109.4 Lesson 1

The best way to learn about this file is to read the man page that is part of the Linux man-pages project. It is available on most systems. It can be accessed with the command man nsswitch.conf. Alternatively, it can be found at https://man7.org/linux/man-pages/dir_section_5.html

Below is a simple example of /etc/nsswitch.conf from its man page:

The file is organized into columns. The far left column is the type of name database. The rest of the columns are the methods the resolution functions should use to lookup a name. The methods are followed by the functions from left to right. Columns with [] are used to provide some limited conditional logic to the column immediately to the left of it.

Suppose a process is trying to resolve the host name learning.lpi.org. It would make an appropriate C library call (most likely gethostbyname). This function will then read /etc/nsswitch.conf. Since the process is looking up a host name, it will find the line starting with hosts. It would then attempt to use DNS to resolve the name. The next column, [!UNAVAIL=return] means that if the service is not unavailable, then do not try the next source, i.e., if DNS is available, stop trying to resolve the host name even if the name servers are unable to. If DNS is unavailable, then continue on to the next source. In this case, the next source is files.

When you see a column in the format [result=action], it means that when a resolver lookup of the column to the left of it is result, then action is performed. If result is preceded with a !, it means if the result is not result, then perform action. For descriptions of the possible results and actions, see the man page.

Now suppose a process is trying to resolve a port number to a service name. It would read the services line. The first source listed is NIS. NIS stands for Network Information Service (it is sometimes referred to as yellow pages). It is an old service that allowed central management of things such as users. It is rarely used anymore due to its weak security. The next column [NOTFOUND=return] means that if the lookup succeeded but the service was not found to stop looking. If the aforementioned condition does not apply, use local files.

Anything to the right of # is a comment and ignored.

The file /etc/resolv.conf is used to configure host resolution via DNS. Some distributions have startup scripts, daemons, and other tools that write to this file. Keep this in mind when manually editing this file. Check your distribution and any network configuration tools documentation if this is the case. Some tools, such as Network Manager will leave a comment in the file letting you know that manual changes will be overwritten.

As with /etc/nsswitch.conf, there is a man page associated with the file. It can be accessed with the command man resolv.conf or at https://man7.org/linux/man-pages/man5/resolv.conf.5.html.

The file format is rather straight forward. In the far left column, you have the option name. The rest of the columns on the same line are the option’s value.

The most common option is the nameserver option. It is used to specify the IPv4 or IPv6 address of a DNS server. As of the date of this writing, you can specify up to three name servers. If your /etc/resolv.conf does not have a nameserver option, your system will by default use the name server on the local machine.

Below is a simple example file that is representative of common configurations:

The search option is used to allow short form searches. In the example, a single search domain of lpi.org is configured. This means that any attempt to resolve a host name without a domain portion will have .lpi.org appended before the search. For example, if you were to try to search for a host named learning, the resolver would search for learning.lpi.org. You can have up to six search domains configured.

Another common option is the domain option. This is used to set your local domain name. If this option is missing, this defaults to everything after the first . in the machine’s host name. If the host name does not contain a ., it is assumed that the machine is part of the root domain. Like search, domain can be used for short name searches.

Keep in mind that domain and search are mutually exclusive. If both are present, the last instance in the file is used.

There are several options that can be set to affect the behavior of the resolver. To set these, use the options keyword, followed by the name of the option to set, and if applicable, a : followed by the value. Below is an example of setting the timeout option, which is the length of time in seconds the resolver will wait for a name server before giving up:

There are other options to resolve.conf, but these are the most common.

The file /etc/hosts is used to resolve names to IP addresses and vice versa. Both IPv4 and IPv6 are supported. The left column is the IP address, the rest are names associated with that address. The most common use for /etc/hosts is for hosts and addresses where DNS is not possible, such as loop back addresses. In the example below, IP addresses of critical infrastructure components are defined.

Here is a realistic example of an /etc/hosts file:

Systemd provides a service called systemd-resolved. It provides mDNS, DNS, and LLMNR. When it is running, it listens for DNS requests on 127.0.0.53. It does not provide a full fledged DNS server. Any DNS requests it receives are looked up by querying servers configured in /etc/systemd/resolv.conf or /etc/resolv.conf. If you wish to use this, use resolve for hosts in /etc/nsswitch.conf. Keep in mind that the OS package that has the systemd-resolved library may not be installed by default.

The getent utility is used to display entries from name service databases. It can retrieve records from any source configurable by /etc/nsswitch.conf.

To use getent, follow the command with the type of name you wish to resolve and optionally a specific entry to lookup. If you only specify the type of name, getent will attempt to display all entries of that data type:

Starting with glibc version 2.2.5, you can force getent to use a specific data source with the -s option. The example below demonstrates this:

host is a simple program for looking up DNS entries. With no options, if host is given a name, it returns the A, AAAA, and MX record sets. If given an IPv4 or IPv6 address, it outputs the PTR record if one is available:

If you are looking for a specific record type, you can use host -t:

host can also be used to query a specific name server if you do not wish to use the ones in /etc/resolve.conf. Simply add the IP address or host name of the server you wish to use as the last argument:

Another tool for querying DNS servers is dig. This command is much more verbose than host. By default, dig queries for A records. It is probably too verbose for simply looking up an IP address or host name. dig will work for simple lookups, but it is more suited for troubleshooting DNS server configuration:

As you can see, dig provides a lot of information. The output is divided into sections. The first section displays information about the version of dig installed and the query sent, along with any options used for the command. Next it shows information about the query and the response.

The next section shows information about EDNS extensions used and the query. In the example, the cookie extension is used. dig is looking for an A record for learning.lpi.org.

The next section shows the result of the query. The number in the second column is the TTL of the resource in seconds.

The rest of the output provides information about the domain’s name servers, including the NS records for the server along with the A and AAAA records of the servers in the domain’s NS record.

Like host, you can specify a record type with the -t option:

Dig has many options to fine tune both the output and query sent to the server. These options begin with +. One option is the short option, which suppresses all output except the result:

Here is an example of turning off the cookie EDNS extension: