Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Question: How can I disable inet6 AAAA queries for my LDAP server during (LDAP-backed) NSS lookups on a CentOS (RHEL) 5 machine?

Background: I've servers configured to consult ldap://ldap.internal for NSS passwd and group lookups. Every relevant NSS lookup, for example the getpwuid(3) implied by an ls -l which needs to translate UIDs to network user names, performs the following DNS dance before connecting to the ldap server:

AAAA? ldap.internal          -> (no records)
AAAA? ldap.internal.internal -> NXDomain
A?    ldap.internal          -> 192.168.3.89

I'd like to skip the first two queries completely. Configuration:

[server]$ cat /etc/redhat-release 
CentOS release 5.4 (Final)
[server]$ grep ^passwd /etc/nsswitch.conf 
passwd:     files ldap
[server]$ grep ^uri /etc/ldap.conf
uri ldap://ldap.internal/

For what it's worth, IPv6 support is otherwise disabled on these systems:

[server]$ grep off /etc/modprobe.conf
alias ipv6 off
alias net-pf-10 off
[server]$ echo "$(ip a | grep -c inet6) IPv6-enabled interfaces"
0 IPv6-enabled interfaces
share|improve this question
    
Out of curiosity, why the belated downvote? –  pilcrow Jun 9 at 21:54
add comment

2 Answers

I'm not sure if /etc/gai.conf would have been available in 2009, but it is now (and would appear to have been at least since CentOS 5.5). It is a feature of glibc and allows setting the preference for sorting of IP addresses by getaddrinfo(3).

Look at http://serverfault.com/a/511240/161782 for a full answer with examples.

If you also want to make source address selection have a matching policy, see this post: http://biplane.com.au/blog/?p=122

share|improve this answer
    
Thanks. It's not address selection per se that I was interested in, but instead the suppression of AAAA lookups. –  pilcrow Jun 9 at 4:28
add comment
up vote 0 down vote accepted

The brief answer is: no, this behavior cannot be changed by simple system configuration.

AAAA lookups are the expected behavior of the shipped openldap libraries, openldap-2.3.43-3.el5 at the time of this writing. Built with --enable-ipv6, the LDAP connection routines resolve hosts with getaddrinfo(3) looking for any available address family (AF_UNSPEC), and so including both inet4 and inet6.

Now, the openldap code is aware of the AI_ADDRCONFIG hint, which would prevent looking for inet6 addresses when none are configured on the system, and similarly for inet4 addresses. However, the code fails to supply this hint for two reasons:

First, and buggily, the hint is misspelled as "AI_ATTRCONFIG" [sic], which misspelling is corrected around 2.4.14. Second, there is no configure test for the viability of this flag, so the code which would supply the flag, misspelled or not, is never compiled in.

Just a little more unneeded network chatter to live with, I suppose.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.