Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Any Unix program (command) to connect to a domain uses a method 'gethostbyname' from RESOLVER. First thing what this method does is reading /etc/nsswitch.conf Where it finds a line: 'hosts: files dns' which means: to look for hosts in files (/etc/hosts), then query dns. So, if you delete 'dns' from this line and leave only 'files', user can only access hosts listed in '/etc/hosts'. And this is exactly the way to create 'white list' of domains. Cool!

Windows has /WINDOWS/system32/drivers/etc/hosts, and it uses it. It uses dns too. But where's the config that defines what to use and in what order? Is there kind of /etc/nsswitch.conf file or a record in registry?

P.S: I promise to inform our system administrators of Windows, so that they could create 'white list' of domains for users in this elegant unix-way instead of using ugly IE 'parental control'.

share|improve this question

2 Answers 2

up vote 3 down vote accepted

You want to manage what your users can access online? You realise that by your approach you have to continuously update the IP for every site your users have to visit... On every server in your network? I also assume your Windows Servers are in a domain, an Active Directory domain is dependant on a functional DNS infrastructure.

What you want is a firwall/proxy etc that can do web filtering.

share|improve this answer
    
In office all machines are in Active Directory domain and behind proxy that does webfiltering. But we also have around 30 sell points scattered around city. They are not in domain and not behind proxy. Our sys.admins need to allow access only to 5 web sites. So, no problem with Active Directory and IP's to update. –  Vitaly Nov 2 '12 at 8:55
    
Then you can probably just do not set DNS-servers on the machines, or if you want to make it somewhat flexible deploy a root DNS server and add forward lookup zones for the domains that should works. –  Zerqent Nov 2 '12 at 8:58

Warning found on google, not in official docs,

Lower numbers mean higher priority compared to other services. registry

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\ServiceProvider

keys LocalPriority - local names cache HostPriority the HOSTS file DnsPriority DNS host resolution NetbtPriority - NetBT name resolution, including WINS

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.