33 ms·

resolv.conf on Linux (2018)

251 points by ausjke 8y ago

adevx 8y ago
I always edited this file than used chattr +i /etc/resolv.conf to prevent further modifications.
petronio 8y ago
After running into this a while ago when I was rebuilding my system and getting annoyed by all the different things that try to modify it, I ended up giving up and just setting the file to immutable. It has been working fine for the past couple of months as nothing seems to autodetect the flag and try to remove it. chattr +i /etc/resolv.conf
- smhenderson 8y ago
  I started doing this exact same thing in Debian, I think around Wheezy. Lately I’m back onSlackware and a little *BSD. Thankfully these systems still go the traditional route so it’s not much of an issue anymore.
- lkirk 8y ago
  I have used this in the past. There are only a few places where this bites you, for instance wifi authentication portals. Some of these wifi access points change your resolv.conf so that you can load their internal page for terms and conditions.
  - likkwidd 8y ago
    I solved the captive portal issue by using captive browser https://github.com/FiloSottile/captive-browser https://github.com/FiloSottile/captive-browser
    - lkirk 8y ago
      Very cool, thanks. I will probably be using this in the future
- low_key 8y ago
  In addition, if you're using dhcp, you can add an enter hook to override make_resolv_conf so /etc doesn't get cluttered with a ton of extra files.
- gjs278 8y ago
  same thing I do because vpnc insists on overwriting it
- narag 8y ago
  Is there a tool that can log processes trying to modify a file?
  - jlgaddis 8y ago
    auditd(8)
    - narag 8y ago
      Thank you!
- williamscales 8y ago
  I've been doing this for months as well. Works beautifully, I thought I was the only one.
- DavideNL 8y ago
  Same. I'm just a Linux "amateur", but what a huge mess to configure something so trivial/simple... (in Debian/Ubuntu compared to Mac/Windows.)
- zcid 8y ago
  This is usually the easiest way especially if you use a caching resolver like unbound and you expect resolv.conf to always point to localhost.
xfitm3 8y ago
I think NetworkManager only exists because wpa supplicant is difficult to use. I loathe networkmanager.
- miffe 8y ago
  Try iwd which replaces wpa supplicant. It makes wifi connections a breeze. https://git.kernel.org/pub/scm/network/wireless/iwd.git/ https://git.kernel.org/pub/scm/network/wireless/iwd.git/
- microcolonel 8y ago
  NetworkManager is convenient, especially for bringing up the kinds of bridged connections, virtual NATs, etc. that ordinary power users often want but don't believe they can achieve. And of course, you have every option not to use it, or to improve it, or to propose your own replacement.
  - fernandotakai 8y ago
    at least for me, configuring vpns on network manager is a LOT simpler than doing by config files.
- subway 8y ago
  It exists because it's nice to have a unified place to define all your network connections and their behavior, instead of having them spread across wpa_supplicant, pppd, mbim-network, dhcpcd, openvpn, vpnc, freeswan, iptables, and ifupdown.
- swiley 8y ago
  Once you understand it wpa_supplicant is way more user friendly than other tools. Most of the other ones just say "stuff is broken too bad :(" when a connection fails. wpa_supplicant tells you everything that's wrong and not only that, usually gives you an easy way to fix it.
amaccuish 8y ago
On my domain controllers (where I absolutely cannot have anyone touching the conf), I just chattr +i /etc/resolv.conf. That prevents anything, even root, from changing the file, unless chattr -i is called first.
- ktpsns 8y ago
  Wow, I wasn't aware of the chattr command at all. Here is a list of available: https://en.wikipedia.org/wiki/Chattr https://en.wikipedia.org/wiki/Chattr Apparently, they are very file system specific. That's why they are not widely used. I guess a chmod 0444 would not do it, as system tools tend to "fix" wrong permissions automatically (but not permissive attributes).
  - deleted 8y ago
    [deleted]
  - j7k6 8y ago
    I use `chattr +i` with NFS mountpoints for backups, it prevents the local harddrive from filling up when a network share fails to mount on boot.
    - muxator 8y ago
      Totally. If something is meant to be a mount point, a chattr +i on the underlying directory is a godsend, because it gives you an immediate error in case the mount should fail for whatever reason.
  - larkeith 8y ago
    You might be able to do it in a more system-agnostic manner with SELinux.
    - cyphar 8y ago
      That would be less system-agnostic because you have to be running with SELinux as the LSM. The immutable attribute is supported on almost all filesystems.
smilesnd 8y ago
I miss the days when I didn't have to worry about outside programs changing my configs without my knowledge.
- microcolonel 8y ago
  Well, you chose to install it, you can configure it not to do this. For the vast majority of people, myself included, NetworkManager should have control of DNS resolvers (at least, when I have WiFi on a system. I usually don't use NetworkManager on Ethernet-only systems, since there's systemd-networkd).
  - gerdesj 8y ago
    Absolutely. My laptop travels across a lot of networks, wifi and ethernet, with and without OpenVPN and Mobile IPSEC. I tether to my phone. I have some IPv6 networks to worry about. Firewalld is expected to do the right thing as well. I have loads of NM profiles, one of which has several RFC1918 addresses for covering most bases when starting out with routers and switches.
- ktpsns 8y ago
  Isn't it great to have the choice wether some tool manages the system or one does it manually? Thanks GNU/Linux, thanks all the Linux distributions maintained by hundreds of volunteers!
  - zamadatix 8y ago
    Choice is "do you want to <x> or <y>" not "if you don't want <x> figure out how to implement <y> on your own". That's simply known as "doing the work yourself" and is largely possible on even closed sourced systems assuming you have rights on the box. There is nothing wrong with that but it shouldn't be conflated as choice and paraded as success of such.
    - derefr 8y ago
      The GP is referring to all the other Linux distributions who really give you <y> (or <z> or <Þ>), not to implementing <y> on your own. There are distributions (e.g. Linux from Scratch) for when the option you want is the NULL option—i.e., doing things yourself. But there are N other managed options, not just one managed option and NULL.
johnklos 8y ago
Does this need to be updated, or is what's in here relevant for the latest round of Ubuntu changes?
- d2wa 8y ago
  It’s up to date.
kingo55 8y ago
Hands down the most annoying defaults on Linux. Being an OS for nerds, I'm surprised NetworkManager doesn't handle for manual updates to resolv.conf
- peterwwillis 8y ago
  If you manually change something, how is it supposed to handle it? Notify the user and ask them to accept the change? But NetworkManager changes the file based on each network. So it'd have to ask you every time you connected to any network. And what do you do until the user accepts the change? Default to nothing? That would break any headless box where resolv gets accidentally overwritten. The simple solution is, make your manual overrides through NetworkManager, or don't use it.
  - subway 8y ago
    NM doesn't always change resolv.conf. This entirely depends on the dns backend. If it's set to use dnsmasq, systemd-resolved or unbound as a dns backend, it never touches the file, instead passing nameservers in to the stub resolver dynamically. https://wiki.gnome.org/Projects/NetworkManager/DNS https://wiki.gnome.org/Projects/NetworkManager/DNS
- the_why_of_y 8y ago
  NetworkManager generates resolv.conf from the information associated with an arbitrary number of network connections. Which, or how many, of these N network connections should manual updates be mapped to? Edit: now I notice a sibling comment already asked almost the same question, but it was greyed out.
jedisct1 8y ago
Removing `systemd-resolved` is often enough, but like many, `chattr +i /etc/resolv.conf` is also the next trick I do.
g45y45 8y ago
You really want to do this if you use Spectrum Cable. You are locked out of configuring the DNS settings via their cable modems (even if you supply your own). These force a DNS search suffix that leaks all DNS requests to their server, even if you are using another public DNS. I noticed network manager kept forcing the DNS search suffix, even after I manually disabled it. I did the config change to disable it messing with the resolv.conf
- gnu8 8y ago
  You should put your own router between their modem and your network, and not rely on DHCP from their modem for any of your network configuration.
  - ahmedalsudani 8y ago
    You usually need to use DHCP to get your IP address, but any decent router will let you pick your preferred DNS server.
    - deleted 8y ago
      [deleted]
    - isostatic 8y ago
      Worst case scenario is your first hop downstream from the cable modem does port 53 interception and redirects. However if the only ISP you can get is so hostile, the solution is to tunnel (IPSEC/SSTP/whatever works) all your traffic to a non-hostile network.
      - erinnh 8y ago
        Use a firewall with nat to redirect all dns traffic to a DoT or DoH dns proxy in your network. That way you dont have to tunnel all your traffic. (Though technically you could also use the tunnel for only DNS, but its not much easier than the solution above if you want this to apply to all your devices)
Faaak 8y ago
I hate systemd-resolved because it uses glib's resolver. The problem is that this resolver doesn't understand root queries. That means that `dig +trace` doesn't work anymore, and you have to use an external server for the root zone. This is such a trivial use case not taken into account by systemd (they don't even want to fix it), that I'm saddened by it..
- coldacid 8y ago
  systemd is such complete garbage that I immediately write off any distros that run on it as unusable. For all the fail of SysV init, at least it sticks to its own job and little else.
  - tzakrajs 8y ago
    SysV init was so full of fail (race conditions, no dependency management, slow as hell, stupid metaphors -- run levels? really?) that people wrote Systemd. Anyone can expand on systemd to have it do stupid shit it shouldn't. But you can do that with any technology that is composable. It does not mean that the core of systemd isn't anything short of incredibly useful.
    - xvaaa 8y ago
      And yet Linux distros like Ubuntu around 9.0 were much more stable than these days. With 16.04 I get core lockups (Intel microcode) and cannot switch out of X with Ctrl-Alt-F1. NetworkManager no longer connects the mobile surfstick, so I do it manually now with pppd. I can't claim that I had a specific problem with systemd, but I never had an issue with SysVinit either. The overall trend however is that Linux distros accumulate crapware by RedHat's NIH developers. I'm not surprised that NetworkManager is also by RedHat.
      - isostatic 8y ago
        I assumed the new network layer in ubuntu 18.04 (which replaced /etc/network/interfaces) was some pan-distro/redhat inspired solution. Apparently not -- netplan is ubuntu originated. They don't do themselves any favours.
StreamBright 8y ago
Alpine for the rescue. Seriously, there must be something super broken with Linux if this article exists.
- coldacid 8y ago
  It's not Linux that's broken, it's arrogant developers of system daemons that are broken.
- swiley 8y ago
  Alpine is definitely the most sane distro at the moment. I just can't recommend it to my friends because I find myself having to compile anything that isn't super common, and of course nothing that needs glibc works (which, is acceptable to me because I do prefer the smaller libc but some people might really dislike it.)
  - AnIdiotOnTheNet 8y ago
    > I find myself having to compile anything that isn't super common Yes well, that's what happens when package managers, with their dependence on maintainers and whatnot, are your culturally lauded software distribution method.
- theon144 8y ago
  Not Linux, mostly systemd.
- vectorEQ 8y ago
  systemd :')
NelsonMinar 8y ago
Along these lines, netplan in Ubuntu is seriously confusing. That's the set of scripts that rewrites most of your network config in /etc with stuff generated from some new set of YAML config files. I'm willing to believe netplan is a Better Way to configure networking, but the kludge of having it rewrite long-understood config files in /etc is really awful.
- isostatic 8y ago
  I tried to get on baord with netplan, I really did. I thought it was a redhat inspired systemd-esque invasion. Turns out it's an 'upstart' type ubuntu crapfest that's unlikely to survive as long as 20.04. I wouldn't mind, but the very first machine I tried to configure with it was an ntop machine, I wanted 2 interfaces to come up with no IPs attached. Turns out it's not possible.
