CentOS7 dns自動覆蓋

1. 現象

CentOS7 阿里雲ECS系統重啟后，/etc/resolv.conf 會被dhclient 或者NetworkManager還原為默認配置/清空

　　

2. 解決方案

2.1 機制

　　1. PEERDNS=yes|no 允許|禁止/etc/resolv.conf 重啟/更新網絡 被覆蓋

　　2. 當開啟NetworkManager.service 時, PEERDNS是不生效的，通過設置dns=none解決

　　3. 阿里雲ECS內部服務不要開啟NetworkManager, 可能導致網絡不可用

2.2 方案

https://www.cyberciti.biz/faq/dhclient-etcresolvconf-hooks/

3. 最佳實踐

系統初始化時：
1. /etc/resolv.conf template一份
2. 通過ansible的lineinfile 只增加一行PEERDNS=no

 

系統初始化時：
1. /etc/resolv.conf template一份
2. 通過ansible的lineinfile 只增加一行PEERDNS=no

- block:
  - name: Modify /etc/resolv.conf
    template:
      src: resolv.conf.j2
      dest: /etc/resolv.conf
      mode: 0644
      owner: root
      group: root


  - name: Install common operate utils
    yum:
      name: "{{ item }}"
      update_cache: yes
    with_items: ["htop", "iftop", "nload", "iptraf", "dstat", "iotop", "screen", "hping3"]

  - name: Modify ifcfg-etho to forbid Autoupdate DNS
    lineinfile:
      dest: /etc/sysconfig/network-scripts/ifcfg-eth0
      state: present
      line: 'PEERDNS=no'
      mode: 0644
      owner: root
      group: root
  when: ansible_distribution == "CentOS"
  tags: update_dns