etc/ststemd/resolved…: aggressive cleanup/rewriting
This commit is contained in:
parent
6e77c77aa7
commit
d47c374706
SSH Key Fingerprint:
SHA256:CXLULpqNBdUKB6E6fLA1b/4SzG0HvKD19PbIePU175Q
|
|
@ -0,0 +1,6 @@
|
||||||
|
[Resolve]
|
||||||
|
# Breaks everything, https://github.com/systemd/systemd/issues?q=dnssec%3Dallow-downgrade+is%3Aissue+is%3Aopen
|
||||||
|
#DNSSEC=allow-downgrade
|
||||||
|
DNSSEC=no
|
||||||
|
DNSOverTLS=opportunistic
|
||||||
|
Cache=yes
|
||||||
|
|
@ -1,6 +0,0 @@
|
||||||
# Config file to attempt DNSSEC and DoT everywhere, regardless of tech
|
|
||||||
# skill
|
|
||||||
[Resolve]
|
|
||||||
DNSSEC=allow-downgrade
|
|
||||||
DNSOverTLS=opportunistic
|
|
||||||
Cache=true
|
|
||||||
|
|
@ -2,19 +2,15 @@
|
||||||
|
|
||||||
### Files explained
|
### Files explained
|
||||||
|
|
||||||
* 00-everywhere.conf - configuration that doesn't affect DNS servers, attempts
|
* 00-defaults.conf - configuration not touching resolvers. Disables DNSSEC (as
|
||||||
to use DNSSEC and DoT and if it fails, doesn't care and uses insecure
|
systemd-resolved doesn't handle it properly), enables opportunistic DoT and
|
||||||
configuration.
|
caching.
|
||||||
* quad9-compat.conf - non-tech person config for Quad9, same as above except
|
* dot-*.conf - configuration to use the DNS provider with DNS-over-TLS. If
|
||||||
specifies the server.
|
captive portals are a concern, `DNSOverTLS`.
|
||||||
* quad9-strict.conf - tech person config demanding DNSSEC and DoT from Quad9
|
|
||||||
* README.md - you are reading it right now.
|
* README.md - you are reading it right now.
|
||||||
|
|
||||||
### General commentary
|
### General commentary
|
||||||
|
|
||||||
I have moved duplicate comments to this file, so it will possibly look weird
|
|
||||||
or miss original context.
|
|
||||||
|
|
||||||
* Based on my test DNSOverTLS is not supported in Ubuntu 18.04.x LTS (however
|
* Based on my test DNSOverTLS is not supported in Ubuntu 18.04.x LTS (however
|
||||||
at the time of writing this README.md, the current version is Ubuntu 20.04.0)
|
at the time of writing this README.md, the current version is Ubuntu 20.04.0)
|
||||||
(systemd v237). DNSOverTLS became supported in v239, strict mode (yes) in
|
(systemd v237). DNSOverTLS became supported in v239, strict mode (yes) in
|
||||||
|
|
@ -26,7 +22,7 @@ or miss original context.
|
||||||
* DNSSEC may not work if the system is down for a long time and not updated.
|
* DNSSEC may not work if the system is down for a long time and not updated.
|
||||||
Thus `allow-downgrade` may be better for non-tech people, even with the
|
Thus `allow-downgrade` may be better for non-tech people, even with the
|
||||||
potential downgrade attack. There are also captive portals, affecting
|
potential downgrade attack. There are also captive portals, affecting
|
||||||
`DNSOverTLS`. Both take `true` or `false` or their own special option,
|
`DNSOverTLS`. Both take `yes` or `no` or their own special option,
|
||||||
for DNNSEC the `allow-downgrade`, for DNSOverTLS `opportunistic`.
|
for DNNSEC the `allow-downgrade`, for DNSOverTLS `opportunistic`.
|
||||||
|
|
||||||
Other links I have found important and my files are based on:
|
Other links I have found important and my files are based on:
|
||||||
|
|
|
||||||
|
|
@ -1,14 +0,0 @@
|
||||||
# AdGuard / systemd-resolved. For people who don't panic when DoT doesn't
|
|
||||||
# work and captive portals attack? See README.md. Also requires not
|
|
||||||
# panicking if tbe user needs something AdGuard is blocking.
|
|
||||||
[Resolve]
|
|
||||||
DNS=2a10:50c0::ad1:ff#dns.adguard.com 94.140.14.14#dns.adguard.com 2a10:50c0::ad2:ff#dns.adguard.com 94.140.15.15#dns.adguard.com
|
|
||||||
Domains=~.
|
|
||||||
# non-tech friendliness in case system down for ages. Also DNSSEC ensures
|
|
||||||
# the DNS server isn't lying which is a task of adblocking DNS server...
|
|
||||||
DNSSEC=false
|
|
||||||
# There is no point of disabling this with adblocking DNS
|
|
||||||
DNSOverTLS=true
|
|
||||||
Cache=true
|
|
||||||
|
|
||||||
# Updated for https://adguard.com/en/blog/adguard-dns-new-addresses.html
|
|
||||||
|
|
@ -1,8 +0,0 @@
|
||||||
# Cloudflare / systemd-resolved. For people who don't panic when DNSSEC or
|
|
||||||
# DoT doesn't work and captive portals attack? See README.md
|
|
||||||
[Resolve]
|
|
||||||
DNS=2606:4700:4700::1111#cloudflare-dns.com 1.0.0.1#cloudflare-dns.com 2606:4700:4700::1001#cloudflare-dns.com 1.1.1.1#cloudflare-dns.com
|
|
||||||
Domains=~.
|
|
||||||
DNSSEC=true
|
|
||||||
DNSOverTLS=true
|
|
||||||
Cache=true
|
|
||||||
|
|
@ -0,0 +1,7 @@
|
||||||
|
[Resolve]
|
||||||
|
DNS=2a10:50c0::ad1:ff#dns.adguard.com 94.140.14.14#dns.adguard.com 2a10:50c0::ad2:ff#dns.adguard.com 94.140.15.15#dns.adguard.com
|
||||||
|
Domains=~.
|
||||||
|
DNSOverTLS=yes
|
||||||
|
Cache=yes
|
||||||
|
|
||||||
|
# Updated for https://adguard.com/en/blog/adguard-dns-new-addresses.html
|
||||||
|
|
@ -0,0 +1,5 @@
|
||||||
|
[Resolve]
|
||||||
|
DNS=2606:4700:4700::1111#cloudflare-dns.com 1.0.0.1#cloudflare-dns.com 2606:4700:4700::1001#cloudflare-dns.com 1.1.1.1#cloudflare-dns.com
|
||||||
|
Domains=~.
|
||||||
|
DNSOverTLS=yes
|
||||||
|
Cache=yes
|
||||||
|
|
@ -1,8 +0,0 @@
|
||||||
[Resolve]
|
|
||||||
DNS=2a07:e340::3#adblock.doh.mullvad.net 194.242.2.3#adblock.doh.mullvad.net 193.19.108.3#adblock.doh.mullvad.net
|
|
||||||
Domains=~.
|
|
||||||
# non-tech friendliness in case system down for ages. Also DNSSEC ensures
|
|
||||||
# the DNS server isn't lying which is a task of adblocking DNS server...
|
|
||||||
DNSSEC=false
|
|
||||||
DNSOverTLS=true
|
|
||||||
Cache=true
|
|
||||||
|
|
@ -0,0 +1,5 @@
|
||||||
|
[Resolve]
|
||||||
|
DNS=2a07:e340::3#adblock.doh.mullvad.net 194.242.2.3#adblock.doh.mullvad.net 193.19.108.3#adblock.doh.mullvad.net
|
||||||
|
Domains=~.
|
||||||
|
DNSOverTLS=yes
|
||||||
|
Cache=yes
|
||||||
|
|
@ -1,6 +1,5 @@
|
||||||
[Resolve]
|
[Resolve]
|
||||||
DNS=2a07:e340::2#doh.mullvad.net 194.242.2.2#doh.mullvad.net 193.19.108.2#doh.mullvad.net
|
DNS=2a07:e340::2#doh.mullvad.net 194.242.2.2#doh.mullvad.net 193.19.108.2#doh.mullvad.net
|
||||||
Domains=~.
|
Domains=~.
|
||||||
DNSSEC=true
|
DNSOverTLS=yes
|
||||||
DNSOverTLS=true
|
Cache=yes
|
||||||
Cache=true
|
|
||||||
|
|
@ -1,7 +1,5 @@
|
||||||
# NextDNS / systemd-resolved. For non-tech people? See README.md
|
|
||||||
[Resolve]
|
[Resolve]
|
||||||
2a07:a8c0::#dns.nextdns.io 2a07:a8c1::#dns.nextdns.io 45.90.28.0#dns.nextdns.io 45.90.30.0#dns.nextdns.io
|
2a07:a8c0::#dns.nextdns.io 2a07:a8c1::#dns.nextdns.io 45.90.28.0#dns.nextdns.io 45.90.30.0#dns.nextdns.io
|
||||||
Domains=~.
|
Domains=~.
|
||||||
DNSSEC=allow-downgrade
|
DNSOverTLS=yes
|
||||||
DNSOverTLS=opportunistic
|
Cache=yes
|
||||||
Cache=true
|
|
||||||
|
|
@ -0,0 +1,5 @@
|
||||||
|
[Resolve]
|
||||||
|
DNS=2620:fe::11#dns11.quad9.net 149.112.112.11#dns11.quad9.net 2620:fe::fe:11#dns11.quad9.net 9.9.9.11#dns11.quad9.net
|
||||||
|
Domains=~.
