14

What is the correct way of editing /etc/hosts? I want to add some IP addresses and host names to it. It works for a while (a few hours) and then it gets reverted back to the original version. Is there any process checking the status of /etc/hosts and reverting it back?

I'm on my MBA with Mountain Lion.

  • FWIW, this does not happen to me. I have an entry in /etc/hosts to a computer in my private network (address 10.0.0.2) which has never been removed by the system. But perhaps it leaves addresses in local networks (10/8, 172.16/12 and 192.168/16 – see RFC 1918) alone, and removes addresses pointing to global IPv4 addresses? </speculation> – Harald Hanche-Olsen Jul 18 '13 at 18:43
  • Actually, I have added some entries a while back and they stayed. The new ones are getting removed. Both are in similar subnets. – Mohammad Moghimi Jul 18 '13 at 18:52
  • Have you been able to determine which process is changing the file? A tool like fseventer might help you understand what's editing the file. Since it's normally owned by root:wheel - the list of programs that can edit the file should be quite small. You could also just set the immutable flag on the file and avoid needing to revert changes. – bmike Jul 18 '13 at 19:36
9

As a tool to help you find the culprit, here is a dtrace oneliner which prints the pid and name of any process which opens a file for writing, together with the filename:

dtrace -qn 'syscall::open*:entry /arg1&3/ { printf("%d %s %s\n", pid, execname, copyinstr(arg0)); }'

It needs to be run as root (e.g., with sudo). Pipe it into grep hosts to avoid drowning in output and missing what you are looking for:

sudo dtrace -qn 'syscall::open*:entry /arg1&3/ { printf("%d %s %s\n", pid, execname, copyinstr(arg0)); }' | grep hosts

Hopefully, this will tell you what process is overwriting the file. Just let it run in a terminal window until it triggers.

12

If you are using Juno Pulse VPN client, /etc/hosts gets over-written by /etc/jnpr-pulse-hosts.bak

8

Do you use Cisco's AnyConnect VPN client? If so, you need to edit /etc/hosts.ac instead, and let it copy that to the live file. See this MacOSXHints article, and these previous questions.

EDIT: I can't find anything specifically about Janos Pulse, but Juniper's Network Connect messes with /etc/hosts, and I suspect Pulse may do the same thing. According to this blog post, if you make changes while connected they'll be reverted when you disconnect, but changes made while disconnected will stick.

  • No I'm not using AnyConnect, there's no /etc/hosts.ac either. However, I'm using another proxy software: Junos Pulse – Mohammad Moghimi Jul 20 '13 at 1:07
  • 1
    I can confirm this behavior with Junos Pulse 5.1.8. Changes to /etc/hosts must be made while disconnected or you'll lose them. – MisterEd Apr 20 '16 at 18:34
8

For me it's in the file

/etc/pulse-hosts.bak

You have to edit this file to customize your hosts directives

When you are going to reconnect/connect using the Pulse Secure VPN, it's going to merge the directives from the

/etc/pulse-hosts.bak

with the content from Pulse directives and creates the

/etc/hosts

2018 Update

With the newer version of Pulse Secure you have to exit the program first (check your active process).

Modify your host (/etc/hosts) and then restart Pulse Secure.

-1

I was unable to use quickstart cloudera VM after entering into VPN. To resolve this issue i followed below steps.

Step-1 : Add entry in /private/etc/hosts for e.g.

127.0.0.1 quickstart.cloudera

Step-2 : Enter into VPN for e.g. I am using F5 VPN

Step-3 : Verify above mentioned entry in /etc/hosts using below command

cat /etc/hosts

I hope that it will be useful.

  • How does this address the problem described in the question, namely "something" overwriting /etc/hosts? – nohillside Jul 8 at 7:00
  • Hi @nohillside, I added 127.0.0.1 quickstart.cloudera entry in my /etc/hosts file but it got erased/overridden when i was connecting to VPN. To add 127.0.0.1 quickstart.cloudera entry permanently, i added it in /private/etc/hosts file. Internally whenever you try to connect to VPN, it copies all entries from /private/etc/hosts to /etc/hosts. I hope that it make sense now. – Shreyash Limbhetwala Jul 9 at 4:07
  • Hi @nohillside, Just FYI... i am using F5 Big-IP Edge client and i have mac OS. – Shreyash Limbhetwala Jul 9 at 4:13
  • On macOS /etc is a symlink to private/etc so /etc/hosts and /private/etc/hosts are actually the same file (run ls -li /etc/hosts /private/etc/hosts to check). – nohillside Jul 9 at 4:25
  • 1
    You are right @nohillside, but after adding entry in /private/etc/hosts my problem got resolved and after connecting to VPN as well my entry is not getting erased/overridden. – Shreyash Limbhetwala Jul 9 at 5:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .