Re: Finding the program that keeps overwriting resolv.conf
On Mon, Nov 25, 2019 at 12:03:19AM -0500, aliasarmor wrote:
> Hello, a program keeps overwriting my resolv.conf. For now I have resorted
> to a cron job that manually sets my resolve.conf to 127.0.0.1 every
> minute.
> I properly set my DNS within Network-manager to 127.0.0.1 and that never
> changes, according to the GUI. Although after several minutes/hours I
> notice that my DNS begins pointing to an external address.
> Whenever it gets overwritten it becomes:
> "
> domain lan
> search lan
> nameserver 10.0.0.1
> "
> I have been running auditd on resolv.conf and the only oddity I think I
> see is dhclient but I do not know enough to determine whether this is
> normal.
> "type=CONFIG_CHANGE msg=audit(1574585306.801:972): auid=4294967295
> ses=4294967295 op=updated_rules path="/etc/resolv.conf" key=(null) list=4
> res= 1
> type=PATH msg=audit(1574585306.801:973): item=2
> name="/etc/resolv.conf.dhclient-new.28806" inode=12847486 dev=fe:01
> mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE
> cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0"
> I may be overlooking something stupid simple?
These previous discussions on the list should provide the information
you need:
https://lists.debian.org/debian-user/2019/07/msg01448.html
https://lists.debian.org/debian-user/2019/08/msg00055.html
https://lists.debian.org/debian-user/2017/10/msg00779.html
Regards,
-Roberto
--
Roberto C. Sánchez
Reply to: