16

How to know the IP address of some host somename I can ssh to? If I do nslookup on this host it says "no answer". How can ssh resolve it's name then?


Neither /etc/hosts nor .ssh/config explanation worked.


EDIT

Sorry somename is fully qualified.

ssh somename.somedomain

works, while

ping somename.somedomain

and

nslookup somename.somedomain

don't

  • 12
    Is it listed in /etc/hosts or ~/.ssh/config? – Stephen Kitt May 7 at 10:14
  • 1
    The name could also be resolved using mDNS (Multicast DNS) or LLMNR (Link-Local Multicast Name Resolution). – Johan Myréen May 7 at 10:26
  • It may have an entry in your .ssh/config file – Tagwint May 7 at 10:31
  • 1
    @Dims You could try pinging somename.local. .local is a special domain reserved for mDNS. For LLMNR you could use this NMAP script. – Johan Myréen May 7 at 15:55
  • 2
    @mckenzm no, it won’t. – Stephen Kitt May 8 at 8:05
31

Nslookup is a program to query Internet domain name servers. Nslookup is very good for querying DNS servers but it does not give you the whole picture when it comes to name resolution.

On Linux name resolution is most commonly controlled by NSS which is configured by /etc/nsswitch.conf. Specifically, this configuration contains a hosts entry. For example:

hosts:          files dns

In the above entry you can see that the first thing to be queried is files followed by dns, meaning that /etc/hosts will be queried before DNS. Other options exist including LDAP, Multicast DNS and WINS.

Answering your question directly, SSH resolves the hostname to an IP address using NSS (pulling results from multiple sources) where nslookup only queries the DNS.

You can check to see which IP NSS resolves a hostname to using getent. For example to resolve somename:

getent hosts somename

Also In the case of SSH you can configure host specific information in /etc/ssh/ssh_config and ~/.ssh/config. This will even let you specify an IP address for a hostname, entirely skipping name resolution.:

The following tells SSH to use 192.168.1.25 for both dev and dev.example.com. SSH will use this address whether or not these names exist as DNS names for a different IP:

# contents of $HOME/.ssh/config
Host dev dev.example.com
    HostName 192.168.1.25
10

How to know the IP address of some host somename I can ssh to?

Use the verbose flag (-v) of the ssh command:

ssh somename -v

The output should contain, among other things, a line that shows the resolved IP of the server you are connecting to:

debug1: Connecting to aur.archlinux.org [5.9.250.164] port 22.

If I do nslookup on this host it says "no answer". How can ssh resolve it's name then?

The most probable cause of ssh being able to resolve a hostname that nslookup cannot is that it is configured at the ssh level.

Per the ssh_config(5) manual page, there are three places where ssh looks at for config files:

  1. command-line options
  2. user's configuration file (~/.ssh/config)
  3. system-wide configuration file (/etc/ssh/ssh_config)

One of these files may contain your hostname somename (or a pattern that matches it) as an alias of another hostname or IP. For example:

# explicit alias of somename to 8.8.8.8 IP
Host somename
    HostName 8.8.8.8

# pattern alias (that obviously matches somename) to another hostname
# that is itself resolved via DNS (and that can be nslookup-ed).
Host *
    HostName anotherhostname

Please refer to the ssh_config(5) manual page explanations of Host and HostName directives and to the PATTERNS section for more information.

  • This answer does not answer the question, which was how a host name is recognized, even if it is not server by a DNS server. – Johan Myréen May 7 at 15:54
  • 1
    The answer correctly mentions very probable scenario where ssh user@someserver seems to "resolve" the someserver DNS name (even if this does not actually happen). If the Host someserver is configured in .ssh/config file, it is then possible to use the ssh command exactly as OP states even if the someserver is not in the DNS at all. – Fiisch May 7 at 18:32
  • 2
    @JohanMyréen The output from ssh -v somename includes the IP address (regardless of any ssh_config entries). So it directly answers the question "How to know the IP address of some host somename I can ssh to?", as well as being a good first step towards answering "How can it be that ssh somename works...?". – JigglyNaga May 8 at 11:20
4

Philip is almost there, but heads off down the .ssh/config rathole which it's unlikely you configured.

The commands...

getent hosts somename

...queries NSS using the hosts: lookup line in /etc/nsswitch.conf, rather than just DNS as nslookup does. It's likely your Unix environment is using more than one naming service; possibly some type of AD integration.

  • 3
    I wouldn't say I headed off down that route. I added an "also" for completeness. – Philip Couling May 7 at 19:42
  • @PhilipCouling Sure, but your "pre-also" is incomplete - you're not showing how to arbitrarily resolve a name when the question is about "$thing versus nsloookup". – Rich May 7 at 20:22
  • 3
    As already commented on the Q, host is normally part of bind-utils (or equivalent) and like both nslookup and dig uses only DNS. OTOH getent hosts (or possibly ahosts) does what you describe. – dave_thompson_085 May 8 at 0:24
  • @dave_thompson_085 Incorrect. host queries other name services. Agreed that getent hosts is the best unambiguous method to query "any configured name services". – Rich May 8 at 16:07
  • 1
    host is DNS-only per the man pages and confirmed by testing on the systems I use (CentOS, Ubuntu, FreeBSD, Solaris) as well as upstream. Also see the (near)dupes I commented on the Q which also say this. – dave_thompson_085 May 10 at 4:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.