resolv.conf.tail

[betweendayandnight]

I read the man page regarding resolv.conf and resolv.conf.tail on http://www.openbsd.org/cgi-bin/man.c...onf.tail&sec=5

However the resolv.conf.tail file may be useful on notebooks, to search multiple domains, to refer to hard-coded information in local files, or otherwise override the defaults.

Could someone provide some real world scenarios?

How is resolv.conf.tail useful on notebooks?

What does it mean by "search multiple domains", "hard-coded information in local files"?

[jggimi]

The resolv.conf.tail file is useful when you use DHCP with a server you do not control. Whatever is negotiated via dhclient(8) for resolution, if you have a .tail file, it will be appended to the resulting negotiated resolv.conf.

Real world uses?

You might want to add search and a list of domains for convenience. Example: I may want to resolve "jggimi" without typing out "jggimi.homeip.net," so I could add search homeip.net to a .tail file.

You might want to add a preferred nameserver, or, you might have set dhclient.conf(5) to ignore domain servers recommended by the DHCP server, rather than overriding them, and therefore will need to add your own.

You may want to add a lookup file bind line so that /etc/hosts is inspected before any nameservers are queried.

[betweendayandnight]

Originally Posted by jggimi

The resolv.conf.tail file is useful when you use DHCP with a server you do not control. Whatever is negotiated via dhclient(8) for resolution, if you have a .tail file, it will be appended to the resulting negotiated resolv.conf.

According to your explanation, DNS resolution occurs via dhclient, not resolv.conf or resolv.conf.tail? Values in either resolv.conf or resolv.conf.tail are passed to dhclient for DNS resolution?

Originally Posted by jggimi

You might want to add a preferred nameserver

Here's the part where I don't quite understand: can I simply edit resolv.conf to add my preferred nameservers? What benefits will I derive by adding DNS nameservers via resolv.conf.tail over resolv.conf?

Another question: Can I remove 192.168.1.1 which is in my resolv.conf file and replace it with, say, 8.8.8.8?

Originally Posted by jggimi

or, you might have set dhclient.conf(5) to ignore domain servers recommended by the DHCP server, rather than overriding them, and therefore will need to add your own.

I'm glad you brought up the topic of dhclient.conf.

In Section 6.4.1 "DHCP Client" (http://www.openbsd.org/faq/faq6.html), it reads as follows:

No matter how you start the DHCP client, you can edit the /etc/dhclient.conf file to not update your DNS according to the dhcp server's idea of DNS by first uncommenting the 'request' lines in it (they are examples of the default settings, but you need to uncomment them to override dhclient's defaults.)

request subnet-mask, broadcast-address, time-offset, routers, domain-name, domain-name-servers, host-name, lpr-servers, ntp-servers;

and then remove domain-name-servers. Of course, you may want to remove host-name, or other settings too.

Could you explain to me in plain English and illustrate with an example or two what is meant by the phrase "you can edit the /etc/dhclient.conf file to NOT update your DNS according to the dhcp server's idea of DNS by....."?


What exactly is DHCP server's idea of DNS?

[jggimi]

DHCP is a negotiation protocol, for obtaining IP addresses, netmasks, routing table entries, and additional information, such as domain name servers to use for resolution.

In OpenBSD, the results of DNS resolution negotiations by dhclient(8) will result in a new, replacement /etc/resolv.conf file every time dhclient negotiates. This happens at least each time you boot and init(8) starts the rc(8) script which executes the network(8) script which reads your hostname.if(5) file and starts dhclient(8).

The /etc/resolv.conf.tail file's contents will be appended to the end of the /etc/resolv.conf file that gets re-negotiated, repeatedly.

Here's a real world example of a dhclient.conf(5) configuration from one of my firewalls. It uses this with an upstream ISP, who have a DHCPd server of some kind that I do not control.

I tell my upstream that the host name is "jggimi" as I have a sister firewall on the same network which may assume the MAC address and lease at any point. Both use the same name.

I use it with supersede options which ignore nameservers entirely, and result in a search record in the resolv.conf that I want, so I do not need to have a .tail file.

Here's the dhclient.conf:

initial-interval 1;
send host-name "jggimi";
supersede host-name "jggimi";
supersede domain-name "jggimi.homeip.net";
supersede domain-name-servers 127.0.0.1, 10.0.1.1;
request subnet-mask, broadcast-address, routers;

The resulting resolv.conf is:

#Generated by vlan3 dhclient
search jggimi.homeip.net
nameserver 127.0.0.1
nameserver 10.0.1.1

[betweendayandnight]

Thanks jggimi for the detailed explanation and example.

I'd appreciate it if you could answer two questions named below:

1. What benefits will I derive by adding DNS nameservers via resolv.conf.tail over resolv.conf?

2. Can I delete 192.168.1.1 from /etc/resolv.conf while my machine is stil connected to a VPN server and replace it with say 8.8.8.8? Will doing so break the VPN connection or worse internet connection? My intention is to have the VPN use my preferred DNS nameservers instead of the ISP's nameserver.

[jggimi]

DHCP stands for Dynamic Host Configuration Protocol. The results of the negotiation are intended to be temporary, and changeable.

In DHCP, the assignment of a network address is called a "lease". And leases, just like when you lease a building, are for a specific period, they have a specific start and end.

In DHCP, the lease period is non-negotiable, and is set by the server. And lease renewals are renegotiated by the dhclient(8) when the lease reaches the 50% lifespan.

I used to have an ISP that used a 300-second lease. Five minutes. And dhclient(8) would renew the lease at the 50% point. 150 seconds.

That's a renegotiation occurring every two minutes and thirty seconds. A renegotiation 576 times per day.

---

Yes, you can edit the resolv.conf file manually, and change how the system resolves domain names to IP addresses, or IP addresses to domain names. But if you are using dhclient(8), this is not best practice.

Best practice is to use either dhclient.conf(5) or resolv.conf.tail(5).