{"id":163,"date":"2024-01-24T14:27:23","date_gmt":"2024-01-24T21:27:23","guid":{"rendered":"https:\/\/dnstrouble.crider.dev\/?docs=common-problems-ssh-login-hangs-delays\/the-name-service-switch-nsswitch"},"modified":"2024-01-24T14:32:24","modified_gmt":"2024-01-24T21:32:24","slug":"the-name-service-switch-nsswitch","status":"publish","type":"docs","link":"https:\/\/dnstrouble.crider.dev\/?docs=common-problems-ssh-login-hangs-delays\/the-name-service-switch-nsswitch","title":{"rendered":"The Name Service Switch (nsswitch)"},"content":{"rendered":"\n

nsswitch is what determines the order in which further components are queried for the domain. This is controlled in \/etc\/nsswitch.conf <\/strong>in the ‘hosts<\/strong>‘ entry:<\/p>\n\n\n\n

$ cat \/etc\/nsswitch.conf | grep hosts
# Valid databases are: aliases, ethers, group, gshadow, hosts,
hosts: files dns myhostname<\/code><\/pre>\n\n\n\n
In this example we see 3 entries — files, dns, myhostname.

This means it will check files first. What files? This is answered in the nsswitch.conf man pages:<\/p>\n\n\n\n
# man nsswitch.conf\n----\n       The following files are read when \"files\" source is specified for respective databases:\n\n           aliases     \/etc\/aliases\n           ethers      \/etc\/ethers\n           group       \/etc\/group\n           hosts       \/etc\/hosts\n           initgroups  \/etc\/group\n           netgroup    \/etc\/netgroup\n           networks    \/etc\/networks\n           passwd      \/etc\/passwd\n           protocols   \/etc\/protocols\n           publickey   \/etc\/publickey\n           rpc         \/etc\/rpc\n           services    \/etc\/services\n           shadow      \/etc\/shadow\n---<\/code><\/pre>\n\n\n\n
As noted, the specific file that is read for the ‘hosts’ nsswitch entry is \/etc\/hosts<\/strong>. So it will first try \/etc\/hosts to see if there is a defined DNS entry for www.redhat.com<\/p>\n\n\n\n
For example, if we had this defined in \/etc\/hosts:<\/p>\n\n\n\n
1.2.3.4 www.redhat.com<\/code><\/pre>\n\n\n\n
Our flow would be:<\/p>\n\n\n\n
command\/application -> glibc -> nsswitch -> \/etc\/hosts<\/p>\n\n\n\n
And \/etc\/hosts would send the 1.2.3.4 value back to us as an answer.<\/p>\n\n\n\n
If it does not find an entry in \/etc\/hosts, it then moves on to the next entry — ‘dns’.<\/p>\n\n\n\n
When ‘dns’ is defined in nsswitch ‘hosts:’, it uses ‘resolver’ functions from the glibc library to search what is defined in \/etc\/resolve.conf, and sends the queries to the nameservers defined.<\/strong><\/p>\n\n\n\n
So if for example \/etc\/resolv.conf has this nameserver defined:<\/p>\n\n\n\n
nameserver 8.8.8.8<\/code><\/pre>\n\n\n\n
The full ‘flow’ of the outgoing www.redhat.com query is as follows:<\/p>\n\n\n\n
command\/application -> glibc -> nsswitch -> \/etc\/hosts ->  \/etc\/resolv.conf -> 8.8.8.8<\/p>\n\n\n\n
And the DNS server at 8.8.8.8 would then be expected to send us the domain records for www.redhat.com.<\/p>\n\n\n\n
The DNS server at 8.8.8.8 could be any kind of DNS server — it could be systemd-resolved, dnsmasq, unbound, BIND DNS server, or some other local hosted server. Regardless, the nameserver is where the outgoing path ends.<\/p>\n\n\n\n
<\/p>\n","protected":false},"featured_media":0,"parent":37,"menu_order":1,"comment_status":"open","ping_status":"closed","template":"","doc_tag":[],"_links":{"self":[{"href":"https:\/\/dnstrouble.crider.dev\/index.php?rest_route=\/wp\/v2\/docs\/163"}],"collection":[{"href":"https:\/\/dnstrouble.crider.dev\/index.php?rest_route=\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/dnstrouble.crider.dev\/index.php?rest_route=\/wp\/v2\/types\/docs"}],"replies":[{"embeddable":true,"href":"https:\/\/dnstrouble.crider.dev\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=163"}],"version-history":[{"count":1,"href":"https:\/\/dnstrouble.crider.dev\/index.php?rest_route=\/wp\/v2\/docs\/163\/revisions"}],"predecessor-version":[{"id":165,"href":"https:\/\/dnstrouble.crider.dev\/index.php?rest_route=\/wp\/v2\/docs\/163\/revisions\/165"}],"up":[{"embeddable":true,"href":"https:\/\/dnstrouble.crider.dev\/index.php?rest_route=\/wp\/v2\/docs\/37"}],"next":[{"title":"\/etc\/resolv.conf","link":"https:\/\/dnstrouble.crider.dev\/?docs=common-problems-ssh-login-hangs-delays\/etc-resolv-conf","href":"https:\/\/dnstrouble.crider.dev\/index.php?rest_route=\/wp\/v2\/docs\/166"}],"prev":[{"title":"The first step: glibc","link":"https:\/\/dnstrouble.crider.dev\/?docs=common-problems-ssh-login-hangs-delays\/outgoing-flow","href":"https:\/\/dnstrouble.crider.dev\/index.php?rest_route=\/wp\/v2\/docs\/157"}],"wp:attachment":[{"href":"https:\/\/dnstrouble.crider.dev\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=163"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/dnstrouble.crider.dev\/index.php?rest_route=%2Fwp%2Fv2%2Fdoc_tag&post=163"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}