2

GitHub Pages allows to set up a public page under <user>.github.io that can optionally be customized with a personal domain. In order to do so:

  • GitHub must be set up to recognize that an incoming call referred to by a non-GitHub domain should be handled
  • the personal domain must have a pointer to GitHub, via a CNAME in the domain's zone

At some point in the documentation, there is a fat warning:

enter image description here

(EDIT: I updated the example below to a more complete zone following Steffen's answer because I do not understand it)

Let's say that I own example.com and the public IP 150.1.1.1, and I have a wildcard DNS entry:

*.example.com. IN CNAME hello.example.com.
hello.example.com. 300 IN A 150.1.1.1
mypageongithub.example.com. IN CNAME myuser.github.io.

In other words, something not otherwise defined in my example.com zone points to hello.example.com.

How can this present a danger of someone using my domain to advertise their GitHub page?

Note: I posted the question in Information Security rather than superuser.com or another similar site as this is more about identity theft (or misrepresentation) than a technical question about DNS

2
  • The warning doesn't apply since your zone isn't CNAME-ing a wildcard to GitHub Pages. You're only doing that for a particular unrelated subdomain. – amon Feb 1 at 23:39
  • @amon: this is probably the meaning of this (terribly worded) warning indeed. – WoJ Feb 2 at 6:40
1
*.example.com. IN CNAME hello.example.com.

A CNAME is resolved in the client to finally get the IP address. This means Github is not aware that you have a CNAME for *.example.com and that whatever.example.com resolves to hello.example.com using this CNAME. All it knows is that somebody wants to access whatever.example.com since this is the name used to access a github.io IP address.

If your <user>.github.io is only mapped to the name hello.example.com then somebody else could create a different <user2>.github.io page and map it to another-hello.example.com. Both domains resolve in the same target IP address (due to the CNAME) but one will show the contents of <user>.github.io while the other will show the contents of <user2>.github.io.

Note that this only relevant if you map all subdomains to github.io using a wildcard - as it seemed to be from your original question. After the edit of the question it came clear that there is only a single name mapped to <user>.github.io and that the wildcard is used for domains which don't map to Github. This is fine and this is also not was Github warned against when reading the warning in the context it was originally published.

6
  • Thanks Steffen, but I do not understand. I updated my question with a full DNS zone, with a wildcard pointing to a CNAME, which points to an A to have a complete example. I still do not understand how someone can make use of another-hello.example.com that will ultimately point to an IP I ultimately own. – WoJ Feb 1 at 22:01
  • @WoJ: Again, all what Github sees that somebody is accessing another-hello.example.com on the IP address of github.io. Github does not see any of the CNAME's including the on pointing to myuser.github.io, it only sees the result of resolving a the name another-hello.example.com to the IP address. Since myuser.github.io and other-user.github.io are ultimately served by the same servers all what it has is the original domain name given in the TLS handshake and HTTP request, i.e. another-hello.example.com. And this mapping could be claimed by other-user. – Steffen Ullrich Feb 2 at 5:26
  • No, another-hello.example.com resolves (though the wildcard) to hello.example.com, which resolves (though the Arecord) to 150.1.1.1 (which is my IP). The only case your example would be working would be if I had the whole wildcard pointing to GitHub (*.example.com IN CNAME user.github.io) - which would indeed be a terrible (and unexpected) thing to do, which may very well be the meaning of the warning, in which case it is poorly worded. – WoJ Feb 2 at 6:39
  • @WoJ: Now I see what you mean. Your original question did not include the mapping of a single name to github.io but included only the wildcard. And I did not properly read your edit. In this case what you have configured is outside of what github is warning against. My understanding of the warning you cite when taking the context of the warning is against using a wildcard to map a domain including all subdomains (wildcard) to github.io. This is not about using wildcards on places in DNS which have no relation to github.io. – Steffen Ullrich Feb 2 at 6:52
  • We agree then. As a side note, my initial question (that you quoted) showed a wildcard pointing to a host on example.com, not github.io – WoJ Feb 2 at 7:22
0

Following the discussion in comments, the warning of GitHub is against DNS entries such as

*.example.com IN CNAME someuser.github.io

This is a case where someone would use example.com as the baseline for several pages at GitHub and would not be willing to name them all one by one.

In such a case, since someuser.github.io ultimately points to a set of IPs in GitHub (someuser.github.io does not have a dedicated IP), then a malicious user could piggy-back on example.com to point to their page.

The example in my question where the wildcard points to a host in example.com is not a problem.

Personal comment: the warning is in a scary red box and should be made IMO more explicit (by GitHub)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.