  - jandrese 8y ago
    I ran into Netplan with an 18.04 server install and the whole time I was asking myself why this was better than the old system.
deathanatos 8y ago
I use a custom resolv.conf. Really, the biggest problem is airports: some want you to go through a captive gateway, but the captive gateway's domain is not publicly registered, so if you're using 8.8.8.8 or similar, it fails to resolve. Leads to an annoying trip to resolv.conf (well, resolvconf.conf in my case) to tell it to use the DHCP settings, run through the portal, and then flip back. (And like, is it really that hard to register your captive portal's name globally, and just let me use a global resolver to get to it? IDK if they're concerned about DNS tunneling, but this happens even on "free" WiFi (where free might mean "watch this ad", which honestly is fine w/ me.))
- isostatic 8y ago
  The people that run these network shave no idea what global resolving and DNS tunneling are. The people that build the systems that provide these networks likely don't know what DNS tunneling is.
- JoshTriplett 8y ago
  > Really, the biggest problem is airports: some want you to go through a captive gateway, but the captive gateway's domain is not publicly registered, so if you're using 8.8.8.8 or similar, it fails to resolve. Ideally, the software detecting captive portals on a network and presenting their login page should also use the network-provided DNS server solely to resolve the captive portal domain if it doesn't resolve with the preferred resolver. That would solve this case. (Also, ideally, captive portals would serve up a URL using DHCP options and not capture traffic.)
- Tsiklon 8y ago
  I saw another user here in this comments section reference a project which might be useful to you: https://news.ycombinator.com/item?id=19436783 https://news.ycombinator.com/item?id=19436783
tyingq 8y ago
Also see "systemd-resolved does not keep the order of the DNS servers" for another irritation with systemd-resolved: https://github.com/systemd/systemd/issues/5755 https://github.com/systemd/systemd/issues/5755 And..."systemd-resolved does not use DNS for local resolution" https://github.com/systemd/systemd/issues/6224 https://github.com/systemd/systemd/issues/6224
AJRF 8y ago
I just recently came across this in Ubuntu and was astounded that it's allowed to be this way. I think this kind of behavior will become more and more prevalent once one util is allowed to do it. It leads us on a path where daemon authors don't allow us to override the settings to suit us, rather to kept them controlled to suit them. The arrogance sets a very bad precedent.
- sverige 8y ago
  The arrogance has been there since the start of systemd. It's not just a comment on a particular personality, either, but rather on the general attitude as demonstrated by design decisions. I think it helps to think of it as making Linux more like Windows, with all of the plumbing hidden from the user and difficult to tweak by the administrator. "Why would you need to, anyway? We've already taken care of that for you."
  - glennpratt 8y ago
    That's rich considering that I regularly use systemd override files with no issue instead of having to hack garbage init scripts filled with bugs.
  - johnny22 8y ago
    hah. i've never had an easier time tweaking linux than with systemd. My first linux was I think Debian Potato (or whatever came on a cd in 1998).
m45t3r 8y ago
Just to some people know, systemd-resolved does not override /etc/resolv.conf by default. I know because neither Arch not NixOS does this, you need to explicitly override it using `ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf`. The culprit is actually NetworkManager. When it detects that systemd-resolved is running it sets the default resolver to systemd-resolved, and automatically makes the override for the user. I think it also does the same for the other supported resolvers (unbound, dnsmasq, etc.).
- m45t3r 8y ago
  To fix it, following just the first part of the article is sufficient (setting `dns=none` in NetworkManager configuration). There is no need to remove or disable systemd-resolved, set chattr +i or anything else (of course, if you're not using you can remove it without problems).
  - jniedrauer 8y ago
    I thought this was common knowledge. I've been doing this since the upstart days...
- fxfan 8y ago
  I hear a lot of chatter about nix. What do you use it for and how is it working out for you?
  - jordanbeiber 8y ago
    Personally I really like having the whole system configuration declared and checked in to vcs. The way packages are like functions in the nix code repo gives you at least fair confidence that things will actually work as intended. Or at the very least it gives you insight into why it doesn’t. More so compared to a traditional deb/rpm distro in my experience. Not saying it’s perfect by any means, just that it has worked brilliant for a few small projects of mine involving some pi’s. At the workplace though, resistance is high amongst my traditionalist RH/centos co-workers. :)
keybuk 8y ago
We had a great plan somewhere around Ubuntu intrepid or jaunty that rather than have apps rewrite /etc/resolve.conf, we'd leave it as a static file and have a "nameserver dynamic" type config in there. ie. sensible default for many people, but super easy to override
sly010 8y ago
This seems backwards. I don't feel strongly about networkd or NetworkManager either way, but I am curious on the meta-debate. I am personally a fan of the modernization of the linux userspace in the last 10 years (systemd, wayland, networkmanager), but I also understand that the puzzle pieces don't always fit together. However the argument against new things always seems to come down to "not what I am used to". Other than tradition what is wrong with explicitly configuring NetworkManager to configure /etc/resolv.conf "my way" instead of going behind it's back. Does it not have a "DNS Server: manual" option?
- nisa 8y ago
  I'm only a bystander in this fight but this is dishonest: > However the argument against new things always seems to come down to "not what I am used to". For me it's always: I can't debug this. I remember installing RHEL 7.0 just after release and nmtui crashing on me with some weird problem in glib when setting a hostname using it. I also remember trying to debug openvpn in network manager (https://i.imgur.com/zbaRcST.mp4 https://i.imgur.com/zbaRcST.mp4) and both of these are beaten paths... I'm able to somehow get around most shell scripts but when something crashes in C land on a customer box - what a PITA! It's not impossible but the amount of work I have to invest is just sooo huge. I remember yelling at reddit about some gnome stuff - and I've got a link to several powerpoint presentations... give me technical documentation not powerpoints and give me tools to troubleshoot that shit. No strace should be a last resort and not your goto tool: https://blog.uberspace.de/systemd-error-getting-authority-kohoutek/ https://blog.uberspace.de/systemd-error-getting-authority-ko... (link in german, but google translate should work)
  - sly010 8y ago
    Good point. > this is dishonest Of course it is, I was trying to trigger a response :)
  - spc476 8y ago
    Having used Unix since 1989 and basically, everything related to Unix admin changes every 10 years. I'm tired of it. And I relish the fact that in twenty years, this year's set of hipster devop admins calling me a neckbeard will be screaming "get off my lawn" at the constant arbitrary changes this industry seems love.
Proven 8y ago
The fact that these articles (he has another, on this topic) are useful says a lot about how hard to manage mainstream Linux has become. I don't know if that's because of systemd or because I don't like to waste my time on understanding the internals of something that should be simple and straightforward, but it is crap. As the article points out it's not that hard to change those settings, but how it may impact other services and apps is not easy to figure that out. Some time ago I made such changes and it seemingly worked but it broke Docker which I didn't realize until weeks later when I tried to use it.
deleted 8y ago
[deleted]
blattimwind 8y ago
Using the immutable flag, of course.
purplezooey 8y ago
I laughed at the title. I've been surprised every time I open resolv.conf lately it says "do not edit!".
deleted 8y ago
[deleted]
nydel 8y ago
it's only recently that the updates on ubuntu and other systemd'd linux distributions have been frequently writing resolv.conf. the suspicion that a user is so incapable of having already set DNS servers is so strong that whatever-is-doing-this doesn't even bother to ask if or check whether the resolv.conf file is different from default. this seems a little too critical of, possibly insulting to the intelligence of, people who use these versions of linux.
usr1106 8y ago
The article and the previous discussion here do not cover any modern distribution using glibc and systemd-resolved. /etc/resolv.conf has become legacy and is not even used by most programs anymore. "Taking back control" of something that is not used will not change much... Modern programs should use getaddrinfo(3). The glibc implementation of that call will first consult the "hosts:" line of /etc/nsswitch.conf. That file will contain a list to determine how host names are resolved: The first entry is typically "files". That means consult /etc/hosts file. Next there could be something to consult avahi/autoip, Ubuntu systems typically do that. There could also be entries "myhostname" and "mymachines". That's systemd's container support, not discussed here. If the system uses systemd-resolved there will be an entry "resolve". Than means consult systemd-resolved Typically the last one is "dns". That's the traditional implementation using /etc/resolv.conf. But if systemd-resolved is configured and working we never get here. Only if you don't have "resolve" before "dns" in your /etc/nsswitch.conf then /etc/resolv.conf is still relevant. It appears to me that musl does not use /etc/nsswitch.conf at all, so there /etc/resolv.conf is still relevant.
- petre 8y ago
  I always disable and deinstall systemd-resolved. It's unnecessarily convoluted and just always gets in the way. Adding an 127.0.0.53 alias? Why in the world is that even necessary? Dnsmasq is fine, is used by NetworkManager and can be easily set up to query a DNS cache of your choice. On servers, an unbound local resolver is a better alternative and it's used on FreeBSD.
- krageon 8y ago
  Any modern distro using a systemd resolver is one meant for the kind of people that don't care about taking back control, because they will be layman users. You are of course correct that this then does not apply to them, but I would argue this is kind of an obvious point.
  - deleted 8y ago
    [deleted]
  - usr1106 8y ago
zwischenzug 8y ago
I got so fed up with debugging DNS issues on Linux I ended up writing this series of posts: https://zwischenzugs.com/2018/06/08/anatomy-of-a-linux-dns-lookup-part-i/ https://zwischenzugs.com/2018/06/08/anatomy-of-a-linux-dns-l... https://zwischenzugs.com/2018/06/18/anatomy-of-a-linux-dns-lookup-part-ii/ https://zwischenzugs.com/2018/06/18/anatomy-of-a-linux-dns-l... https://zwischenzugs.com/2018/07/06/anatomy-of-a-linux-dns-lookup-part-iii/ https://zwischenzugs.com/2018/07/06/anatomy-of-a-linux-dns-l... https://zwischenzugs.com/2018/08/06/anatomy-of-a-linux-dns-lookup-part-iv/ https://zwischenzugs.com/2018/08/06/anatomy-of-a-linux-dns-l... and I haven't even covered caching.
rawoke083600 8y ago
It miss just having to "know" about /etc/resolv.conf for DNS. Now (years later) I feel I always have to google magic-recipes to get my DNS to work :(
throw2016 8y ago
How is designing for laptop networking for a system predominantly used as a server with marginal desktop market share justified. Why not roll out something discrete for the negligible percent of laptop users instead of imposing configuration overhead on all users? Debian prides itself on stability but voted for an 'init' that is rapidly changing with unlimited scope outside the purview of Debian. Thus we have a lot of extremely questionable networking functionality like 'predictable network names' and more just rolled out and 'imposed' on everyone without discussion, debate or technical scrutiny by a single group. Alpine Linux servers and VMs boot in seconds and are easy to configure and use. Void is equally fast for desktop users. The real problem seems to be a lot of developers are unfamiliar with the shell and its extensive use in everything from the system to the apps ecosystem. And we are left with a situation where the shell is demonized by people who are not familiar with it.

