9

Today, I got a message while doing a git push, saying

Warning: Permanently added the RSA host key for IP address '192.30.253.112' to the list of known hosts.

It seems as if it's consistent with what GitHub uses, based on What IP addresses does GitHub use that I should whitelist? though I haven't tried looking up how CIDR notation works.

However, if I try looking up 192.30.253.112 at http://ip-lookup.net/index.php , the "Host" information just has a literal question mark. It's only if I open up the "IP owner info (Whois)" section that I see it's associated with GitHub.

Is this unusual behaviour I should worry about from a security perspective?

techraf
  • 9,141
  • 11
  • 44
  • 62
Andrew Grimm
  • 2,100
  • 2
  • 20
  • 27

1 Answers1

11

No, you should not be worried, but you should be checking GitHub's server fingerprint rather then relying on IP addresses.

With git command you do it only on first (ever) connection. If the public key (corresponding to the fingerprint) is in known_hosts file, subsequent connections to github.com cause only warning if the domain got resolved to a new IP address. It is equivalent of using ssh command with CheckHostIP=no option.

You should be cautious (and check with a trusted source) if a new fingerprint was displayed on your screen for confirmation.

Regarding ip-lookup.net results:

ip-lookup.net figures out what DNS name is associated with an IP address using a reverse DNS.

In case of 192.30.253.112 it queries the address 112.253.30.192.in-addr.arpa which does not have a corresponding forward DNS record.

It seems like a misconfiguration or not strictly enforced-one on GitHub side, however the verification mechanism would not be viable in this scenario.

In case of Git (SSH) client connecting to github.com domain, if you assumed a compromised DNS server redirecting to a rogue IP, the verification of the destination address using reverse DNS lookup would be susceptible to the same attack (compromised DNS server would confirm the address to belong to github.com owner with reverse DNS).

Regardless of IP ownership verification, checking the server fingerprint assures no server impersonation or MitM attack is taking place.

techraf
  • 9,141
  • 11
  • 44
  • 62