Lesson 5.29: How a name is resolved
When a program asks for pkg.northwind.example, Linux doesn't go straight to DNS. The C library follows /etc/nsswitch.conf, which on Ubuntu says: look in /etc/hosts first, then ask DNS. That order makes /etc/hosts a powerful override, useful for testing and dangerous when someone abuses it, because a single line can silently send a server's traffic elsewhere. Tools disagree too: dig asks DNS directly, getent follows the same path as programs. In the lab web02 downloads packages from the wrong address; you find out why with getent, dig and nsswitch.conf, and remove the planted entry.
14 min
You will learn to
- Explain the resolution order in nsswitch.conf
- Compare getent with dig
- Spot an /etc/hosts override
- Remove a malicious entry safely
- Explain why signed repositories limit the damage
Key terms
- Resolver
- The part of the C library that turns names into addresses for programs.
- /etc/nsswitch.conf
- Lists which sources are asked, in order, for names, users and more.
- /etc/hosts
- A local table of addresses and names, checked first on most systems.
- getent
- Looks names up through nsswitch, exactly like programs do.
- dig
- Queries a DNS server directly, ignoring /etc/hosts.
← Searching the filesystem: find and locate · All lessons · Service secrets with systemd credentials →