/etc/hosts is a local name-resolution file that maps hostnames to IP addresses before external DNS is consulted. Attackers can abuse it to redirect traffic, and defenders should watch for unexpected edits on servers and endpoints. It is often checked when investigating connection failures or suspicious redirection.
What /etc/hosts Does
/etc/hosts is a local override for hostname resolution. It gives the system a static mapping from a name to an IP address before the resolver asks external DNS, so it can redirect traffic without changing upstream records.
This makes the file small but influential. A single line can change where a browser, package manager, internal service, or administrative tool connects, which is why defenders often review it during troubleshooting and tamper investigations.
How Local Name Resolution Works
On many Unix-like systems, the resolver checks local sources first, then falls back to DNS according to the host configuration. That order matters because /etc/hosts can create a trust shortcut: the machine will accept a local answer even when it conflicts with the public name system.
This behaviour is useful for maintenance, lab environments, service cutovers, and temporary overrides, but it also means the file should be treated as a security-sensitive configuration artifact rather than a convenience list.
Why It Is Security-Relevant
/etc/hosts affects where processes send traffic, so it can be used to block, reroute, or impersonate legitimate destinations. In practice, that can support phishing-like redirection, sinkholing, outage simulation, or attacker-controlled interception if the file is changed unexpectedly.
Because the mapping happens locally, the risk is not limited to DNS infrastructure. An endpoint or server with a modified hosts file may appear healthy at the network layer while still reaching the wrong destination, which complicates diagnosis and incident response.
Operational Uses and Common Failure Modes
Administrators use /etc/hosts for loopback aliases, temporary migrations, emergency overrides, and environments where DNS is unavailable or deliberately avoided. Those legitimate uses become a failure mode when the override is forgotten, duplicated, or copied across systems without review.
Unexpected edits can also cause subtle breakage, including failed TLS validation, split-brain behaviour between hosts, inconsistent service discovery, and hard-to-explain connection errors. A clean-looking hostname entry can therefore mask a much larger routing or trust problem.
Risk and Threat Considerations
When attackers or rogue administrators can alter /etc/hosts, they can redirect high-value traffic to a different endpoint without touching DNS. That makes the file a compact but powerful place to hide persistence, interfere with updates, or steer users and services toward a malicious destination.
Failure mechanism: The local resolver trusts the hosts file ahead of external name service, so a small local edit can override the organisation’s intended destination and bypass normal DNS-based visibility.
Impact: Systems may connect to the wrong server, credentials or session traffic may be exposed to interception, and investigators may waste time chasing a network issue that is actually a local configuration change.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | CM-6 — Configuration Settings | Hosts file changes are configuration changes that need baseline control. |
| SI-7 — Software, Firmware, and Information Integrity | Unexpected hosts-file edits are integrity events affecting system trust. | |
| Recommendation — Enforce approved host-file baselines and review unauthorized local resolution changes. Monitor critical local name-resolution files for unauthorized modification. | ||
| ISO/IEC 27001:2022 | A.8.9 — Configuration management | Local hostname mappings are configuration items requiring controlled change. |
| Recommendation — Control and review hosts-file updates as part of managed system configuration. | ||
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | The hosts file is a local configuration element that should remain hardened and documented. |
| CIS-13 — Network Monitoring and Defense | Name-resolution tampering can be detected by monitoring unusual connection destinations. | |
| Recommendation — Standardize and audit hosts-file settings across endpoints and servers. Alert on traffic that resolves to unexpected internal or external destinations. | ||
Practitioner Guidance
What to watch for: Review /etc/hosts whenever a system reaches an unexpected IP, a known service name resolves incorrectly, or one host behaves differently from peers. Unexpected extra entries, altered comments, and unexplained precedence over DNS are all strong signals that the file deserves scrutiny.
Governance implication: Treat the file as part of hardened baseline management, not an ad hoc troubleshooting surface. On Linux estates, the Linux Server Hardening Guide is the natural companion for understanding how local configuration, file permissions, and host integrity controls fit together.
Practitioner takeaway: If a hostname resolves correctly everywhere except one system, check the local hosts file before assuming the problem is DNS.