AdminSysGNULinux

Cette page est en lecture seule. Vous pouvez afficher le texte source, mais ne pourrez pas le modifier. Contactez votre administrateur si vous pensez qu'il s'agit d'une erreur.
{{tag>Brouillon DNS CA}}

= Notes client DNS

Voir aussi les clients DNS :
* [[https://doc.ubuntu-fr.org/unbound|Unbound]]

Voir aussi :
* https://linuxfr.org/news/happydomain-on-devrait-tous-avoir-un-nom-de-domaine#toc-%C3%80-quoi-sert-happydomain


=== /etc/resolv.conf

Voir aussi:
* /etc/nsswitch.conf

==== Hard limits for the /etc/resolv.conf file

NOTE : Le comportement est différent avec **musl libc** (alternative à glibc)

You need to be aware of the hard limits for name servers, domain name, and search domains when you create or edit the ''/etc/resolv.conf'' file.

The hard limits for the ''/etc/resolv.conf'' file are as follows:
  *     Maximum number of name servers is 3. (is hardcoded as the 4th will never be used)
  *     Maximum line size is 256. (avant glibc 2.26 ?)
  *     Maximum domain name length is 256 characters. (avant glibc 2.26 ?)
  *     Maximum search domains limit is 6.
    * In glibc 2.25 and earlier, the search list is limited to six domains with a total of 256 characters.  Since glibc 2.26, the search list is unlimited (RHEL 6 ; sous RHEL 7 et 8 ça dépend de la version de la glibc)
  *     Total number of characters for all search domains is 256. (avant glibc 2.26)
  *     Note: You should use only tab or space to separate host names in the search domain list.


Si plus de 3 serveurs dans /etc/resolv.conf : "Nameserver limits were exceeded, some nameservers have been omitted..."


Note: There is no limit on file size.


Le mot-clé **search** du fichier ''resolv.conf'' du système  peut  être  surchargé  indépendamment
pour  chaque  processus  en  remplissant  la variable d'environnement **LOCALDOMAIN** avec une
liste de domaines de recherche séparés par des espaces. \\

Le mot-clé **options** du fichier ''resolv.conf'' du système peut  être  surchargé  indépendamment
pour  chaque processus en remplissant la variable d'environnement **RES_OPTIONS** en une liste
d'options de la bibliothèque resolver (séparées par  des  espaces)...



=== Redirection de port

<code bash>
sudo socat -v -v udp4-listen:53,reuseaddr,fork udp4:8.8.8.8:53
</code>


== Test connexions

<code bash>
# UDP
#host -U -W 1 127.0.0.1 8.8.8.8
host -W 1 127.0.0.1 8.8.8.8

# TCP
host -T -W 1 127.0.0.1 8.8.8.8
</code>

<code bash>
echo "127.0.0.1,192.168.1.1,8.8.8.8" |tr "," "\n" |xargs -L1 -I% bash -c "host -W 1 plop.plop % |grep -q 'not found' && echo OK % || echo NOK %"
</code>

<code yaml>
- name: Check DNS connectivity - UDP
  command: "host -W 1 127.0.0.1 {{ item | quote }}"
  check_mode: false
  changed_when: false
  register: cmd_host_udp
  failed_when: not ( cmd_host_udp.rc == 0 or ( cmd_host_udp.rc == 1 and cmd_host_udp.stdout_lines is search('not found') ) )
  with_items: "{{ resolv_new_nameservers }}"

- name: Check DNS connectivity - TCP
  command: "host -T -W 1 127.0.0.1 {{ item | quote }}"
  check_mode: false
  changed_when: false
  register: cmd_host_tcp
  failed_when: not ( cmd_host_tcp.rc == 0 or ( cmd_host_tcp.rc == 1 and cmd_host_tcp.stdout_lines is search('not found') ) )
  with_items: "{{ resolv_new_nameservers }}"

</code>


Ou encore :
<code bash>
curl --dns-servers 192.168.0.1,192.168.0.2 https://example.com
curl --dns-servers 10.0.0.1:53 https://example.com

systemd-resolve HOSTNAME SERVERNAME
</code>


== Conf Docker

=== Docker-compose

<code yaml>
  my-app:
     build: my-app
     dns:
       - 10.20.20.1  # dns server 1
       - 10.21.21.2  # dns server 2
     dns_search: ibm-edv.ibmnet.int
</code>


<code yaml>
spec:
  containers:
  - name: test
    image: nginx
    dnsConfig:
      options:
      - name: timeout
        value: "2"
</code>


<code yaml>
extra_hosts:
 - "somehost:162.242.195.82"
 - "otherhost:50.31.209.229"
</code>





== Cache DNS coté client

Voir aussi :
* https://geekflare.com/fr/setup-dns-caching-dnsmasq-on-ubuntu/
* https://doc.ubuntu-fr.org/unbound
* Rescached
  * https://wiki.archlinux.org/title/rescached
  * https://github.com/shuLhan/rescached-go


''/etc/systemd/resolved.conf''
<code ini>
DNS=1.1.1.1 1.0.0.1
</code>

<code bash>
sudo mv /etc/resolv.conf /etc/resolv.conf.orig

sudo ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
</code>

''/etc/resolv.conf''
<code bash>
nameserver 127.0.0.53
options edns0
</code>

**Voir aussi ''/etc/nsswitch.conf''**

<code bash>
sudo pkill -USR1 systemd-resolve
sudo systemd-resolve --flush-caches
sudo resolvectl flush-caches

sudo journalctl -u systemd-resolved > ~/resolved.txt

sudo systemd-resolve --statistics
</code>



=== Flush DNS / Clear cache


Vider le cache DNS SystemD
<code bash>
systemd-resolve --flush-caches
</code>

Clear BIND Server DNS Cache
<code bash>
sudo rndc restart
</code>

Clear DNS cache for a particular domain, use the below command.
<code bash>
sudo rndc flushname <Domain_Name>
</code>

Clear the dnsmasq Server DNS Cache
<code bash>
sudo systemctl restart dnsmasq
</code>

Flush nscd server DNS Cache
<code bash>
sudo systemctl restart nscd
</code>

pdnsd
<code bash>
pdnsd-ctl empty-cache
</code>


== Options

No ipv6 AAAA
<code ->
# since glibc 2.36
options         no-aaaa
</code>

no-tld-query (since glibc 2.14)


== Pb

=== Pb Résolution noms courts

''/etc/resolv.conf''
<code bash>
# options rotate timeout:1 retries:1
# options rotate timeout:2 attempts: 1
options         timeout:0 attempts:1
nameserver      192.168.10.10
nameserver      192.168.11.10
search          domain1.local domain2.local
domain          domain2.local
</code>

Résolution FQDN OK
<code ->
# getent hosts srv01.domain1.local
192.168.1.101  srv01.domain1.local
</code>

Résolution FQDN NOK
<code ->
# getent hosts srv01
#
</code>


==== Solution

Placer ''search'' après ''domain'' ou alors commenter ''domain''

According to the implementation of Glibc, if ''domain'' and ''search'' directives are both used, only the last instance will be used for DNS queries. \\
Source : https://access.redhat.com/solutions/5958611

The ''domain'' directive is an obsolete name for the ''search'' directive that handles one search list entry only. \\
Source : https://man7.org/linux/man-pages/man5/resolv.conf.5.html

''/etc/resolv.conf''
<code bash>
options rotate timeout:1 retries:1
# options rotate timeout:2 attempts: 1
nameserver      192.168.10.10
nameserver      192.168.11.10
domain          domain2.local
search          domain1.local domain2.local
</code>

<code ->
# getent hosts srv01
192.168.1.101  srv01.domain1.local

# getent hosts srv01.domain1.local
192.168.1.101  srv01.domain1.local
</code>


=== Pb client DNS Linux résolution FQDN KO

<code bash>
$ getent hosts plop
192.168.21.25    plop.acme.local

$ getent hosts plop.acme.local
$

$ dig +short plop.acme.local
192.168.21.25
</code>


==== Solution

Vérif avec dig / nslookup et si OK le pb est ailleurs, par exemple dans la conf **libc**

''/etc/nsswitch.conf''
<code ->
#hosts:          files mdns4_minimal [NOTFOUND=return] dns myhostname
hosts:          files dns myhostname
</code>



== Outils


=== Dig

the step-by-step name resolution, you can do this:
<code bash>
dig +add +trace @8.8.8.8 www.google.com
</code>

=== kdig 

kdig client (part of Knot): 

kdig +tls @localhost -p 8353 foobar.test


=== check-soa

https://framagit.org/bortzmeyer/check-soa

=== blaeu-resolve

<code bash>
blaeu-resolve -r 100 - -type NS meteofrance.com
</code>


--------------

== Notes client DNS & diag

<code bash>
# /etc/systemd/resolved.conf
sudo systemctl restart systemd-resolved.service
</code>

Conf
<code bash>
systemd-resolve --set-dns=192.168.1.1 -i wlan1
</code>

Status
<code bash>
systemd-resolve --status
</code>



Disable and stop the systemd-resolved service
<code bash>
sudo systemctl disable systemd-resolved.service
sudo systemctl stop systemd-resolved
</code>

''/etc/NetworkManager/NetworkManager.conf''
<code ini>
[main]
dns=default
</code>

<code bash>
unlink /etc/resolv.conf
sudo service network-manager restart
</code>

DHCP DNS ?

''/etc/systemd/network/enp0s31f6.network''
<code ini>
[DHCP]
UseDNS=true
</code>

Autre 
<code bash>
ps aux |grep dnsmasq 
</code>



=== Diag port ?

''resolv.py''
<code python>
import socket
for x in range(5):
   print(socket.getaddrinfo('gnu.org', 80))
</code>

<code ->
# strace -e trace=connect python resolv.py 2>&1 | grep 53
connect(3, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("192.168.10.10")}, 16) = 0
connect(3, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("192.168.20.20")}, 16) = 0
connect(3, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("192.168.1.5")}, 16) = 0
connect(3, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("192.168.10.10")}, 16) = 0
connect(3, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("192.168.20.20")}, 16) = 0
</code>



<code bash>
lsof -i udp:53
time tcpdump udp port 53 -Qout -n |nl
time strace -f -e trace=%network -p 29976 2>&1 |grep 'htons(53)' |nl
</code>

<code ->
# sysdig -c lsof "'fd.l4proto=udp and fd.port=53'"
COMMAND             PID     TID     USER    FD      TYPE        NAME
systemd-resolve     2870470 2870470 systemd 12      ipv4        127.0.0.53:53
</code>

<code bash>
csysdig -v connections fd.ip=10.172.93.224
iftop -f "host 10.172.93.224"
</code>


== Autres

windows

<code ->
nslookup
set detail
</code>


== Todo

Root serveur.
MX
Transfer de zone.
[[audit]]

-------

https://github.com/bortzmeyer/check-soa

<code bash>
check-soa -i dz
</code>