The spread of 192.0.2.53: configuration audit

Audit AUD-CFG-26-091 · Window 2026-09-08 to 09-12 · Auditor configuration management · Trigger 2026-Q3 resolver sweep review

The question this audit was chartered to answer: how did the address 192.0.2.53 get into /etc/resolv.conf on all 1,181 hosts of the estate. Three sections: vector, containment, opinion.

Vector

resolv.conf is owned by the config automation module net-resolv. Blame on the line:

+ nameserver 192.0.2.53
commit 4c1a09f
author  svc-build (account closed 2015-07, never reissued)
date    2022-09-30
diff    one line

The module pushes on each host's next agent run, so the address lands with a host's provisioning cycle, not its config cycle. The audit rebuilt the quarterly sweep from deploy logs and it matches to the host, every quarter: first deploy bastion-02; thereafter each quarter's sweep count equals the number of hosts that rebuilt since the commit - 4, 11, 38, 106, 291, 604, 1,180, 1,181. No host that has not rebuilt since 2022-09-30 carries the line. No host that has, lacks it.

The zone serial from the zone transfer (axfr-from-53) is 2022093001: a date, 2022-09-30, the commit's day. The audit records the equality and declines to read it as causation, because the audit does not know what would disprove it either way.

bastion-02, patient zero, was rebuilt clean from the golden build on 2026-04-09 (session-0). The sweep still counts it. The golden image was re-captured from bastion-02 in 2023-Q1. The audit writes both of those sentences down and does not call either an explanation.

Containment

The line was removed from net-resolv at 2026-09-08 16:20, after the transfer incident. Containment check on 09-10: the sweep still reports 1,181 hosts carrying the address. The audit inspected 12 hosts across four teams. Two carry the line with a build date after the removal and a golden image the audit verified clean byte-for-byte. The mechanism of reacquisition is not identified in this report because it was not found.

Opinion

Revision 1 read: "stale template line, auto-healed from a cached copy; finding severity low." Revision 2, written after containment failed, reads "stale template line and one unidentified second vector." Revision 3 reads: "The audit cannot identify a vector that explains the containment result. This opinion is recorded for completeness." The opinion is the only part of this report the audit no longer stands behind.

Finding F-5, no code assigned

Every sweep row since 2022-Q3 equals, exactly, the number of hosts rebuilt since 2022-09-30. One reading: the line propagates once per rebuilt host. The other reading: the line arrives once per rebuilt host. These readings predict the same table and the audit has no test that separates them, and no finding-code in the manual means the configuration is reporting a fact. All other findings use known codes.

Related: stories/the-fourth-nameserver, stories/axfr-from-53, stories/session-0.

Source: the pages linked above, read 2026-09-13. Invented.