1

I am in the process of upgrading my production server from Ubuntu 14.04 to 18.04 and noticed that there is something called systemd-resolved in 18.04 which run a local DNS cache of sorts. [1]

Why is this required? What is wrong with simply putting nameserver 1.1.1.1 or nameserver 8.8.8.8 in /etc/resolv.conf and calling it a day? Is it safe to disable systemd-resolved and revert to the simpler configuration?

[1] I noticed only because it is randomly crashing and causing all hostname lookups to fail, effectively crippling my app - https://askubuntu.com/questions/1117842/systemd-resolved-crashing-with-failed-to-set-up-mount-namespacing-invalid-argu

  • I think the intent of that was for the situation when you setup your own Authoritative DNS. – Overmind Feb 13 at 6:48
  • @Overmind is this a very common setup to make this the default in Ubuntu 18.04? Does systemd-resolved serve some other critical purpose and it's recommended to disable it? – Saurabh Nanda Feb 13 at 7:01
  • I've explained in an answer. P.S. Why not use something like a CentOS for your production server ? – Overmind Feb 13 at 7:27
  • Unfortunately it's part of an overarching way that systemd is being implemented under the cover of improved usability. systemd-resolved does things completely different from the previous implementations and in my opinion should be disabled on any production system. – Gothrek Feb 13 at 18:52
3

The logic of it is that Ubuntu has a built in DNS cache, which it checks first when trying to resolve anything. In this version, by default, NetworkManager is not updating /etc/resolv.conf instead it’s calling application called resolvconf.

This approach:

service resolvconf disable-updates
update-rc.d resolvconf disable
service resolvconf stop

May not make it through a reboot.

To get rid of the problem, we can try harder:

systemctl disable systemd-resolved.service
systemctl stop systemd-resolved

add the following lines to the [main] section of NetworkManager.conf:

dns=default

Then restart net manager:

service network-manager restart

That should make the system use the classic resolv.conf .

An alternate dirty trick is to makes the service un-startable until you "unmask" it:

systemctl mask systemd-resolved

The unsafe part of this may be that disabling it might break name resolution in some VPN scenarios. So if you want to use VPNs, make sure to do proper testing of their functionality after getting rid of systemd-resolved.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.