DNS resolution problem with Fedora 20

Question

I have a newly built Fedora 20 server that I've just hooked to my network. It's a virtual server running on a VirtualBox host. Everything seems to be working but I have a problem with name resolution.

(I should say at this point that name resolution is provided by a Windows server on separate hardware that works well for every other machine on the network.)

From the command line I can resolve an external host like unix.stackexchange.com. I can quite happily resolve that and ping it, as with every other external host I've tried.

However, my local network (let's call it xyz.local) is different. The network interface on my F20 machine has DOMAIN=xyx.local in the network script (full script below). From the command line I can resolve, say, server-01, but not server-01.xyz.local.

I can resolve an alias in the short form, even though the canonical name is the long form, so, for example, ping mysql successfully resolves to its alias linux-04.xyz.local, but I can resolve neither mysql.xyz.local nor linux-04.xyz.local.

Clearly I've missed something. Can anyone suggest what?

/etc/hosts has only the standard localhost entries for 127.0.0.1

/etc/resolv.conf is as follows:

#Generated by Network Manager
search xyz.local
nameserver 192.168.xxx.xxx

My interface script is

TYPE=Ethernet
BOOTPROTO=none
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
NAME="Wired connection 1"
UUID=<uuid>
ONBOOT=yes
IPADDR0=192.168.xxx.xxx
PREFIX0=24
GATEWAY0=192.168.xxx.xxx
DNS1=192.168.xxx.xxx
HWADDR=<mac>
DOMAIN=xyz.local
IPV6_PEERDNS=yes
IPV6_PEERROUTES=yes

Solution 1

The problem is caused due to the keyword "mdns4_minimal" in nsswitch.conf file. This keyword tells resolver that everything that ends with local should be queried using mdns. It should be enough to remove that keyword (and additional options usually given in square brackets).

More details you can find in my post

The reason why nslookup resolves everything is because it doesn't look into nsswitch.conf but uses /etc/resolv.conf directly. ping, on the other hand, depends on resolver that first looks into nsswitch.conf and resolves name using whatever is written in there.

Solution 2

Part of your issue is likely due to your search path being auto-generated via NetworkManager:

search xyz.local

This line should really be this:

search xyz.local.

The period at the end is critical since that tells the DNS resolver to stop. So it won't do things like this to you:

mysql.xyz.local.xyz.local

You can confirm this by trying to resolve hostnames by manually adding a period yourself, temporarily.

$ nslookup mysql.xyz.local.

Resolving this domain wide

To resolve this you'll need to change the definition of your domain on your DHCP server so that it's serving out the domain as xyz.local..

/etc/nsswitch.conf

The method used to resolve a hostname is controlled by the file /etc/nsswitch.conf. The notation NSS, stands for Name Service Switch, and you can read more about it via the man page, man nss.

Here's the line from my file that controls how hostnames get resolved:

$ grep ^hosts /etc/nsswitch.conf
hosts:      files dns mdns4_minimal

It looks to my local file, /etc/hosts, first, then queries DNS 2nd.

Comments

[Admin]

@polym Thanks for the edit. This is a development machine on an doubly firewalled internal network. Is public knowledge of the credential information likely to be a risk, or is this just a matter of good form?

[Admin]

It is a risk that if someone comes in contact with packets containing these credential information, they can pinpoint it to you.

[Admin]

This is a server box so the address info is static. NSLOOKUP successfully resolved all three forms of the address (mysql, mysql.xyx.local, and mysql.xyz.local.), but ping only resolved the first (short) form. I have changed the search term in the Network Connections utility and restarted the interface and there's no change: nslookup resolves everything, ping doesn't.

[slm]

@Warwick - done

[Warwick]

@slm - Sorry, I wasn't clear enough. I didn't want to see YOUR /etc/nsswitch.conf. I wanted to see Mike W's /etc/nsswitch.conf. :-) Mike W, can you please post your /etc/nsswitch.conf? Thanks.