assign it an address different than the one it had last because that one is taken, but it doesn't want to change so it keeps the one it wants. If this is whats happening, what you're seeing in DNS is the other computer with this IP. The best work-around that I've found is to give the MAC a static reservation in DHCP unfortunately

2
dVntOP•

Well, as I was trying to say, that's what I was thinking as well. However, given this theory, how do we explain Macs picking up the hostnames of computers which are on different subnets and wouldn't be conflicting in such a way?

1
MonsieurOblongSenior Systems Engineer - Unix•

I'm not that familiar with the desktop world, but the only thing I've ever noticed is that, in an AD environment, my Mac has the hostname of the last Windows box to use that IP. In other words, the DNS part of AD doesn't know what to do with the Mac, so it just leaves the old record there.

It sounds like you're dealing with something different though.

2