Mikaela
/
shell-things
mirror of https://gitea.blesmrt.net/mikaela/shell-things.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
shell-things/etc/systemd/resolved.conf.d
History
Aminda Suomalainen e825c1dac3
systemd-resolved: dot-mullvad.conf: update domains, add commented other server options 		2023-11-12 12:51:07 +02:00
..
00-defaults.conf systemd-resolved: keep DNSSEC enabled 2023-10-21 11:27:07 +03:00
README.md systemd-resolved: keep DNSSEC enabled 2023-10-21 11:27:07 +03:00
dns-over-tls.conf systemd-resolved: prefer IPv6 over IPv4 2023-09-10 11:16:57 +03:00
dot-adguard.conf etc/ststemd/resolved…: aggressive cleanup/rewriting 2022-03-28 20:28:17 +03:00
dot-cloudflare.conf etc/ststemd/resolved…: aggressive cleanup/rewriting 2022-03-28 20:28:17 +03:00
dot-dns0-appliedprivacy.conf resolved.conf.d: add dot-dns0-appliedprivacy.conf in style of quad9-ecs-appliedprivacy 2023-10-14 19:18:45 +03:00
dot-dns0-kids.conf systemd-resolved: prefer IPv6 over IPv4 2023-09-10 11:16:57 +03:00
dot-dns0-open.conf systemd-resolved: prefer IPv6 over IPv4 2023-09-10 11:16:57 +03:00
dot-dns0-zero.conf systemd-resolved: prefer IPv6 over IPv4 2023-09-10 11:16:57 +03:00
dot-dns0.conf systemd-resolved: prefer IPv6 over IPv4 2023-09-10 11:16:57 +03:00
dot-mullvad.conf systemd-resolved: dot-mullvad.conf: update domains, add commented other server options 2023-11-12 12:51:07 +02:00
dot-nextdns.conf etc/ststemd/resolved…: aggressive cleanup/rewriting 2022-03-28 20:28:17 +03:00
dot-quad9-ecs-appliedprivacy.conf resolved: add dot-quad9-ecs-appliedprivacy.conf for Steam Deck purposes 2023-10-01 19:06:46 +03:00
dot-quad9-ecs.conf etc/ststemd/resolved…: aggressive cleanup/rewriting 2022-03-28 20:28:17 +03:00
dot-quad9.conf etc/ststemd/resolved…: aggressive cleanup/rewriting 2022-03-28 20:28:17 +03:00
dot-snopyta.conf etc/ststemd/resolved…: aggressive cleanup/rewriting 2022-03-28 20:28:17 +03:00
unbound.conf systemd-resolved: keep DNSSEC enabled 2023-10-21 11:27:07 +03:00

README.md

systemd-resolved additional config files

Quickstart

sudo systemctl enable --now systemd-resolved.service
sudo ln -rsf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
# After changing configuration
sudo systemctl restart systemd-resolved

Files explained

  • 00-defaults.conf - configuration not touching resolvers. Enables DNSSEC (regardless of systemd-resolved not handling it properly), enables opportunistic DoT and caching.
  • dot-*.conf - configuration to use the DNS provider with DNS-over-TLS. If captive portals are a concern, DNSOverTLS=no.
  • README.md - you are reading it right now.

General commentary

  • Based on my test DNSOverTLS is not supported in Ubuntu 18.04.x LTS (however at the time of writing this README.md, the current version is Ubuntu 20.04.0) (systemd v237). DNSOverTLS became supported in v239, strict mode (yes) in v243 (big improvements in v244).
    • TODO: find out when SNI became supported, I have just spotted it in the fine manual in 2020-06-??.
  • Domains has to be .~ for them to override DHCP. See https://www.internetsociety.org/blog/2018/12/dns-privacy-in-linux-systemd without which I wouldn’t have got this right.
  • DNSSEC may not work if the system is down for a long time and not updated. Thus allow-downgrade may be better for non-tech people, even with the potential downgrade attack. There are also captive portals, affecting DNSOverTLS. Both take yes or no or their own special option, for DNNSEC the allow-downgrade, for DNSOverTLS opportunistic.
    • Then again when was any system that outdated to not have working DNSSEC?
      • TODO: return to this configuration should that actually happen?

Other links I have found important and my files are based on: