It may be. I was installing Ubuntu using full image, not net install.

Maybe first Ubuntu web site should be checked because it's trigering
some extra file download, second thing, this /etc/.resolv% file can do
harm and it's not standard part of the system.

I choose dnamask because that's the closest category to choose. There is
no option to report a problem.


Sent from Proton Mail for iOS.

-------- Original Message --------
On Wednesday, 10/07/26 at 18:55 Guilherme Puida Moreira 
<[email protected]> wrote:
I think this file is somehow a leftover artifact of the image building
process. I downloaded the ubuntu-26.04.1-desktop-amd64.iso and mounted
the inner minimal.squashfs

% ls -la /tmp/iso/squash/etc/.resolv.conf.systemd-resolved.bak
-rw-r--r-- 1 root root 862 Aug 26 02:27 
/tmp/iso/squash/etc/.resolv.conf.systemd-resolved.bak

% cat /tmp/iso/squash/etc/.resolv.conf.systemd-resolved.bak
# This is /run/systemd/resolve/resolv.conf managed by man:systemd-resolved(8).
# Do not edit.
#
# This file might be symlinked as /etc/resolv.conf. If you're looking at
# /etc/resolv.conf and seeing this text, you have followed the symlink.
#
# This is a dynamic resolv.conf file for connecting local clients directly to
# all known uplink DNS servers. This file lists all configured search domains.
#
# Third party programs should typically not access this file directly, but only
# through the symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a
# different way, replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 10.131.53.11
nameserver 10.131.53.12
nameserver 10.131.53.13
search ppa openstack.prodstack5.lan

I don't think this is a dnsmasq bug at all. Should this be a task in
livecd-rootfs? Unsure what actually generate those images.

** Tags added: server-triage-discuss

--
You received this bug notification because you are subscribed to the bug
report.
https://bugs.launchpad.net/bugs/2169298

Title:
  Strange hiden config file with private ip address as dns server

Status in dnsmasq package in Ubuntu:
  Incomplete

Bug description:
  This issue is having multiple stages. First stage is where tor browser
  blocked ubuntu.com from downloading some suspicious file in the same
  time when Ubuntu 26.04.1 LTS iso file downloading is initiated. After
  download is done, hash signature verification was successful. After
  installation, suspicious hidden file is found at location
  /etc/.resolv.conf.systemd-resolved.bak. File is including dns records
  which are pointing to private ip addresses: nameserver 10.131.53.11,
  nameserver 10.131.53.12, nameserver 10.131.53.13 and domain search ppa
  openstack.prodstack5.lan. These ip addresses are not some kind of
  loopback ip addresses like 127.0.0.53:53 which are known as part of
  dns configuration. I wasn't able to find this file in available Ubuntu
  documentation.

  ProblemType: Bug
  DistroRelease: Ubuntu 26.04
  Package: dnsmasq (not installed)
  ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14
  Uname: Linux 7.0.0-38-generic x86_64
  ApportVersion: 2.34.1-0ubuntu0.1
  Architecture: amd64
  CasperMD5CheckResult: pass
  CurrentDesktop: ubuntu:GNOME
  Date: Fri Oct  2 15:32:18 2026
  InstallationDate: Installed on 2026-09-30 (2 days ago)
  InstallationMedia: Ubuntu 26.04.1 LTS "Resolute Raccoon" - Release amd64 
(20260826)
  ProcEnviron:
   LANG=en_US.UTF-8
   PATH=(custom, no username)
   SHELL=/bin/bash
   XDG_RUNTIME_DIR=<set>
  SourcePackage: dnsmasq
  UpgradeStatus: No upgrade log present (probably fresh install)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/dnsmasq/+bug/2169298/+subscriptions

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2169298

Title:
  Strange hiden config file with private ip address as dns server

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/dnsmasq/+bug/2169298/+subscriptions


-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to