251 points by ausjke 8y ago

I always edited this file than used chattr +i /etc/resolv.conf to prevent further modifications.

After running into this a while ago when I was rebuilding my system and getting annoyed by all the different things that try to modify it, I ended up giving up and just setting the file to immutable. It has been working fine for the past couple of months as nothing seems to autodetect the flag and try to remove it. chattr +i /etc/resolv.conf

smhenderson 8y ago
I started doing this exact same thing in Debian, I think around Wheezy. Lately I’m back onSlackware and a little *BSD. Thankfully these systems still go the traditional route so it’s not much of an issue anymore.
lkirk 8y ago
I have used this in the past. There are only a few places where this bites you, for instance wifi authentication portals. Some of these wifi access points change your resolv.conf so that you can load their internal page for terms and conditions.
- likkwidd 8y ago
  I solved the captive portal issue by using captive browser https://github.com/FiloSottile/captive-browser https://github.com/FiloSottile/captive-browser
  - lkirk 8y ago
    Very cool, thanks. I will probably be using this in the future
low_key 8y ago
In addition, if you're using dhcp, you can add an enter hook to override make_resolv_conf so /etc doesn't get cluttered with a ton of extra files.
gjs278 8y ago
same thing I do because vpnc insists on overwriting it
narag 8y ago
Is there a tool that can log processes trying to modify a file?
- jlgaddis 8y ago
  auditd(8)
  - narag 8y ago
    Thank you!
williamscales 8y ago
I've been doing this for months as well. Works beautifully, I thought I was the only one.
DavideNL 8y ago
Same. I'm just a Linux "amateur", but what a huge mess to configure something so trivial/simple... (in Debian/Ubuntu compared to Mac/Windows.)
zcid 8y ago
This is usually the easiest way especially if you use a caching resolver like unbound and you expect resolv.conf to always point to localhost.

xfitm3 8y ago

I think NetworkManager only exists because wpa supplicant is difficult to use. I loathe networkmanager.

miffe 8y ago
Try iwd which replaces wpa supplicant. It makes wifi connections a breeze. https://git.kernel.org/pub/scm/network/wireless/iwd.git/ https://git.kernel.org/pub/scm/network/wireless/iwd.git/
microcolonel 8y ago
NetworkManager is convenient, especially for bringing up the kinds of bridged connections, virtual NATs, etc. that ordinary power users often want but don't believe they can achieve. And of course, you have every option not to use it, or to improve it, or to propose your own replacement.
- fernandotakai 8y ago
  at least for me, configuring vpns on network manager is a LOT simpler than doing by config files.
subway 8y ago
It exists because it's nice to have a unified place to define all your network connections and their behavior, instead of having them spread across wpa_supplicant, pppd, mbim-network, dhcpcd, openvpn, vpnc, freeswan, iptables, and ifupdown.
swiley 8y ago
Once you understand it wpa_supplicant is way more user friendly than other tools. Most of the other ones just say "stuff is broken too bad :(" when a connection fails. wpa_supplicant tells you everything that's wrong and not only that, usually gives you an easy way to fix it.

amaccuish 8y ago

On my domain controllers (where I absolutely cannot have anyone touching the conf), I just chattr +i /etc/resolv.conf. That prevents anything, even root, from changing the file, unless chattr -i is called first.

ktpsns 8y ago
Wow, I wasn't aware of the chattr command at all. Here is a list of available: https://en.wikipedia.org/wiki/Chattr https://en.wikipedia.org/wiki/Chattr Apparently, they are very file system specific. That's why they are not widely used. I guess a chmod 0444 would not do it, as system tools tend to "fix" wrong permissions automatically (but not permissive attributes).
- deleted 8y ago
  [deleted]
- j7k6 8y ago
  I use `chattr +i` with NFS mountpoints for backups, it prevents the local harddrive from filling up when a network share fails to mount on boot.
  - muxator 8y ago
    Totally. If something is meant to be a mount point, a chattr +i on the underlying directory is a godsend, because it gives you an immediate error in case the mount should fail for whatever reason.
- larkeith 8y ago
  You might be able to do it in a more system-agnostic manner with SELinux.
  - cyphar 8y ago
    That would be less system-agnostic because you have to be running with SELinux as the LSM. The immutable attribute is supported on almost all filesystems.

smilesnd 8y ago

I miss the days when I didn't have to worry about outside programs changing my configs without my knowledge.

microcolonel 8y ago
Well, you chose to install it, you can configure it not to do this. For the vast majority of people, myself included, NetworkManager should have control of DNS resolvers (at least, when I have WiFi on a system. I usually don't use NetworkManager on Ethernet-only systems, since there's systemd-networkd).
- gerdesj 8y ago
  Absolutely. My laptop travels across a lot of networks, wifi and ethernet, with and without OpenVPN and Mobile IPSEC. I tether to my phone. I have some IPv6 networks to worry about. Firewalld is expected to do the right thing as well. I have loads of NM profiles, one of which has several RFC1918 addresses for covering most bases when starting out with routers and switches.
ktpsns 8y ago
Isn't it great to have the choice wether some tool manages the system or one does it manually? Thanks GNU/Linux, thanks all the Linux distributions maintained by hundreds of volunteers!
- zamadatix 8y ago
  Choice is "do you want to <x> or <y>" not "if you don't want <x> figure out how to implement <y> on your own". That's simply known as "doing the work yourself" and is largely possible on even closed sourced systems assuming you have rights on the box. There is nothing wrong with that but it shouldn't be conflated as choice and paraded as success of such.
  - derefr 8y ago
    The GP is referring to all the other Linux distributions who really give you <y> (or <z> or <Þ>), not to implementing <y> on your own. There are distributions (e.g. Linux from Scratch) for when the option you want is the NULL option—i.e., doing things yourself. But there are N other managed options, not just one managed option and NULL.

