Hi Jakub,<br>first of all thanks for the complete response. You told me a lot of things I didn't know.<br>Please, see my answer below.<br><br><div class="gmail_quote">On Sun, Dec 18, 2011 at 10:36 PM, Jakub Hrozek <span dir="ltr"><<a href="mailto:jhrozek@redhat.com" target="_blank">jhrozek@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>On Sun, Dec 18, 2011 at 07:09:30PM +0100, Marco Pizzoli wrote:<br>
> Hi,<br>
> I started to look at the documentation of FreeIPA and SSSD.<br>
> Now I'm curious to know about the relationship between sssd and the dns<br>
> servers.<br>
><br>
<br>
</div>To be honest, I'm not sure I completely understand what are you trying<br>
to accomplish. I'll try to answer your questions, but feel free to<br>
clarify or steer me in the right direction.<br>
<br>
One thing to keep in mind is that SSSD does not perform name resolution<br>
through glibc, mostly because glibc's interface is synchronous. SSSD uses<br>
the "c-ares" library. c-ares does read /etc/hosts and /etc/resolv.conf so<br>
there is no separate config and the name resolution gives the same results<br>
as it would if performed via glibc, but the name resolution process itself<br>
is completely standalone.<br>
<div><br>
> As I can see, obviously, the deployment of all windows-style services are<br>
> led by a query/response by sssd to dns servers, possibly directly to the<br>
> FreeIPA dns server.<br>
<br>
</div>There are two ways SSSD queries DNS when acting as a FreeIPA client,<br>
depending on your configuration:<br>
1) name resolution to get the IP address corresponding to a hostname in<br>
the "ipa_server" parameter<br>
2) if the IPA server is not set, query DNS using the SRV records to get<br>
the list of servers and then perform 1)<br>
<div><br>
> When deploying sssd I have to configure the resolv.conf file. Is hereafter<br>
> sssd the only service which is *required* to use that file?<br>
><br>
<br>
</div>I don't understand this part, sorry. /etc/resolv.conf is read prominently<br>
by the glibc resolver and affects library calls such as gethostbyname<br>
etc.<br>
<br>
In a centralized environment, the resolv.conf would typically be set by<br>
DHCP.<br>
<div><br>
> I'm thinking to the unix/linux farm of my office in which, by taking a<br>
> weighted choice, they decided to not use the dns servers, relying only on<br>
> /etc/hosts files.<br>
<br>
</div>The order of the hosts databases (aka when to use resolv.conf and when<br>
to use /etc/hosts) is set in the /etc/nsswitch.conf config file with the<br>
hosts directive. The typical order is "files dns" which translates to<br>
"ask /etc/hosts first and if there's no answer, go ask the servers in<br>
/etc/resolv.conf"<br>
<br>
c-ares reads that order so it should work in sync with the rest of the<br>
system. c-ares allows overriding the list of servers it talks to, but<br>
currently SSSD does not expose or leverage this interface.<br>
<div><br>
><br>
> If you confirm this, do you think it would be a good idea the filing of a<br>
> feature request asking to have an option for sssd to choose the<br>
> resolv.conf file to point to?<br>
> So I could use a file called, for example, "/etc/resolv.conf.FreeIPA". So<br>
> I can be sure that no other services will use that dns's.<br>
<br>
</div>If we want to support this feature, I would much prefer adding a new config<br>
option directly to sssd.conf than a new resolv.conf style file.<br>
<br>
That said, can you explain why would you like to see this feature?</blockquote><div> </div><div>My wish is to use sssd on a Linux system joined to a FreeIPA domain, but
being able to do this still *not* enabling the dns resolution for the
rest of that Linux system -> not populating the /etc/resolv.conf
file. <br><br>If I correctly understand, you are telling me that I could
achieve this result by withdrawing the "dns" keyword from the
/etc/nsswitch.conf file. <br>Is this right?<br> <br></div><blockquote class="gmail_quote" style="margin:0pt 0pt 0pt 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> If it's just for overriding DNS config per-client, then I would suggest to<br>
do this using either some DHCP client override (such as dhcp-class) or<br>
distribute /etc/hosts to clients.<br></blockquote><div><br>I understand these suggestions but we don't use dhcp and centralizing the /etc/hosts distribution has not been considered so far.<br><br>Thanks again, I very appreciated<br>
Marco<br></div></div><br clear="all"><br>-- <br>_________________________________________<br>Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi.<br> Jim Morrison<br>