|
||||||
|
DNSOverTLS=yes
|
||||||
|
Cache=yes
|
||||||
|
|
@ -1,7 +1,5 @@
|
||||||
# Quad9 / systemd-resolved. For non-tech people? See README.md
|
|
||||||
[Resolve]
|
[Resolve]
|
||||||
DNS=2620:fe::9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 9.9.9.9#dns.quad9.net
|
DNS=2620:fe::9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 9.9.9.9#dns.quad9.net
|
||||||
Domains=~.
|
Domains=~.
|
||||||
DNSSEC=allow-downgrade
|
DNSOverTLS=yes
|
||||||
DNSOverTLS=opportunistic
|
Cache=yes
|
||||||
Cache=true
|
|
||||||
|
|
@ -0,0 +1,5 @@
|
||||||
|
[Resolve]
|
||||||
|
DNS=2a01:4f9:2a:1919::9301#fi.dot.dns.snopyta.org 95.216.24.230#fi.dot.dns.snopyta.org
|
||||||
|
Domains=~.
|
||||||
|
DNSOverTLS=yes
|
||||||
|
Cache=yes
|
||||||
|
|
@ -1,8 +0,0 @@
|
||||||
# NextDNS / systemd-resolved. For people who don't panic when DNSSEC or
|
|
||||||
# DoT doesn't work and captive portals attack? See README.md
|
|
||||||
[Resolve]
|
|
||||||
2a07:a8c0::#dns.nextdns.io 2a07:a8c1::#dns.nextdns.io 45.90.28.0#dns.nextdns.io 45.90.30.0#dns.nextdns.io
|
|
||||||
Domains=~.
|
|
||||||
DNSSEC=true
|
|
||||||
DNSOverTLS=true
|
|
||||||
Cache=true
|
|
||||||
|
|
@ -1,7 +0,0 @@
|
||||||
# Quad9 with client subnet / systemd-resolved. For non-tech people? See README.md
|
|
||||||
[Resolve]
|
|
||||||
DNS=2620:fe::11#dns11.quad9.net 149.112.112.11#dns11.quad9.net 2620:fe::fe:11#dns11.quad9.net 9.9.9.11#dns11.quad9.net
|
|
||||||
Domains=~.
|
|
||||||
DNSSEC=allow-downgrade
|
|
||||||
DNSOverTLS=opportunistic
|
|
||||||
Cache=true
|
|
||||||
|
|
@ -1,8 +0,0 @@
|
||||||
# Quad9 with client subnet / systemd-resolved. For people who don't panic when DNSSEC or
|
|
||||||
# DoT doesn't work and captive portals attack? See README.md
|
|
||||||
[Resolve]
|
|
||||||
DNS=2620:fe::11#dns11.quad9.net 149.112.112.11#dns11.quad9.net 2620:fe::fe:11#dns11.quad9.net 9.9.9.11#dns11.quad9.net
|
|
||||||
Domains=~.
|
|
||||||
DNSSEC=true
|
|
||||||
DNSOverTLS=true
|
|
||||||
Cache=true
|
|
||||||
|
|
@ -1,8 +0,0 @@
|
||||||
# Quad9 / systemd-resolved. For people who don't panic when DNSSEC or
|
|
||||||
# DoT doesn't work and captive portals attack? See README.md
|
|
||||||
[Resolve]
|
|
||||||
DNS=2620:fe::9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 9.9.9.9#dns.quad9.net
|
|
||||||
Domains=~.
|
|
||||||
DNSSEC=true
|
|
||||||
DNSOverTLS=true
|
|
||||||
Cache=true
|
|
||||||
|
|
@ -1,8 +0,0 @@
|
||||||
# Snopyta / systemd-resolved. For people who don't panic when DNSSEC or
|
|
||||||
# DoT doesn't work and captive portals attack? See README.md
|
|
||||||
[Resolve]
|
|
||||||
DNS=2a01:4f9:2a:1919::9301#fi.dot.dns.snopyta.org 95.216.24.230#fi.dot.dns.snopyta.org
|
|
||||||
Domains=~.
|
|
||||||
DNSSEC=true
|
|
||||||
DNSOverTLS=true
|
|
||||||
Cache=true
|
|
||||||
|
|
@ -3,9 +3,9 @@
|
||||||
DNS=127.0.0.1
|
DNS=127.0.0.1
|
||||||
DNS=::1
|
DNS=::1
|
||||||
Domains=~.
|
Domains=~.
|
||||||
# Done better by Unbound, no failed-auxillary
|
# Done better by Unbound
|
||||||
DNSSEC=false
|
DNSSEC=no
|
||||||
# Not needed on localhost
|
# Not needed on localhost
|
||||||
DNSOverTLS=false
|
DNSOverTLS=no
|
||||||
# Done by Unbound
|
# Done by Unbound
|
||||||
Cache=false
|
Cache=no
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue