CentOS - Oct 2009 - resolv.conf rewritten every reboot. How to figure out who and why?

My machine has a static IP, with dhcp and IPv6 disabled. Every time I
reboot, some process rewrites /etc/resolv.conf, including a comment
about dhcpclient. The only package I have installed that shows up in
"rpm -qa|grep -i dhcp" is dhcpv6-client-1.0.10-16.el5, and nothing in
there is named dhcpclient.

I'd like to figure out what software is rewriting this file and why.
man 5 resolv.conf  and man resolver are unhelpful in this case. rpm
reports /etc/resolv.conf is not owned by any package.

At this point, I am as (or more) interested in pointers regarding how
to find the answer as I am in the actual answer. Please teach me to
fish.

mahalo,
Dave

On Thu, Oct 8, 2009 at 10:41 AM, Dave <tdbtdb+centos at gmail.com>
wrote:
> My machine has a static IP, with dhcp and IPv6 disabled. Every time I
> reboot, some process rewrites /etc/resolv.conf, including a comment
> about dhcpclient. The only package I have installed that shows up in
> "rpm -qa|grep -i dhcp" is dhcpv6-client-1.0.10-16.el5, and
nothing in
> there is named dhcpclient.
>
I don't know that answer, but one workaround would be to maintain a
backup copy of the file and initiate a late-boot service that replaces
the rewritten one with the backup if they don't match.

mhr

On Thu, Oct 8, 2009 at 1:41 PM, Dave <tdbtdb+centos at gmail.com>
wrote:
> My machine has a static IP, with dhcp and IPv6 disabled. Every time I
> reboot, some process rewrites /etc/resolv.conf, including a comment
> about dhcpclient. The only package I have installed that shows up in
> "rpm -qa|grep -i dhcp" is dhcpv6-client-1.0.10-16.el5, and
nothing in
> there is named dhcpclient.
Looks like the dhclient script is still being called.

One option would be to comment out the make_resolv_conf()  function in
/sbin/dhclient-script.

M

Maybe it overwritten by NetworkManager?

On Thu, Oct 8, 2009 at 9:41 PM, Dave
<tdbtdb+centos at gmail.com<tdbtdb%2Bcentos at
gmail.com>
> wrote:
> My machine has a static IP, with dhcp and IPv6 disabled. Every time I
> reboot, some process rewrites /etc/resolv.conf, including a comment
> about dhcpclient. The only package I have installed that shows up in
> "rpm -qa|grep -i dhcp" is dhcpv6-client-1.0.10-16.el5, and
nothing in
> there is named dhcpclient.
>
> I'd like to figure out what software is rewriting this file and why.
> man 5 resolv.conf  and man resolver are unhelpful in this case. rpm
> reports /etc/resolv.conf is not owned by any package.
>
> At this point, I am as (or more) interested in pointers regarding how
> to find the answer as I am in the actual answer. Please teach me to
> fish.
>
> mahalo,
> Dave
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> http://lists.centos.org/mailman/listinfo/centos
>


-- 
Sergey Smirnov
email/xmpp: Sergey.A.Smirnov at Gmail.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.centos.org/pipermail/centos/attachments/20091008/d548a730/attachment-0002.html>

On Thu, Oct 8, 2009 at 7:52 AM, Sergey Smirnov
<sergey.a.smirnov at gmail.com> wrote:
> Maybe it?overwritten by NetworkManager?
I almost wish.

[root@ ~]# /etc/init.d/NetworkManager status
NetworkManager is stopped
[root@ ~]# chkconfig --list|grep Netw
NetworkManager  0:off   1:off   2:off   3:off   4:off   5:off   6:off

> about dhcpclient. The only package I have installed that shows up in
It's called "dhclient", so searching for "dhcp"
won't give you a hit on
that.

chkconfig for dhclient too, and see what that results.

Also, look at /etc/sysconfig/network-scripts/ifcfg-eth0.

It's possible to have addresses "statically" assigned via DHCP
based on
MAC addresses. If resolv.conf is getting populated by dhclient, then
I'm guessing the odds of you having a dhcp server on your network is
good. :)

In all likelihood, you have a static IP assigned in your ifcfg-eth0,
and the resolv.conf is being over-written by dhclient.

-- 
Spiro Harvey                  Knossos Networks Ltd
021-295-1923                  www.knossos.net.nz
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 197 bytes
Desc: not available
URL:
<http://lists.centos.org/pipermail/centos/attachments/20091009/7ada5cb5/attachment-0002.sig>

Dave wrote:
> My machine has a static IP, with dhcp and IPv6 disabled. Every time I
> reboot, some process rewrites /etc/resolv.conf, including a comment
> about dhcpclient. The only package I have installed that shows up in
What happens when you do this:

grep BOOTPROTO /etc/sysconfig/network-scripts/ifcfg-*

-- 
Florin Andrei

http://florin.myip.org/

Dave wrote:
> My machine has a static IP, with dhcp and IPv6 disabled. Every time I
> reboot, some process rewrites /etc/resolv.conf, including a comment
> about dhcpclient.
Is that dhcpclient, or dhclient?
> The only package I have installed that shows up in
> "rpm -qa|grep -i dhcp" is dhcpv6-client-1.0.10-16.el5, and
nothing in
> there is named dhcpclient.
What is the output of these commands?

rpm -qa | grep dhc
# to see what's actually installed as a package

find / -name dhclient
# to see if and where is the executable installed

grep -rI dhclient /etc | grep -v selinux | grep -v /ifup-eth: \
	| grep -v /ifdown-eth:
# to see if it's called from somewhere else than the regular places

-- 
Florin Andrei

http://florin.myip.org/

On Thu, Oct 8, 2009 at 9:49 AM, Spiro Harvey <spiro at knossos.net.nz>
wrote:
> chkconfig for dhclient too, and see what that results.

[root@ ~]# chkconfig --list|grep  -e dh -e clie
[root@ ~]#
>
> Also, look at /etc/sysconfig/network-scripts/ifcfg-eth0.

[root at lee1 ~]# cat /etc/sysconfig/network-scripts/ifcfg-eth0
# Broadcom Corporation NetXtreme BCM5751 Gigabit Ethernet PCI Express
DEVICE=eth0
BOOTPROTO=none
HWADDR=00:18:8b:0f:ad:c2
IPADDR=1[snip]0
ONBOOT=yes
DHCP_HOSTNAME=[snip]
DNS1=1[snip]0
DNS2=1[snip].2
NM_CONTROLLED=no
SEARCH=[snip]
NETMASK=255.255.255.0
DNS3=1[snip]0
GATEWAY=1[snip]0.1
TYPE=Ethernet
USERCTL=no
PEERDNS=yes
IPV6INIT=no
>
> It's possible to have addresses "statically" assigned via
DHCP based on
> MAC addresses. If resolv.conf is getting populated by dhclient, then
> I'm guessing the odds of you having a dhcp server on your network is
> good. :)
You guessed right. But the question remains, what software is writing the file?
> In all likelihood, you have a static IP assigned in your ifcfg-eth0,
> and the resolv.conf is being over-written by dhclient.
What is invoking dhclient, how do I find it?
 rpm -qR dhclient
/bin/bash
initscripts >= 6.75
libc.so.6()(64bit)
libc.so.6(GLIBC_2.2.5)(64bit)
libc.so.6(GLIBC_2.3)(64bit)
libc.so.6(GLIBC_2.3.4)(64bit)
libc.so.6(GLIBC_2.4)(64bit)
libc.so.6(GLIBC_2.8)(64bit)
rpmlib(CompressedFileNames) <= 3.0.4-1
rpmlib(PayloadFilesHavePrefix) <= 4.0-1
rpmlib(VersionedDependencies) <= 3.0.3-1
rtld(GNU_HASH)

Dave

At Thu, 8 Oct 2009 07:41:33 -1000 CentOS mailing list <centos at
centos.org> wrote:
> 
> My machine has a static IP, with dhcp and IPv6 disabled. Every time I
> reboot, some process rewrites /etc/resolv.conf, including a comment
> about dhcpclient. The only package I have installed that shows up in
> "rpm -qa|grep -i dhcp" is dhcpv6-client-1.0.10-16.el5, and
nothing in
> there is named dhcpclient.
> 
> I'd like to figure out what software is rewriting this file and why.
> man 5 resolv.conf  and man resolver are unhelpful in this case. rpm
> reports /etc/resolv.conf is not owned by any package.
> 
> At this point, I am as (or more) interested in pointers regarding how
> to find the answer as I am in the actual answer. Please teach me to
> fish.
Is NetworkManager running?  If so, stop it:

sudo /sbin/service NetworkManager stop

and disable it:

sudo /sbin/chkconfig NetworkManager off


> 
> mahalo,
> Dave
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> http://lists.centos.org/mailman/listinfo/centos
> 
>
-- 
Robert Heller             -- 978-544-6933
Deepwoods Software        -- Download the Model Railroad System
http://www.deepsoft.com/  -- Binaries for Linux and MS-Windows
heller at deepsoft.com       -- http://www.deepsoft.com/ModelRailroadSystem/

Dave wrote:
> My machine has a static IP, with dhcp and IPv6 disabled. Every time I
> reboot, some process rewrites /etc/resolv.conf, including a comment
> about dhcpclient. The only package I have installed that shows up in
> "rpm -qa|grep -i dhcp" is dhcpv6-client-1.0.10-16.el5, and
nothing in
> there is named dhcpclient.
> 
> I'd like to figure out what software is rewriting this file and why.
> man 5 resolv.conf  and man resolver are unhelpful in this case. rpm
> reports /etc/resolv.conf is not owned by any package.
> 
> At this point, I am as (or more) interested in pointers regarding how
> to find the answer as I am in the actual answer. Please teach me to
> fish.
> 
> mahalo,
> Dave
Hi

Is network-manager enabled?

Regards

mg.

The consensus of the list seemed to be that I should change the PEERDNS
variable. It seems not to be working. The machine rebooted yesterday,
/etc/resolv.conf got rewritten again. And yet:

 find /etc/sysconfig/ -type f -exec grep -iH 'peerdns=' {} \;
/etc/sysconfig/network-scripts/ifcfg-eth0:PEERDNS=no
/etc/sysconfig/network-scripts/ifcfg-eth0.old:PEERDNS=yes
/etc/sysconfig/networking/profiles/default/ifcfg-eth0:PEERDNS=no
/etc/sysconfig/networking/devices/ifcfg-eth0:PEERDNS=no
# chkconfig --list|grep Net
NetworkManager  0:off   1:off   2:off   3:off   4:off   5:off   6:off
# /etc/init.d/NetworkManager status
NetworkManager is stopped
# find /etc/sysconfig/ -type f -exec grep -iH 'bootproto=' {} \;
/etc/sysconfig/network-scripts/ifcfg-eth0:BOOTPROTO=none
/etc/sysconfig/network-scripts/ifcfg-eth0.old:BOOTPROTO=none
/etc/sysconfig/network-scripts/ifup-eth:    BOOTPROTO=bootp
/etc/sysconfig/networking/profiles/default/ifcfg-eth0:BOOTPROTO=none
/etc/sysconfig/networking/devices/ifcfg-eth0:BOOTPROTO=none
# cat /etc/resolv.conf
; generated by /sbin/dhclient-script
search soest.hawaii.edu
nameserver 1...
nameserver 1...


So, it's not PEERDNS, not DHCP, not NetworkManager. Why is dhclient-script
even being run?

Maybe I should disable selinux altogether, instead of just making it
permissive? I think I'll try that.

# grep resol  /sbin/dhclient-script
make_resolv_conf() {
        save_previous /etc/resolv.conf
        change_resolv_conf $rscf
            for resolvfile in /etc/resolv.conf* ; do
                /sbin/restorecon $resolvfile >/dev/null 2>&1
    make_resolv_conf
        if [ -f /etc/resolv.conf.predhclient.$interface ]; then
            change_resolv_conf /etc/resolv.conf.predhclient.$interface
            rm -f /etc/resolv.conf.predhclient.$interface
[root at lee1 ~]# getenforce
Permissive

How badly would things blow up if I did this?

chmod a-w /etc/resolv.conf

mahalo,
Dave


On Thu, Oct 8, 2009 at 7:41 AM, Dave
<tdbtdb+centos at gmail.com<tdbtdb%2Bcentos at
gmail.com>
> wrote:
> My machine has a static IP, with dhcp and IPv6 disabled. Every time I
> reboot, some process rewrites /etc/resolv.conf, including a comment
> about dhcpclient. The only package I have installed that shows up in
> "rpm -qa|grep -i dhcp" is dhcpv6-client-1.0.10-16.el5, and
nothing in
> there is named dhcpclient.
>
> I'd like to figure out what software is rewriting this file and why.
> man 5 resolv.conf  and man resolver are unhelpful in this case. rpm
> reports /etc/resolv.conf is not owned by any package.
>
> At this point, I am as (or more) interested in pointers regarding how
> to find the answer as I am in the actual answer. Please teach me to
> fish.
>
> mahalo,
> Dave
>


-- 
???????????????????????-
Q: Why should this email be 5 sentences or less?
A: http://five.sentenc.es
IPRC-help FAQ: https://wailua/wiki/index.php/Faq
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.centos.org/pipermail/centos/attachments/20091029/b19f6553/attachment-0002.html>

> /etc/sysconfig/network-scripts/ifup-eth:??? BOOTPROTO=bootp
> So, it's not PEERDNS, not DHCP, not NetworkManager. Why is
dhclient-script
> even being run?
BOOTPROTO=bootp is triggering it.

In /etc/sysconfig/network-scripts/ifup-eth:

if [ "${BOOTPROTO}" = "bootp" -o "${BOOTPROTO}" =
"dhcp" ]; then
    DYNCONFIG=true
fi

Then, later on in that script:

if [ -n "${DYNCONFIG}" -a -x /sbin/dhclient ]; then

do a bunch of stuff related to dynamically assigned addresses and names.

And finally:

    if /sbin/dhclient ${DHCLIENTARGS} ${DEVICE} ; then
        echo $" done."
    else
> Maybe I should disable selinux altogether, instead of just making it
> permissive? I think I'll try that.
selinux shouldn't have anything to do with the resolv.conf file being
rewritten -- unless it's set to enforcing and something that isn't
allowed to do so is trying to rewrite the file.

HTH,

M