1 |
On 3/11/21 6:38 AM, Michael wrote: |
2 |
> I'm losing my thread in this ... thread, but what I'm trying to say |
3 |
> is the AD/ DC and Kerberos way of processing the /etc/hosts entries, |
4 |
> when an /etc/hosts file is used, is different to your run of the mill |
5 |
> Linux box and server. |
6 |
|
7 |
I disagree. |
8 |
|
9 |
First, AD/DC ~ Kerberos don't process the /etc/hosts file. They do ask |
10 |
the system to resolve names to IP addresses. |
11 |
|
12 |
Second, the system will process the /etc/hosts file, DNS, NIS(+) in the |
13 |
order configured in the /etc/nsswitch file so that it can resolve names |
14 |
to IP addresses for programs that ask it to do so. |
15 |
|
16 |
Third, both non-AD / non-Kerberos and AD / Kerberos systems ask the |
17 |
system to resolve names to IP addresses. Further, I'll bet dollars to |
18 |
donuts that they call the same functions and use the same subsystems. |
19 |
|
20 |
I will agree that non-AD / non-Kerberos systems are not sensitive to -- |
21 |
what some consider to be -- the misconfigurations that AD / Kerberos |
22 |
systems are. |
23 |
|
24 |
> The Samba link in a previous message makes it clear the DC must have |
25 |
> a DNS domain, which corresponds to the domain for the AD forest, |
26 |
> this will be used by the Kerberos AD realm; and, the DC must have a |
27 |
> static IP address. |
28 |
|
29 |
Yes. But that has nothing to do with the contents of the /etc/hosts file. |
30 |
|
31 |
> The syntax is: |
32 |
> |
33 |
> IP_address canonical_hostname [aliases...] |
34 |
|
35 |
Agreed. That's what it should be. Though I've seen all sorts of failures. |
36 |
|
37 |
> Therefore, in an entry like: |
38 |
> |
39 |
> 127.0.0.1 localhost host.example.net host |
40 |
> |
41 |
> the "host.example.net" and "host" are both entered as aliases, but |
42 |
> will nevertheless resolve to 127.0.0.1 - which will break the Samba |
43 |
> AD DC requirement. |
44 |
|
45 |
Agreed. |
46 |
|
47 |
> The host name and FQDN must resolve to the static IP of the DC on |
48 |
> the LAN. |
49 |
|
50 |
Remember, that this also applies to clients, not just DCs. |
51 |
|
52 |
> Since /etc/hosts is parsed from the top, things may work fine when |
53 |
> the localhost entry is further down the list and further down than |
54 |
> any other entries acting as AD DNS resolvers - I don't recall testing |
55 |
> this on Samba to know for sure. |
56 |
|
57 |
Why are you putting entries for the DNS servers in the /etc/hosts file? |
58 |
|
59 |
> The same syntax won't break a LAMP, or vanilla linux PC, as long as |
60 |
> the same box is not acting as a DC. |
61 |
|
62 |
Actually it can. I've seen it multiple times in the past. |
63 |
|
64 |
Bind a service to /only/ the LAN IP. Then have the system try to |
65 |
connect to itself. It will fail because the service isn't listening on |
66 |
the loopback IP. |
67 |
|
68 |
This is (or was) common on web servers that had multiple IP addresses to |
69 |
use different TLS certificates before SNI became a viable thing. Have |
70 |
each virtual web server listen on only it's specific IP address. Have |
71 |
the virtual web server for the system's FQDN follow suit for consistency |
72 |
reasons. Then trying to connect to the FQDN would fail if it was an |
73 |
alias for 127.0.0.1 or ::1. |
74 |
|
75 |
> See my statement above re. entries for AD DNS resolvers, if these |
76 |
> are listed in the /etc/hosts file. |
77 |
|
78 |
You didn't answer my question. |
79 |
|
80 |
What does the number of DNS servers (configured in /etc/resolv.conf) |
81 |
have to do with the contents of the /etc/hosts file? |
82 |
|
83 |
> The /etc/hosts file specifies the LAN IP address(es) of the DC which |
84 |
> acts as DNS resolver for the AD DNS zones. |
85 |
|
86 |
No, the /etc/hosts file has nothing to do with how /DNS/ resolution |
87 |
operates. |
88 |
|
89 |
> The DC's /etc/resolv.conf shouldn't be pointing to non-AD compatible |
90 |
> resolvers. |
91 |
|
92 |
Which has nothing to do with the contents of /etc/hosts. |
93 |
|
94 |
> ACK. I hope what I've written above better reflects my understanding, |
95 |
> although it could be factually incorrect. Other contributors should |
96 |
> soon put me right. :-) |
97 |
|
98 |
I'm wondering if your understanding is that there's a close relationship |
99 |
and interaction between the contents of /etc/hosts and /etc/resolv.conf |
100 |
as in the former effects the latter. This is not the case. |
101 |
|
102 |
/etc/hosts and /etc/resolv.conf are completely independent and can each |
103 |
quite happily exist without the other. You can even run systems without |
104 |
one or the other. Running without both is technically possible, but |
105 |
things start to get ... cumbersome. |
106 |
|
107 |
You can add entries in /etc/hosts for the DNS servers as a convenience. |
108 |
But doing so has no influence on how the DNS resolution subsystem |
109 |
functions. The DNS resolution subsystem is driven by options in the |
110 |
/etc/resolv.conf file. And it's done independently of the contents of |
111 |
the /etc/hosts file. |
112 |
|
113 |
Yes, the /etc/hosts file and the /etc/resolv.conf file both have to do |
114 |
with name to IP (and IP to name) resolution. But they are as |
115 |
independent of each other as looking up a phone number in the phone book |
116 |
vs calling and asking the operator to look it up for you. They achieve |
117 |
the same goal, but do so completely different ways and completely |
118 |
independently of each other. |
119 |
|
120 |
This has been and is an interesting discussion. However, I'm still no |
121 |
closer to learning why the Gentoo handbook wants the local host name |
122 |
added to the 127.0.0.1 / ::1 entry in the /etc/hosts file. Something |
123 |
which I believe is wrong and bad advice. |
124 |
|
125 |
|
126 |
|
127 |
-- |
128 |
Grant. . . . |
129 |
unix || die |