6

Is it possible to set different DNS servers for different users?

Say user test1 uses Google's DNS (8.8.8.8 and 8.8.8.8), test2 would use 0.0.0.0, and both test3 and test4 would use 127.0.0.1.

Is this possible?

2
  • Just got an idea: couldn't you just turn /etc/resolv.conf into an alias that links to ~/resolv.conf?
    – William
    Aug 21, 2015 at 16:53
  • If you mean symbolic links, then you can’t. ~ is a construct of application software; there is no such substitution in the kernel (that expands symbolic links). Sep 12, 2015 at 17:41

4 Answers 4

7

“Is it…” Well, yes.

“How,” is where it gets complicated.

Basically, you've got two real options that I can think of. Assuming that you're using Gnu libc, and you have nsswitch support (I vaguely recall that some distribution(s) may have disabled that?), one option might be to replace the “normal” NSS DNS module (ie, /lib64/libnss_dns*) with a custom version that would check, perhaps ~/.config/resolv.conf or so.

Note, by “replace” I mean to add another module, with an unique name, that you then refer-to from /etc/nsswitch.conf. One might “simply” fork the code used to build the “normal” version and add something to construct a per-user version from it.

The other option might be to use kernel namespaces to “mount” a replacement resolv.conf from the perspective of each user's processes. (See a very thorough treatment from IBM in the comments.)

I'm not aware of any existing tools to facilitate either, though.

A third option that occurs to me, is to build each user a chroot jail, with most of the files hard-linked or bind-mounted, and a few select files like resolv.conf changed in-place.

2
  • 2
    See ibm.com/developerworks/linux/library/l-mount-namespaces/… for a really well written but extremely heavy duty approach to solving this kind of problem. I don't have the day or so available to dig through this in sufficient detail to attempt implementation myself. Aug 21, 2015 at 16:29
  • 1
    mapping a different resolv.conf might not behave as you might expect - resolved/sssd/mscd will all do systemwide caching of results. While libnss might be resolving suttf on a per user basis there is often a shared DNS cache of the host.
    – symcbean
    Mar 17, 2023 at 14:26
1

The DNS server settings are defined for the machine, not for the user.

The gethostbyname*() syscall family tries to lookup a given hostname and return an IP-address. The first place is normally the /etc/hosts file. Then they do a lookup via the DNS-servers set in /etc/resolv.conf.

1

While it would be possible to configure the accounts such that each ran in its own network namespace, then add iptables rules to redirect the DNS queries elsewhere - but this would not address the problem of data already cached in nscd/sssd/resolved.

While @X Tian already suggested changing the hosts file, this again makes the change at the host level - not the user level. But most versions of Linux support a per-session override of the location of the hosts file via the HOSTALIASES environment variable. It has been a very long time since I have had reason to use this, and some testing would be required to establish if it still works in a world of systemd.

3
  • I don't understand. What is your point? OP wants different DNS servers for different users. Since this isn't possible, RESOLV_HOST_CONF provides for a more granular override of DNS records which MIGHT need OPs unstated objective.
    – symcbean
    Mar 17, 2023 at 14:46
  • 1
    Thanks @telcoM - yes, sloppy googling - meant to discuss HOSTALIASES - amending post.
    – symcbean
    Mar 17, 2023 at 17:21
  • And thanks to you, for reminding me of this elusive bit of information. I once looked for it too, and evidently my disappointment at RESOLV_HOST_CONF left a stronger memory than when I eventually found HOSTALIASES, so when I read your original answer, my immediate reaction was "I don't remember what was the solution, but I definitely know RESOLV_HOST_CONF is not it!" :-)
    – telcoM
    Mar 17, 2023 at 17:46
0

No, DNS is not designed to do this. However, if you are testing you could use /etc/hosts and hard code several test domain names to specific IP addresses and then give each user the test domain names that you want them to use.

eg. /etc/hosts

IP address1 hosta.test2 
IP address2 hostb.test2

IP address3 hosta.test3
IP address4 hostb.test3

...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .