[SSSD] Question about sssd and dns
Jan Zelený
jzeleny at redhat.com
Mon Dec 19 10:46:10 UTC 2011
> > > My wish is to use sssd on a Linux system joined to a FreeIPA domain,
> >
> > but
> >
> > > being able to do this still *not* enabling the dns resolution for
> > > the
> >
> > rest
> >
> > > of that Linux system -> not populating the /etc/resolv.conf file.
> >
> > So you would like to use DNS resolution only for sssd and let the rest
> > of the system rely only on data in /etc/hosts? That seems like a recipe
> > for trouble, keep in mind that libraries that SSSD uses might still want
> > to perform name resolution themselves. For instance, Kerberos might need
> > to canonicalize hostname in some cases.
> >
> > What is the problem you are trying to solve with this separation?
>
> You caught the point.
> In the past we used to have all Linux production systems use the dns
> server. In our business dns servers are managed by a different office.
> During normal operations we faced occasional problems that prevented us to
> guarantee our service level agreement:
> - the dns server having a bad configuration following a configuration
> upgrade: his forwarding policies went messes and we had a lot of delay in
> serving requests
> - the dns server solves every system in the network: when network isolation
> is not achievable, we limited the "visibility" of system by not enable them
> to be found in searching by names. This helped a lot also when some
> colleagues make a mistake by forgetting to change the configuration of web
> applications from test to production (db connection strings, and so on...).
>
> We decided to not use the dns server and put in the /etc/hosts file only
> the hosts we were aware that particular system had need to communicate to.
As I wrote before - why don't you use the same approach in SSSD? There is only
a limited number of servers it communicates with. And other DNS queries can be
(mostly) disabled by configuration.
>
> > > If I correctly understand, you are telling me that I could achieve
> >
> > this
> >
> > > result by withdrawing the "dns" keyword from the /etc/nsswitch.conf
> >
> > file.
> >
> > > Is this right?
> >
> > Not quite. Even though c-ares is a standalone resolver, it still reads
> > /etc/nsswitch.conf and resolves in same order as specified there.
>
> Ok, I understand.
>
> Thanks again
> Marco
Jan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111219/c1e1c02b/attachment.sig>
More information about the sssd-devel
mailing list