Systemd: Don’t fallback to Google NTP and DNS

Re:Systemd: Don’t fallback to Google NTP and DNS by znpy on Thursday July 02, 2020 @11:15AM (#23714139)

    It’s /etc/resolv.conf, and systemd overwrites it, 
    Network Manager overwrites it (like every 10 minutes),
    dhcp overwrites it, etc. What do they overwrite it to?

I still haven't understood where is the definitive place to set dns nowadays.

/etc/resolv.conf is routinely touched by stuff like NetworkManager and other stuff. Systemd-resolved config seems like the correct place, but I'm not sure how that plays with network-manager.

[ Parent | on HN ]

Re:Systemd: Don’t fallback to Google NTP and DNS by JdeBP on Thursday July 02, 2020 @06:48PM (#23718997)

There is no definitive place, because there are several ways in which people set up DNS service:

1. local resolving/forwarding proxy DNS server on loopback

2. resolving/forwarding proxy DNS server on another machine on the LAN with a known IP address

3. resolving/forwarding proxy DNS server on another machine on the LAN but only the LAN's DHCP server definitively knows what its IP address is

4. resolving/forwarding proxy DNS server out on the WAN with a known IP address

5. resolving/forwarding proxy DNS server out on the WAN but only the LAN's DHCP server definitively knows what its IP address is

There's scope for variation within each of these categories, moreover.

Part of the confusion is that most DHCP clients assume that you are doing #3 or #5, and continually switch over to them, until you turn that off by ignoring/superseding the relevant DHCP options. Traditionally in the Unix world one actually generally did #1, with a local BIND being as much a thing as a local Sendmail. Some DHCP clients can do a forwarding variant of #1, but only interoperate (easily) with a few forwarding proxy DNS server softwares. That nowadays #1 might be done with dnscache, or dnsmasq, or PowerDNS, or MaraDNS, or unbound, or something else, introduces configuration file variance but doesn't change the fundamental nature of #1.

systemd-resolved is mainly #1 too, but can operate in a mode where it is #3 or #5, in which case you have it and the DHCP clients doing overlapping work. One of the things that, in fairness, one can actually praise about systemd-resolved is that whilst conventional DHCP clients actually end up rewriting /etc/resolv.conf itself (via resolvconf and similar mechanisms) systemd-resolved instead rewrites two files of its own, and lets you rather choose to symbolically link /etc/resolv.conf to (one of) them. If the conventional DHCP clients also did this more, there'd be less of the conflict between #1/#2/#4 and #3/#5.

[ Parent | on HN ]

Re:Systemd: Don’t fallback to Google NTP and DNS by manjalyc on Thursday July 02, 2020 @11:23AM (#23714277)

Universal practice is editing the resolv.conf file and then write-protecting it with.

  chattr +i /etc/resolv.conf

This always works, but certain applications NetworkManager have their own preferred way of doing things that I quite frankly do not care to learn.

[ Parent | on HN ]

Re:Systemd: Don’t fallback to Google NTP and DNS by kevin_nisbet on Thursday July 02, 2020 @11:34AM (#23714419)

I think it get's a bit harder than this, with newer systemd supporting name resolution over dbus. It's conceivable that some programs may move away from libc resolvers using resolv.conf and start querying the service directly over dbus.

I'm not sure I'm personally a fan, just saying it's something that might become more common based on my read of the systemd docs awhile back.

[ Parent | on HN ]

Re:Systemd: Don’t fallback to Google NTP and DNS by vetinari on Thursday July 02, 2020 @12:00PM (#23714715)

> with newer systemd supporting name resolution over dbus.

Not only that, with suitably configured nsswitch.conf, (e.g. with nss-resolve), you might find out that your /etc/resolv.conf is used only by apps that have their own resolver and ignore the glibc one.

[ Parent | on HN ]

Re:Systemd: Don’t fallback to Google NTP and DNS by manjalyc on Thursday July 02, 2020 @11:55AM (#23714666)

Ah, I didn't want to get into the stupidity and sysadmin nightmare of systemd-resolved, but rest-assured even with systemd-resolved active most users can simply manage their /etc/resolv.conf file and systemd-resolved should respect it. It gets trickier when you don't have a network manager program or are use dhcp, VPNs, etc.

[ Parent | on HN ]

Re:Systemd: Don’t fallback to Google NTP and DNS by vetinari on Thursday July 02, 2020 @11:57AM (#23714689)

> I still haven't understood where is the definitive place to set dns nowadays.

If you are using NetworkManager, then in NetworkManager, per each connection. You can also configure which zones each of them can resolve, if they are not global.

So you can things like using your prefered global DNS and then have per-VPN DNS that can resolve hosts in whatever network you VPN into.

[ Parent | on HN ]

Re:Systemd: Don’t fallback to Google NTP and DNS by marcosdumay on Thursday July 02, 2020 @12:42PM (#23715120)

> I still haven't understood where is the definitive place to set dns nowadays.

There isn't. There are half a dozen packages on a Linux install that each will reset the DNS settings as they wish.

Setting your network DHCP with the correct values tends to work, because everything queries it. But I still didn't manage to replace the upstream DNS on the DHCP server.

[ Parent | on HN ]

Re:Systemd: Don’t fallback to Google NTP and DNS by creeble on Thursday July 02, 2020 @11:52AM (#23714625)

That's because distro releases just love to keep changing where network configuration goes.

NetworkManager? No it's in sysconfig/interfaces. No that was last release. Now it's in a netplan YAML file you get to learn all about.

So many terrific "improvements" every release!

[ Parent | on HN ]