mirror of
https://codeberg.org/privacy1st/arch
synced 2024-12-23 01:16:04 +01:00
add DNS
This commit is contained in:
parent
72aa32c7d2
commit
1b224071be
11
pkg/de-p1st-dns/DoT.conf
Normal file
11
pkg/de-p1st-dns/DoT.conf
Normal file
@ -0,0 +1,11 @@
|
|||||||
|
[Resolve]
|
||||||
|
DNS=5.9.164.112:853#dns3.digitalcourage.de 46.182.19.48:853#dns2.digitalcourage.de
|
||||||
|
DNSOverTLS=yes
|
||||||
|
DNSSEC=yes
|
||||||
|
FallbackDNS=185.95.218.42:853#dns.digitale-gesellschaft.ch 185.95.218.43:853#dns.digitale-gesellschaft.ch 89.233.43.71:853#unicast.uncensoreddns.org 5.1.66.255:853#dot.ffmuc.net
|
||||||
|
Domains=~.
|
||||||
|
Cache=yes
|
||||||
|
#LLMNR=yes
|
||||||
|
#MulticastDNS=yes
|
||||||
|
#DNSStubListener=yes
|
||||||
|
#ReadEtcHosts=yes
|
||||||
37
pkg/de-p1st-dns/PKGBUILD
Normal file
37
pkg/de-p1st-dns/PKGBUILD
Normal file
@ -0,0 +1,37 @@
|
|||||||
|
# Maintainer: Daniel Langbein <daniel@systemli.org>
|
||||||
|
_pkgname=dns
|
||||||
|
_reponame=arch-pkg
|
||||||
|
pkgname="de-p1st-$_pkgname"
|
||||||
|
pkgver=0.0.1
|
||||||
|
pkgrel=1
|
||||||
|
pkgdesc="DNS configuration: Use DNS over TLS"
|
||||||
|
arch=('any')
|
||||||
|
url="https://git.privacy1st.de/langfingaz/${_reponame}"
|
||||||
|
license=('MIT')
|
||||||
|
groups=()
|
||||||
|
|
||||||
|
# systemd-resolvd
|
||||||
|
depends=('systemd')
|
||||||
|
# (optional) replacement for resolvconf
|
||||||
|
depends+=('systemd-resolvconf')
|
||||||
|
|
||||||
|
makedepends=('git')
|
||||||
|
optdepends=()
|
||||||
|
provides=()
|
||||||
|
conflicts=() # 'openresolv' conflicts with 'systemd-resolvd'
|
||||||
|
replaces=()
|
||||||
|
backup=()
|
||||||
|
options=()
|
||||||
|
install=
|
||||||
|
changelog=
|
||||||
|
source=("git+${url}.git")
|
||||||
|
noextract=()
|
||||||
|
sha256sums=('SKIP')
|
||||||
|
|
||||||
|
package() {
|
||||||
|
cd "${_reponame}/pkg/${pkgname}"
|
||||||
|
|
||||||
|
install -Dm0644 DoT.conf "$pkgdir"/etc/systemd/resolved.conf.d/DoT.conf
|
||||||
|
install -Dm0644 dns.conf "$pkgdir"/etc/NetworkManager/conf.d/dns.conf
|
||||||
|
install -Dm0644 systemd.preset "$pkgdir"/usr/lib/systemd/system-preset/"$pkgname".preset
|
||||||
|
}
|
||||||
158
pkg/de-p1st-dns/README.md
Normal file
158
pkg/de-p1st-dns/README.md
Normal file
@ -0,0 +1,158 @@
|
|||||||
|
# DNS
|
||||||
|
|
||||||
|
List of DNS servers
|
||||||
|
|
||||||
|
* kuketz-blog
|
||||||
|
* https://www.kuketz-blog.de/empfehlungsecke/#dns
|
||||||
|
* Digitalcourage
|
||||||
|
* https://digitalcourage.de/support/zensurfreier-dns-server
|
||||||
|
* DoT, DNSSEC: 5.9.164.112:853#dns3.digitalcourage.de
|
||||||
|
* DoT, DNSSEC: 46.182.19.48:853#dns2.digitalcourage.de
|
||||||
|
* Digitale Gesellschaft
|
||||||
|
* https://www.digitale-gesellschaft.ch/dns/
|
||||||
|
* DoT, DNSSEC: 185.95.218.42:853#dns.digitale-gesellschaft.ch
|
||||||
|
* DoT, DNSSEC: 185.95.218.43:853#dns.digitale-gesellschaft.ch
|
||||||
|
* UncensoredDNS
|
||||||
|
* https://blog.uncensoreddns.org/dns-servers/
|
||||||
|
* 89.233.43.71:853#unicast.uncensoreddns.org
|
||||||
|
* https://ffmuc.net/wiki/doku.php?id=knb:dohdot
|
||||||
|
* 5.1.66.255:853#dot.ffmuc.net
|
||||||
|
|
||||||
|
## Unencrypted DNS - Network Manager Configuration
|
||||||
|
|
||||||
|
* https://wiki.archlinux.org/index.php/NetworkManager#Custom_DNS_servers
|
||||||
|
|
||||||
|
```shell
|
||||||
|
echo '[global-dns-domain-*]
|
||||||
|
# servers=serveripaddress1,serveripaddress2,serveripaddress3
|
||||||
|
servers=46.182.19.48,2a02:2970:1002::18,91.239.100.100,2001:67c:28a4::,89.233.43.71,2a01:3a0:53:53::' \
|
||||||
|
| sudo tee /etc/NetworkManager/conf.d/dns-servers.conf
|
||||||
|
|
||||||
|
sudo systemctl restart NetworkManager
|
||||||
|
```
|
||||||
|
|
||||||
|
## Encrypted DNS - systemd-resolved
|
||||||
|
|
||||||
|
* https://wiki.archlinux.org/index.php/Systemd-resolved#DNS_over_TLS
|
||||||
|
* https://www.freedesktop.org/software/systemd/man/resolved.conf.html#
|
||||||
|
* `domains=~.`
|
||||||
|
* https://unix.stackexchange.com/a/632292
|
||||||
|
* https://fedoramagazine.org/use-dns-over-tls/
|
||||||
|
|
||||||
|
> systemd-resolved provides resolver services
|
||||||
|
> for Domain Name System (DNS) (including DNSSEC
|
||||||
|
> and DNS over TLS), Multicast DNS (mDNS) and
|
||||||
|
> Link-Local Multicast Name Resolution (LLMNR)
|
||||||
|
|
||||||
|
Installation:
|
||||||
|
|
||||||
|
```shell
|
||||||
|
# already preinstalled, contains systemd-resolved
|
||||||
|
sudo pacman -S --needed systemd
|
||||||
|
|
||||||
|
# remove openresolv! It is in conflict with systemd-resolvd
|
||||||
|
sudo pacman -Rns openresolv
|
||||||
|
|
||||||
|
# optional: install resolvconf replacement (for use with systemd-resolved)
|
||||||
|
sudo pacman -S --needed systemd-resolvconf
|
||||||
|
```
|
||||||
|
|
||||||
|
Resolver configuration:
|
||||||
|
|
||||||
|
```shell
|
||||||
|
sudo mkdir -p /etc/systemd/resolved.conf.d
|
||||||
|
|
||||||
|
echo \
|
||||||
|
'[Resolve]
|
||||||
|
DNS=5.9.164.112:853#dns3.digitalcourage.de 46.182.19.48:853#dns2.digitalcourage.de
|
||||||
|
DNSOverTLS=yes
|
||||||
|
DNSSEC=yes
|
||||||
|
FallbackDNS=185.95.218.42:853#dns.digitale-gesellschaft.ch 185.95.218.43:853#dns.digitale-gesellschaft.ch 89.233.43.71:853#unicast.uncensoreddns.org 5.1.66.255:853#dot.ffmuc.net
|
||||||
|
Domains=~.
|
||||||
|
Cache=yes
|
||||||
|
#LLMNR=yes
|
||||||
|
#MulticastDNS=yes
|
||||||
|
#DNSStubListener=yes
|
||||||
|
#ReadEtcHosts=yes' \
|
||||||
|
| sudo tee /etc/systemd/resolved.conf.d/DoT.conf >/dev/null
|
||||||
|
```
|
||||||
|
|
||||||
|
NetworkManager -> use systemd-resolved:
|
||||||
|
|
||||||
|
- There are multiple alternatives to do this
|
||||||
|
- From man page https://developer.gnome.org/NetworkManager/stable/NetworkManager.conf.html:
|
||||||
|
If resolv.conf is symlink (see symlink
|
||||||
|
line below), then NetworkManager wil automatically use
|
||||||
|
resolvd. This is the nicest method.
