From 44b7aedbde8b30825ee1dbf47346d21007a1a417 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 15 Apr 2020 18:05:39 +0200 Subject: [PATCH 1/2] man: move "files" after "resolve" in the suggested configuration resolved caches files, so we should move nss-files after nss-resolve to speed up local access (and yes, people like to have thousands of lines in /etc/hosts). See https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/LCX6YXLM62QEYJSOLJBWXXVXTZVL73GI/ for the background. --- man/nss-myhostname.xml | 2 +- man/nss-mymachines.xml | 2 +- man/nss-resolve.xml | 19 ++++++++++--------- man/nss-systemd.xml | 2 +- 4 files changed, 13 insertions(+), 12 deletions(-) diff --git a/man/nss-myhostname.xml b/man/nss-myhostname.xml index 908c91eb7cd..9a1125caae3 100644 --- a/man/nss-myhostname.xml +++ b/man/nss-myhostname.xml @@ -83,7 +83,7 @@ group: compat mymachines systemd shadow: compat -hosts: files mymachines resolve [!UNAVAIL=return] dns myhostname +hosts: mymachines resolve [!UNAVAIL=return] files dns myhostname networks: files protocols: db files diff --git a/man/nss-mymachines.xml b/man/nss-mymachines.xml index 40b0abee344..71865874dd9 100644 --- a/man/nss-mymachines.xml +++ b/man/nss-mymachines.xml @@ -69,7 +69,7 @@ group: compat mymachines systemd shadow: compat -hosts: files mymachines resolve [!UNAVAIL=return] dns myhostname +hosts: mymachines resolve [!UNAVAIL=return] files dns myhostname networks: files protocols: db files diff --git a/man/nss-resolve.xml b/man/nss-resolve.xml index e4ea4e18982..5c8b7458816 100644 --- a/man/nss-resolve.xml +++ b/man/nss-resolve.xml @@ -34,14 +34,15 @@ name resolution service. It replaces the nss-dns plug-in module that traditionally resolves hostnames via DNS. - To activate the NSS module, add resolve to the line starting with - hosts: in /etc/nsswitch.conf. Specifically, it is recommended to place - resolve early in /etc/nsswitch.conf's hosts: line (but - after the files or mymachines entries), right before the - dns entry if it exists, followed by [!UNAVAIL=return], to ensure DNS queries - are always routed via - systemd-resolved8 if it is - running, but are routed to nss-dns if this service is not available. + To activate the NSS module, add resolve [!UNAVAIL=return] to the line starting + with hosts: in /etc/nsswitch.conf. Specifically, it is + recommended to place resolve early in /etc/nsswitch.conf's + hosts: line. It should be before the files entry, since + systemd-resolved supports /etc/hosts internally, but with + caching. To the contrary, it should be after mymachines, to give hostnames given to + local VMs and containers precedence over names received over DNS. Finally, we recommend placing + dns somewhere after resolve, to fall back to + nss-dns if systemd-resolved.service is not available. Note that systemd-resolved will synthesize DNS resource records in a few cases, for example for localhost and the @@ -66,7 +67,7 @@ group: compat mymachines systemd shadow: compat -hosts: files mymachines resolve [!UNAVAIL=return] dns myhostname +hosts: mymachines resolve [!UNAVAIL=return] files dns myhostname networks: files protocols: db files diff --git a/man/nss-systemd.xml b/man/nss-systemd.xml index e343c406f29..a5b3de73e72 100644 --- a/man/nss-systemd.xml +++ b/man/nss-systemd.xml @@ -65,7 +65,7 @@ group: compat [SUCCESS=merge] mymachines [SUCCESS=merge] systemd shadow: compat -hosts: files mymachines resolve [!UNAVAIL=return] dns myhostname +hosts: mymachines resolve [!UNAVAIL=return] files dns myhostname networks: files protocols: db files From f2a20e9966d48d460e50ab36d46e63277177878c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 15 Apr 2020 18:15:51 +0200 Subject: [PATCH 2/2] man: move "myhostname" right after "resolve" The text in the man page provides the justification why I think this is generally the right thing. An additional reason is that with the previous commit (to move resolved earlier), since resolved internally implements the same rules that nss-myhostname does, we'd have this strange inversion where the priority of external configuration would be different in the "resolve" path and in the fallback path. --- man/nss-myhostname.xml | 13 ++++++++++--- man/nss-mymachines.xml | 2 +- man/nss-resolve.xml | 2 +- man/nss-systemd.xml | 2 +- 4 files changed, 13 insertions(+), 6 deletions(-) diff --git a/man/nss-myhostname.xml b/man/nss-myhostname.xml index 9a1125caae3..e23b24483e4 100644 --- a/man/nss-myhostname.xml +++ b/man/nss-myhostname.xml @@ -67,9 +67,13 @@ To activate the NSS modules, add myhostname to the line starting with hosts: in /etc/nsswitch.conf. - It is recommended to place myhostname last in the nsswitch.conf' - hosts: line to make sure that this mapping is only used as fallback, and that any DNS or - /etc/hosts based mapping takes precedence. + It is recommended to place myhostname either between resolve + and "traditional" modules like files and dns, or after them. In the + first version, well-known names like localhost and the machine hostname are given + higher priority than the external configuration. This is recommended when the external DNS servers and + network are not absolutely trusted. In the second version, external configuration is given higher + priority and nss-myhostname only provides a fallback mechanism. This might be suitable + in closely controlled networks, for example on a company LAN. @@ -83,6 +87,9 @@ group: compat mymachines systemd shadow: compat +# Either (untrusted network): +hosts: mymachines resolve [!UNAVAIL=return] myhostname files dns +# Or (only trusted networks): hosts: mymachines resolve [!UNAVAIL=return] files dns myhostname networks: files diff --git a/man/nss-mymachines.xml b/man/nss-mymachines.xml index 71865874dd9..1ff88aba2d1 100644 --- a/man/nss-mymachines.xml +++ b/man/nss-mymachines.xml @@ -69,7 +69,7 @@ group: compat mymachines systemd shadow: compat -hosts: mymachines resolve [!UNAVAIL=return] files dns myhostname +hosts: mymachines resolve [!UNAVAIL=return] myhostname files dns networks: files protocols: db files diff --git a/man/nss-resolve.xml b/man/nss-resolve.xml index 5c8b7458816..cc33b2c0822 100644 --- a/man/nss-resolve.xml +++ b/man/nss-resolve.xml @@ -67,7 +67,7 @@ group: compat mymachines systemd shadow: compat -hosts: mymachines resolve [!UNAVAIL=return] files dns myhostname +hosts: mymachines resolve [!UNAVAIL=return] myhostname files dns networks: files protocols: db files diff --git a/man/nss-systemd.xml b/man/nss-systemd.xml index a5b3de73e72..ac22452bc3e 100644 --- a/man/nss-systemd.xml +++ b/man/nss-systemd.xml @@ -65,7 +65,7 @@ group: compat [SUCCESS=merge] mymachines [SUCCESS=merge] systemd shadow: compat -hosts: mymachines resolve [!UNAVAIL=return] files dns myhostname +hosts: mymachines resolve [!UNAVAIL=return] myhostname files dns networks: files protocols: db files