How can it be that ssh somename works, while nslookup somename does not?

Question

How to know the IP address of some host somename I can ssh to? If I do nslookup on this host it says "no answer". How can ssh resolve it's name then?

---

Neither /etc/hosts nor .ssh/config explanation worked.

---

EDIT

Sorry somename is fully qualified.

ssh somename.somedomain

works, while

ping somename.somedomain

and

nslookup somename.somedomain

don't

Answer 1

Nslookup is a program to query Internet domain name servers. Nslookup is very good for querying DNS servers but it does not give you the whole picture when it comes to name resolution.

On Linux name resolution is most commonly controlled by NSS which is configured by /etc/nsswitch.conf. Specifically, this configuration contains a hosts entry. For example:

hosts:          files dns

In the above entry you can see that the first thing to be queried is files followed by dns, meaning that /etc/hosts will be queried before DNS. Other options exist including LDAP, Multicast DNS and WINS.

Answering your question directly, SSH resolves the hostname to an IP address using NSS (pulling results from multiple sources) where nslookup only queries the DNS.

You can check to see which IP NSS resolves a hostname to using getent. For example to resolve somename:

getent hosts somename

---

Also In the case of SSH you can configure host specific information in /etc/ssh/ssh_config and ~/.ssh/config. This will even let you specify an IP address for a hostname, entirely skipping name resolution.:

The following tells SSH to use 192.168.1.25 for both dev and dev.example.com. SSH will use this address whether or not these names exist as DNS names for a different IP:

# contents of $HOME/.ssh/config
Host dev dev.example.com
    HostName 192.168.1.25

Answer 2

How to know the IP address of some host somename I can ssh to?

Use the verbose flag (-v) of the ssh command:

ssh somename -v

The output should contain, among other things, a line that shows the resolved IP of the server you are connecting to:

debug1: Connecting to aur.archlinux.org [5.9.250.164] port 22.

---

If I do nslookup on this host it says "no answer". How can ssh resolve it's name then?

The most probable cause of ssh being able to resolve a hostname that nslookup cannot is that it is configured at the ssh level.

Per the ssh_config(5) manual page, there are three places where ssh looks at for config files:

1. command-line options
2. user's configuration file (~/.ssh/config)
3. system-wide configuration file (/etc/ssh/ssh_config)

One of these files may contain your hostname somename (or a pattern that matches it) as an alias of another hostname or IP. For example:

# explicit alias of somename to 8.8.8.8 IP
Host somename
    HostName 8.8.8.8

# pattern alias (that obviously matches somename) to another hostname
# that is itself resolved via DNS (and that can be nslookup-ed).
Host *
    HostName anotherhostname

Please refer to the ssh_config(5) manual page explanations of Host and HostName directives and to the PATTERNS section for more information.

Answer 3

Philip is almost there, but heads off down the .ssh/config rathole which it's unlikely you configured.

The commands...

getent hosts somename

...queries NSS using the hosts: lookup line in /etc/nsswitch.conf, rather than just DNS as nslookup does. It's likely your Unix environment is using more than one naming service; possibly some type of AD integration.