johnklos 8y ago

Does this need to be updated, or is what's in here relevant for the latest round of Ubuntu changes?

d2wa 8y ago
It’s up to date.

kingo55 8y ago

Hands down the most annoying defaults on Linux. Being an OS for nerds, I'm surprised NetworkManager doesn't handle for manual updates to resolv.conf

peterwwillis 8y ago
If you manually change something, how is it supposed to handle it? Notify the user and ask them to accept the change? But NetworkManager changes the file based on each network. So it'd have to ask you every time you connected to any network. And what do you do until the user accepts the change? Default to nothing? That would break any headless box where resolv gets accidentally overwritten. The simple solution is, make your manual overrides through NetworkManager, or don't use it.
- subway 8y ago
  NM doesn't always change resolv.conf. This entirely depends on the dns backend. If it's set to use dnsmasq, systemd-resolved or unbound as a dns backend, it never touches the file, instead passing nameservers in to the stub resolver dynamically. https://wiki.gnome.org/Projects/NetworkManager/DNS https://wiki.gnome.org/Projects/NetworkManager/DNS
the_why_of_y 8y ago
NetworkManager generates resolv.conf from the information associated with an arbitrary number of network connections. Which, or how many, of these N network connections should manual updates be mapped to? Edit: now I notice a sibling comment already asked almost the same question, but it was greyed out.

jedisct1 8y ago

Removing `systemd-resolved` is often enough, but like many, `chattr +i /etc/resolv.conf` is also the next trick I do.

g45y45 8y ago

You really want to do this if you use Spectrum Cable. You are locked out of configuring the DNS settings via their cable modems (even if you supply your own). These force a DNS search suffix that leaks all DNS requests to their server, even if you are using another public DNS. I noticed network manager kept forcing the DNS search suffix, even after I manually disabled it. I did the config change to disable it messing with the resolv.conf

gnu8 8y ago
You should put your own router between their modem and your network, and not rely on DHCP from their modem for any of your network configuration.
- ahmedalsudani 8y ago
  You usually need to use DHCP to get your IP address, but any decent router will let you pick your preferred DNS server.
  - deleted 8y ago
    [deleted]
  - isostatic 8y ago
    Worst case scenario is your first hop downstream from the cable modem does port 53 interception and redirects. However if the only ISP you can get is so hostile, the solution is to tunnel (IPSEC/SSTP/whatever works) all your traffic to a non-hostile network.
    - erinnh 8y ago
      Use a firewall with nat to redirect all dns traffic to a DoT or DoH dns proxy in your network. That way you dont have to tunnel all your traffic. (Though technically you could also use the tunnel for only DNS, but its not much easier than the solution above if you want this to apply to all your devices)

Faaak 8y ago

I hate systemd-resolved because it uses glib's resolver. The problem is that this resolver doesn't understand root queries. That means that `dig +trace` doesn't work anymore, and you have to use an external server for the root zone. This is such a trivial use case not taken into account by systemd (they don't even want to fix it), that I'm saddened by it..

coldacid 8y ago
systemd is such complete garbage that I immediately write off any distros that run on it as unusable. For all the fail of SysV init, at least it sticks to its own job and little else.
- tzakrajs 8y ago
  SysV init was so full of fail (race conditions, no dependency management, slow as hell, stupid metaphors -- run levels? really?) that people wrote Systemd. Anyone can expand on systemd to have it do stupid shit it shouldn't. But you can do that with any technology that is composable. It does not mean that the core of systemd isn't anything short of incredibly useful.
  - xvaaa 8y ago
    And yet Linux distros like Ubuntu around 9.0 were much more stable than these days. With 16.04 I get core lockups (Intel microcode) and cannot switch out of X with Ctrl-Alt-F1. NetworkManager no longer connects the mobile surfstick, so I do it manually now with pppd. I can't claim that I had a specific problem with systemd, but I never had an issue with SysVinit either. The overall trend however is that Linux distros accumulate crapware by RedHat's NIH developers. I'm not surprised that NetworkManager is also by RedHat.
    - isostatic 8y ago
      I assumed the new network layer in ubuntu 18.04 (which replaced /etc/network/interfaces) was some pan-distro/redhat inspired solution. Apparently not -- netplan is ubuntu originated. They don't do themselves any favours.

StreamBright 8y ago

Alpine for the rescue. Seriously, there must be something super broken with Linux if this article exists.

coldacid 8y ago
It's not Linux that's broken, it's arrogant developers of system daemons that are broken.
swiley 8y ago
Alpine is definitely the most sane distro at the moment. I just can't recommend it to my friends because I find myself having to compile anything that isn't super common, and of course nothing that needs glibc works (which, is acceptable to me because I do prefer the smaller libc but some people might really dislike it.)
- AnIdiotOnTheNet 8y ago
  > I find myself having to compile anything that isn't super common Yes well, that's what happens when package managers, with their dependence on maintainers and whatnot, are your culturally lauded software distribution method.
theon144 8y ago
Not Linux, mostly systemd.
vectorEQ 8y ago
systemd :')

NelsonMinar 8y ago

Along these lines, netplan in Ubuntu is seriously confusing. That's the set of scripts that rewrites most of your network config in /etc with stuff generated from some new set of YAML config files. I'm willing to believe netplan is a Better Way to configure networking, but the kludge of having it rewrite long-understood config files in /etc is really awful.

isostatic 8y ago
I tried to get on baord with netplan, I really did. I thought it was a redhat inspired systemd-esque invasion. Turns out it's an 'upstart' type ubuntu crapfest that's unlikely to survive as long as 20.04. I wouldn't mind, but the very first machine I tried to configure with it was an ntop machine, I wanted 2 interfaces to come up with no IPs attached. Turns out it's not possible.
- jandrese 8y ago
  I ran into Netplan with an 18.04 server install and the whole time I was asking myself why this was better than the old system.

deathanatos 8y ago

I use a custom resolv.conf. Really, the biggest problem is airports: some want you to go through a captive gateway, but the captive gateway's domain is not publicly registered, so if you're using 8.8.8.8 or similar, it fails to resolve. Leads to an annoying trip to resolv.conf (well, resolvconf.conf in my case) to tell it to use the DHCP settings, run through the portal, and then flip back. (And like, is it really that hard to register your captive portal's name globally, and just let me use a global resolver to get to it? IDK if they're concerned about DNS tunneling, but this happens even on "free" WiFi (where free might mean "watch this ad", which honestly is fine w/ me.))

isostatic 8y ago
The people that run these network shave no idea what global resolving and DNS tunneling are. The people that build the systems that provide these networks likely don't know what DNS tunneling is.
JoshTriplett 8y ago
> Really, the biggest problem is airports: some want you to go through a captive gateway, but the captive gateway's domain is not publicly registered, so if you're using 8.8.8.8 or similar, it fails to resolve. Ideally, the software detecting captive portals on a network and presenting their login page should also use the network-provided DNS server solely to resolve the captive portal domain if it doesn't resolve with the preferred resolver. That would solve this case. (Also, ideally, captive portals would serve up a URL using DHCP options and not capture traffic.)
Tsiklon 8y ago
I saw another user here in this comments section reference a project which might be useful to you: https://news.ycombinator.com/item?id=19436783 https://news.ycombinator.com/item?id=19436783

tyingq 8y ago

Also see "systemd-resolved does not keep the order of the DNS servers" for another irritation with systemd-resolved: https://github.com/systemd/systemd/issues/5755 https://github.com/systemd/systemd/issues/5755 And..."systemd-resolved does not use DNS for local resolution" https://github.com/systemd/systemd/issues/6224 https://github.com/systemd/systemd/issues/6224

AJRF 8y ago

I just recently came across this in Ubuntu and was astounded that it's allowed to be this way. I think this kind of behavior will become more and more prevalent once one util is allowed to do it. It leads us on a path where daemon authors don't allow us to override the settings to suit us, rather to kept them controlled to suit them. The arrogance sets a very bad precedent.

sverige 8y ago
The arrogance has been there since the start of systemd. It's not just a comment on a particular personality, either, but rather on the general attitude as demonstrated by design decisions. I think it helps to think of it as making Linux more like Windows, with all of the plumbing hidden from the user and difficult to tweak by the administrator. "Why would you need to, anyway? We've already taken care of that for you."
- glennpratt 8y ago
  That's rich considering that I regularly use systemd override files with no issue instead of having to hack garbage init scripts filled with bugs.
- johnny22 8y ago
  hah. i've never had an easier time tweaking linux than with systemd. My first linux was I think Debian Potato (or whatever came on a cd in 1998).

m45t3r 8y ago

Just to some people know, systemd-resolved does not override /etc/resolv.conf by default. I know because neither Arch not NixOS does this, you need to explicitly override it using `ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf`. The culprit is actually NetworkManager. When it detects that systemd-resolved is running it sets the default resolver to systemd-resolved, and automatically makes the override for the user. I think it also does the same for the other supported resolvers (unbound, dnsmasq, etc.).

m45t3r 8y ago
To fix it, following just the first part of the article is sufficient (setting `dns=none` in NetworkManager configuration). There is no need to remove or disable systemd-resolved, set chattr +i or anything else (of course, if you're not using you can remove it without problems).
- jniedrauer 8y ago
  I thought this was common knowledge. I've been doing this since the upstart days...
fxfan 8y ago
I hear a lot of chatter about nix. What do you use it for and how is it working out for you?
- jordanbeiber 8y ago
  Personally I really like having the whole system configuration declared and checked in to vcs. The way packages are like functions in the nix code repo gives you at least fair confidence that things will actually work as intended. Or at the very least it gives you insight into why it doesn’t. More so compared to a traditional deb/rpm distro in my experience. Not saying it’s perfect by any means, just that it has worked brilliant for a few small projects of mine involving some pi’s. At the workplace though, resistance is high amongst my traditionalist RH/centos co-workers. :)

keybuk 8y ago

We had a great plan somewhere around Ubuntu intrepid or jaunty that rather than have apps rewrite /etc/resolve.conf, we'd leave it as a static file and have a "nameserver dynamic" type config in there. ie. sensible default for many people, but super easy to override

sly010 8y ago

This seems backwards. I don't feel strongly about networkd or NetworkManager either way, but I am curious on the meta-debate. I am personally a fan of the modernization of the linux userspace in the last 10 years (systemd, wayland, networkmanager), but I also understand that the puzzle pieces don't always fit together. However the argument against new things always seems to come down to "not what I am used to". Other than tradition what is wrong with explicitly configuring NetworkManager to configure /etc/resolv.conf "my way" instead of going behind it's back. Does it not have a "DNS Server: manual" option?