|
||||||
|
- https://wiki.archlinux.org/index.php/Systemd-resolved#DNS
|
||||||
|
- Alternative: Add "[main] <newLine> dns=systemd-resolved"
|
||||||
|
to /etc/NetworkManager/conf.d/dns.conf
|
||||||
|
- https://wiki.archlinux.org/index.php/NetworkManager#systemd-resolved
|
||||||
|
|
||||||
|
```shell
|
||||||
|
# resolv.conf generated by NetworkManager
|
||||||
|
sudo systemctl stop NetworkManager
|
||||||
|
if [ ! -f /etc/resolv.conf.backup ]; then sudo mv /etc/resolv.conf /etc/resolv.conf.backup; fi
|
||||||
|
sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
|
||||||
|
```
|
||||||
|
|
||||||
|
Enabling systemd-resolvd:
|
||||||
|
|
||||||
|
```shell
|
||||||
|
sudo systemctl enable --now systemd-resolved.service
|
||||||
|
```
|
||||||
|
|
||||||
|
Restarting NetworkManager:
|
||||||
|
|
||||||
|
```shell
|
||||||
|
sudo systemctl restart NetworkManager
|
||||||
|
```
|
||||||
|
|
||||||
|
After some seconds, `resolv.conf` should just contain `nameserver 127.0.0.53`
|
||||||
|
|
||||||
|
```shell
|
||||||
|
cat /etc/resolv.conf
|
||||||
|
```
|
||||||
|
|
||||||
|
See also: `resolvectl status`
|
||||||
|
|
||||||
|
|
||||||
|
## Verification of unencrypted DNS
|
||||||
|
|
||||||
|
```shell
|
||||||
|
sudo pacman -S --needed ngrep
|
||||||
|
|
||||||
|
sudo ngrep port 53
|
||||||
|
```
|
||||||
|
|
||||||
|
The destination IP addresses should be one of the configured dns servers:
|
||||||
|
|
||||||
|
```
|
||||||
|
yoda@yodaTux ~ % sudo ngrep port 53
|
||||||
|
interface: wlp1s0 (192.168.178.0/255.255.255.0)
|
||||||
|
filter: ( port 53 ) and ((ip || ip6) || (vlan && (ip || ip6)))
|
||||||
|
#
|
||||||
|
U 192.168.178.71:60481 -> 46.182.19.48:53 #1
|
||||||
|
<............wiki.archlinux.org.....
|
||||||
|
```
|
||||||
|
|
||||||
|
## Verification of unencrypted DNS
|
||||||
|
|
||||||
|
```shell
|
||||||
|
sudo pacman -S --needed ngrep
|
||||||
|
|
||||||
|
# output should be empty
|
||||||
|
sudo ngrep port 53
|
||||||
|
|
||||||
|
# configured DoT addresses should be visible
|
||||||
|
sudo ngrep port 853
|
||||||
|
```
|
||||||
|
|
||||||
|
```
|
||||||
|
yoda@yodaTux ~ % sudo ngrep port 853
|
||||||
|
[...]
|
||||||
|
#
|
||||||
|
T 192.168.178.71:48350 -> 5.9.164.112:853 [AP] #274
|
||||||
|
....P.G.B.(...%/. e"..A".w.>.h..a.../...<.3b.
|
||||||
|
^.d......'bj...w.qU.... ....90..4.LL.=.&
|
||||||
|
```
|
||||||
2
pkg/de-p1st-dns/dns.conf
Normal file
2
pkg/de-p1st-dns/dns.conf
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
[main]
|
||||||
|
dns=systemd-resolved
|
||||||
1
pkg/de-p1st-dns/systemd.preset
Normal file
1
pkg/de-p1st-dns/systemd.preset
Normal file
@ -0,0 +1 @@
|
|||||||
|
enable systemd-resolved.service
|
||||||
Loading…
Reference in New Issue
Block a user