| NSS-RESOLVE(8) | nss-resolve | NSS-RESOLVE(8) |
.SH "NAME" nss-resolve, libnss_resolve.so.2 - Hostname resolution
via systemd-resolved.service
.SH "SYNOPSIS"
.PP libnss_resolve.so.2
.SH "DESCRIPTION"
.PP nss-resolve is a plug-in module for the GNU Name Service Switch
(NSS) functionality of the GNU C Library (glibc) enabling it to
resolve hostnames via the systemd-resolved(8) local network name
resolution service. It replaces the nss-dns plug-in module that
traditionally resolves hostnames via DNS.
.PP To activate the NSS module, add resolve [!UNAVAIL=return] to the
line starting with hosts: in /etc/nsswitch.conf. Specifically, it is
recommended to place resolve early in /etc/nsswitch.conf's hosts: line. It
should be before the files entry, since systemd-resolved supports /etc/hosts
internally, but with caching. To the contrary, it should be after
mymachines, to give hostnames given to local VMs and containers precedence
over names received over DNS. Finally, we recommend placing dns somewhere
after resolve, to fall back to nss-dns if systemd-resolved.service is
not available.
.PP Note that systemd-resolved will synthesize DNS resource records in
a few cases, for example for localhost and the current local hostname, see
systemd-resolved(8) for the full list. This duplicates the
functionality of nss-myhostname(8), but it is still recommended (see
examples below) to keep nss-myhostname configured in
/etc/nsswitch.conf, to keep those names resolvable if
systemd-resolved is not running.
.PP Please keep in mind that nss-myhostname (and nss-resolve)
also resolve in the other direction — from locally attached IP
addresses to hostnames. If you rely on that lookup being provided by DNS,
you might want to order things differently.
.PP Communication between nss-resolve and systemd-resolved.service
takes place via the /run/systemd/resolve/io.systemd.Resolve AF_UNIX
socket.
.SH "ENVIRONMENT VARIABLES"
.PP $SYSTEMD_NSS_RESOLVE_VALIDATE
Takes a boolean argument. When false, cryptographic validation of resource
records via DNSSEC will be disabled. This may be useful for testing, or when
system time is known to be unreliable.
Added in version 250.
.RE
.PP $SYSTEMD_NSS_RESOLVE_SYNTHESIZE
Takes a boolean argument. When false, synthetic records, e.g. for the local
host name, will not be returned. See section SYNTHETIC RECORDS in
systemd-resolved.service(8) for more information. This may be useful
to query the "public" resource records, independent of the
configuration of the local machine.
Added in version 250.
.RE
.PP $SYSTEMD_NSS_RESOLVE_CACHE
Takes a boolean argument. When false, the cache of previously queried records
will not be used by systemd-resolved(8).
Added in version 250.
.RE
.PP $SYSTEMD_NSS_RESOLVE_ZONE
Takes a boolean argument. When false, answers using locally registered public
LLMNR/mDNS resource records will not be returned.
Added in version 250.
.RE
.PP $SYSTEMD_NSS_RESOLVE_TRUST_ANCHOR
Takes a boolean argument. When false, answers using locally configured trust
anchors will not be used.
Added in version 250.
.RE
.PP $SYSTEMD_NSS_RESOLVE_NETWORK
Takes a boolean argument. When false, answers will be returned without using
the network, i.e. either from local sources or the cache in
systemd-resolved(8).
Added in version 250.
.RE
.PP $SYSTEMD_NSS_RESOLVE_INTERFACE
Takes an interface name or index as an argument. When specified, answers will
only be obtained from name servers belonging to the specified interface.
Added in version 260.
.RE
.SH "EXAMPLE"
.PP Here is an example /etc/nsswitch.conf file that enables
nss-resolve correctly:
passwd: files systemd group: files [SUCCESS=merge] systemd shadow: files systemd gshadow: files systemd hosts: mymachines resolve [!UNAVAIL=return] files myhostname dns networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis
.SH "SEE ALSO"
.PP systemd(1), systemd-resolved(8), nss-systemd(8),
nss-myhostname(8), nss-mymachines(8), nsswitch.conf(5),
systemd.syntax(7)
| systemd 262.2 |