nisa 8y ago
I'm only a bystander in this fight but this is dishonest: > However the argument against new things always seems to come down to "not what I am used to". For me it's always: I can't debug this. I remember installing RHEL 7.0 just after release and nmtui crashing on me with some weird problem in glib when setting a hostname using it. I also remember trying to debug openvpn in network manager (https://i.imgur.com/zbaRcST.mp4 https://i.imgur.com/zbaRcST.mp4) and both of these are beaten paths... I'm able to somehow get around most shell scripts but when something crashes in C land on a customer box - what a PITA! It's not impossible but the amount of work I have to invest is just sooo huge. I remember yelling at reddit about some gnome stuff - and I've got a link to several powerpoint presentations... give me technical documentation not powerpoints and give me tools to troubleshoot that shit. No strace should be a last resort and not your goto tool: https://blog.uberspace.de/systemd-error-getting-authority-kohoutek/ https://blog.uberspace.de/systemd-error-getting-authority-ko... (link in german, but google translate should work)
- sly010 8y ago
  Good point. > this is dishonest Of course it is, I was trying to trigger a response :)
- spc476 8y ago
  Having used Unix since 1989 and basically, everything related to Unix admin changes every 10 years. I'm tired of it. And I relish the fact that in twenty years, this year's set of hipster devop admins calling me a neckbeard will be screaming "get off my lawn" at the constant arbitrary changes this industry seems love.

Proven 8y ago

The fact that these articles (he has another, on this topic) are useful says a lot about how hard to manage mainstream Linux has become. I don't know if that's because of systemd or because I don't like to waste my time on understanding the internals of something that should be simple and straightforward, but it is crap. As the article points out it's not that hard to change those settings, but how it may impact other services and apps is not easy to figure that out. Some time ago I made such changes and it seemingly worked but it broke Docker which I didn't realize until weeks later when I tried to use it.

deleted 8y ago

[deleted]

blattimwind 8y ago

Using the immutable flag, of course.

purplezooey 8y ago

I laughed at the title. I've been surprised every time I open resolv.conf lately it says "do not edit!".

deleted 8y ago

[deleted]

nydel 8y ago

it's only recently that the updates on ubuntu and other systemd'd linux distributions have been frequently writing resolv.conf. the suspicion that a user is so incapable of having already set DNS servers is so strong that whatever-is-doing-this doesn't even bother to ask if or check whether the resolv.conf file is different from default. this seems a little too critical of, possibly insulting to the intelligence of, people who use these versions of linux.

usr1106 8y ago

The article and the previous discussion here do not cover any modern distribution using glibc and systemd-resolved. /etc/resolv.conf has become legacy and is not even used by most programs anymore. "Taking back control" of something that is not used will not change much... Modern programs should use getaddrinfo(3). The glibc implementation of that call will first consult the "hosts:" line of /etc/nsswitch.conf. That file will contain a list to determine how host names are resolved: The first entry is typically "files". That means consult /etc/hosts file. Next there could be something to consult avahi/autoip, Ubuntu systems typically do that. There could also be entries "myhostname" and "mymachines". That's systemd's container support, not discussed here. If the system uses systemd-resolved there will be an entry "resolve". Than means consult systemd-resolved Typically the last one is "dns". That's the traditional implementation using /etc/resolv.conf. But if systemd-resolved is configured and working we never get here. Only if you don't have "resolve" before "dns" in your /etc/nsswitch.conf then /etc/resolv.conf is still relevant. It appears to me that musl does not use /etc/nsswitch.conf at all, so there /etc/resolv.conf is still relevant.

petre 8y ago
I always disable and deinstall systemd-resolved. It's unnecessarily convoluted and just always gets in the way. Adding an 127.0.0.53 alias? Why in the world is that even necessary? Dnsmasq is fine, is used by NetworkManager and can be easily set up to query a DNS cache of your choice. On servers, an unbound local resolver is a better alternative and it's used on FreeBSD.
krageon 8y ago
Any modern distro using a systemd resolver is one meant for the kind of people that don't care about taking back control, because they will be layman users. You are of course correct that this then does not apply to them, but I would argue this is kind of an obvious point.
- deleted 8y ago
  [deleted]
- usr1106 8y ago

zwischenzug 8y ago

I got so fed up with debugging DNS issues on Linux I ended up writing this series of posts: https://zwischenzugs.com/2018/06/08/anatomy-of-a-linux-dns-lookup-part-i/ https://zwischenzugs.com/2018/06/08/anatomy-of-a-linux-dns-l... https://zwischenzugs.com/2018/06/18/anatomy-of-a-linux-dns-lookup-part-ii/ https://zwischenzugs.com/2018/06/18/anatomy-of-a-linux-dns-l... https://zwischenzugs.com/2018/07/06/anatomy-of-a-linux-dns-lookup-part-iii/ https://zwischenzugs.com/2018/07/06/anatomy-of-a-linux-dns-l... https://zwischenzugs.com/2018/08/06/anatomy-of-a-linux-dns-lookup-part-iv/ https://zwischenzugs.com/2018/08/06/anatomy-of-a-linux-dns-l... and I haven't even covered caching.

rawoke083600 8y ago

It miss just having to "know" about /etc/resolv.conf for DNS. Now (years later) I feel I always have to google magic-recipes to get my DNS to work :(

throw2016 8y ago

How is designing for laptop networking for a system predominantly used as a server with marginal desktop market share justified. Why not roll out something discrete for the negligible percent of laptop users instead of imposing configuration overhead on all users? Debian prides itself on stability but voted for an 'init' that is rapidly changing with unlimited scope outside the purview of Debian. Thus we have a lot of extremely questionable networking functionality like 'predictable network names' and more just rolled out and 'imposed' on everyone without discussion, debate or technical scrutiny by a single group. Alpine Linux servers and VMs boot in seconds and are easy to configure and use. Void is equally fast for desktop users. The real problem seems to be a lot of developers are unfamiliar with the shell and its extensive use in everything from the system to the apps ecosystem. And we are left with a situation where the shell is demonized by people who are not familiar with it.