CentOS7 dns自动覆盖

Posted 2020-11-14 leesirc

1. 现象

CentOS7 阿里云ECS系统重启后，/etc/resolv.conf 会被dhclient 或者NetworkManager还原为默认配置/清空

　　

2. 解决方案

2.1 机制

　　1. PEERDNS=yes|no 允许|禁止/etc/resolv.conf 重启/更新网络 被覆盖

　　2. 当开启NetworkManager.service 时, PEERDNS是不生效的，通过设置dns=none解决

　　3. 阿里云ECS内部服务不要开启NetworkManager, 可能导致网络不可用

2.2 方案

https://www.cyberciti.biz/faq/dhclient-etcresolvconf-hooks/

3. 最佳实践

系统初始化时：
1. /etc/resolv.conf template一份
2. 通过ansible的lineinfile 只增加一行PEERDNS=no

- block:
  - name: Modify /etc/resolv.conf
    template:
      src: resolv.conf.j2
      dest: /etc/resolv.conf
      mode: 0644
      owner: root
      group: root


  - name: Install common operate utils
    yum:
      name: "{{ item }}"
      update_cache: yes
    with_items: ["htop", "iftop", "nload", "iptraf", "dstat", "iotop", "screen", "hping3"]

  - name: Modify ifcfg-etho to forbid Autoupdate DNS
    lineinfile:
      dest: /etc/sysconfig/network-scripts/ifcfg-eth0
      state: present
      line: ‘PEERDNS=no‘
      mode: 0644
      owner: root
      group: root
  when: ansible_distribution == "CentOS"
  tags: update_dns