Haɗin CIFS ɗinka yana gazawa ta VPN saboda tsarin nsswitch

Ramin yana aiki. Sabar fayil tana amsa ping da adireshi. Sannan mount.cifs da sunan mai masauki yana zama a wajen na ɗan lokaci sannan ya ba da labarin cewa ba a isa ga mai masaukin ba, kuma za ka fara sake gina bayanan VPN wanda bai taɓa zama matsalar ba. A Linux glibc tana warware sunan kafin kowane fakitin SMB ya kasance, kuma tsari a cikin wannan mai warware zai iya kawo ƙarshen binciken kafin a taɓa tambayar DNS. Ga hanyar da nake bi, ina farawa daga umarnin da ya gaza ba daga abokin ciniki ba.

Karanta gazawar a wurin da ya dace

Kayan aiki biyu suna bin hanyoyi daban-daban zuwa suna ɗaya, kuma kwatanta su yana ɗaukar umarni ɗaya. getent yana bi ta cikin tarin sabis ɗin suna da aka saita; host da dig suna tambayar DNS kai tsaye kuma suna watsi da wannan tarin. Idan tambayar kai tsaye ta dawo da adireshi amma getent bai dawo da komai ba, sabar DNS tana isa kuma saitin mai warware naka ne ke gazawa.

getent hosts fileserver.corp.example
host fileserver.corp.example 10.61.0.1
getent -s dns hosts fileserver.corp.example

Umarni na uku shi ne mai yanke hukunci: yana tilasta tushen DNS kuma yana tsallake sauran tarin. Lokacin da wannan ya yi aiki amma getent na yau da kullum bai yi ba, ka tabbatar da cewa tsari ne laifi, ba rami ba kuma ba sabar ba.

Layin hosts jerin ne da ke tsayawa da wuri

Mai warware na glibc yana karanta /etc/nsswitch.conf kuma yana bin shigarwar hosts: daga hagu zuwa dama. Yawancin rarrabawa suna aika layin da binciken multicast ke zuwa farko tare da aikin dawowa da wuri a haɗe. Aikin ba ado ba ne: lokacin da mDNS ya amsa “not found”, [NOTFOUND=return] yana kawo ƙarshen dukan binciken, don haka ba a taɓa aika sunan kamfanin zuwa ga mai warware da VPN ta tura ba. Babu abin da ke yin rikodin hakan, domin ba a aika wata tambaya da mai warware zai iya ƙin ba. Shi ya sa haɗin yake kama da rataye sannan ya ba da labarin mai masaukin da ba a isa ba.

cat /etc/nsswitch.conf | grep '^hosts:'
# illustrative repair: dns before the early-return action
hosts: files myhostname mdns4_minimal dns [NOTFOUND=return] wins mdns4

Matsar da DNS gaban aikin dawowa da wuri maimakon share mDNS, kuma canza shi ta hanyar sarrafa saiti. Gyaran hannu yana rayuwa har zuwa ginin hoto na gaba, sannan tikitin ɗaya ya zo daga wata na'ura da ba ta tuna gyaran ba.

Mai warware ba yankin bincike ba ne

Warwarewa kuma yana buƙatar a gwada sunan. Sunan da ba shi da cancanta kamar fileserver yana zama fileserver.corp.example ne kawai lokacin da aka haɗa yankin bincike da mu'amalar da ke ɗauke da tambayar. VPN da ke tura sabar DNS ba tare da jerin bincike ba yana haifar da rarrabuwa ta musamman: ana warware sunan cikakke kuma kowane gajeren suna yana gazawa.

Gwada duka siffofin biyu kafin gyara bayanan, domin gazawar biyu suna nuni zuwa wurare daban-daban. A kan mai masaukin systemd-resolved haɗin ramin yana da sabar da yankunan tuƙi nasa, don haka karanta haɗin ba fayil ɗin duniya ba.

resolvectl status
resolvectl query fileserver.corp.example
resolvectl dns
resolvectl domain

Idan an danganta tambayar da haɗin da ba ya ɗauke da ramin, yankin tuƙi ya ɓace ko da adireshin DNS yana nan. Wannan matsala ce ta manufa a cikin saitin resolved, ba matsalar tuƙi a cikin ramin ba.

Kwantenan suna ɗauke da nasu kwafin amsar

Kwantan da aka gina daga hoto na gama-gari yawanci yana aika ƙayyadadden resolv.conf. Canje-canjen mai warware da aka yi a kan mai masauki ba sa isa gare shi, haka ma yankin bincike, don haka aikin gini da ke haɗa rabo ta ramin yana gazawa yayin da wannan umarni ɗaya ke aiki a wajen kwantan. Ba kwantan nasa saitunan DNS da bincike a cikin fayil ɗin compose ko a cikin hujjojin run, ba kawai a cikin bayanan mai masauki ba.

Bincika cikin kwantan kafin ka zargi hoton. Umarni biyu suna sake haifar da dukan bincike cikin 'yan daƙiƙa, kuma na biyu yana tabbatar da wane mai warware ya amsa da gaske.

Sannan kawai ka duba rabon da tacewar

Da zarar an warware sunan, sauran gazawar na yau da kullum ne na cibiyar sadarwa. SMB yana buƙatar TCP 445 zuwa sabar, kuma duba jerin ƙungiyar aiki ya dogara da sabis ɗin suna da ramin ba ya wuce su. Yi taswira da sunan mai masauki maimakon jira jerin ya cika, kuma bar abokin ciniki ya gaya maka wane mataki ya kai. Hakanan ya kamata a raba haɗin da aka ƙi da shiru na lokaci, domin na farkon yawanci yana nufin wani abu ya amsa kuma na biyun yana nufin babu komai.

getent hosts fileserver.corp.example
nc -vz fileserver.corp.example 445
mount -t cifs //fileserver.corp.example/share /mnt/share \
  -o vers=3.1.1,username=svc_mount,uid=1000

Adireshin da aka warware tare da ƙin tashar 445 ko lokaci ya ƙare matsala ce ta wutar bango ko mai sauraro a wancan gefen. Sunan da ba a warware ba ita ce matsalar mai warware. Kuma haɗin da ke tabbatarwa amma yana mayar da kurakurai na izini ba ɗaya daga cikinsu ba ne, don haka kada ka sake buɗe tambayar cibiyar sadarwa da zarar an kafa zaman.

Ka riƙe ƙarshen magana daidai da hujja. Lokacin da adireshin ke aiki amma sunan ba ya yi, ramin yana yin aikinsa kuma gyaran ya shafi tsarin mai warware, yankin bincike ko saitin kwantan da kansa.