Mikaela/shell-things
1
0
Fork 0
mirror of https://gitea.blesmrt.net/mikaela/shell-things.git synced 2024-11-06 17:39:22 +01:00
Code Issues Projects Releases Wiki Activity
f87c4899b6
shell-things/etc/systemd/resolved.conf.d
History
Aminda Suomalainen 861b35c25f
systemd-resolved: add the other applied-privacy.net port too
2024-04-25 13:47:18 +03:00
..
.gitignore resolved.conf.d: add dot-trex.conf symlink and explaining comments like in unbound 2024-04-21 13:14:53 +03:00
00-defaults.conf systemd-resolved: another attempt at local resolvers 2024-04-25 13:45:37 +03:00
dot-443.conf systemd-resolved: add the other applied-privacy.net port too 2024-04-25 13:47:18 +03:00
dot-adguard.conf systemd-resolved: add vim modelines 2024-04-21 10:58:45 +03:00
dot-cloudflare.conf systemd-resolved: add vim modelines 2024-04-21 10:58:45 +03:00
dot-dns0.conf systemd-resolved: add vim modelines 2024-04-21 10:58:45 +03:00
dot-mullvad.conf systemd-resolved: add vim modelines 2024-04-21 10:58:45 +03:00
dot-quad9.conf resolved.conf.d: add dot-trex.conf symlink and explaining comments like in unbound 2024-04-21 13:14:53 +03:00
dot-trex.conf resolved.conf.d: add dot-trex.conf symlink and explaining comments like in unbound 2024-04-21 13:14:53 +03:00
README.md systemd-resolved: attempt to simplify configuration 2024-04-22 15:08:03 +03:00
zz-local-resolver.conf systemd-resolved: another attempt at local resolvers 2024-04-25 13:45:37 +03:00

README.md

systemd-resolved additional config files

Quickstart

sudo systemctl enable --now systemd-resolved.service
sudo ln -rsf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
# After changing configuration
sudo systemctl restart systemd-resolved

Files explained

  • 00-defaults.conf - configuration that should be used everywhere. Enables DNSSEC (regardless of systemd-resolved not handling it properly), enables opportunistic DoT, caching and local DNS servers (because they should exist anyway as I don’t trust systemd-resolved entirely. Anyway if there truly is no local resolver, systemd-resolved will detect that and act accordingly.)
    • To rephrase, this is to be used together with other files, especially some of those beginning with dot-.
  • dot-*.conf - configuration to use the DNS provider with DNS-over-TLS. At least one of these should be used in addition to 00-defaults.conf
  • README.md - you are reading it right now.

General commentary

  • DNSOverTLS became supported in systemd v239, strict mode (true) in v243 (big improvements in v244).
    • TODO: find out when SNI became supported, I have just spotted it in the fine manual in 2020-06-??.
  • Domains has to be .~ for them to override DHCP. See https://www.internetsociety.org/blog/2018/12/dns-privacy-in-linux-systemd without which I wouldn’t have got this right.
  • DNSSEC may not work if the system is down for a long time and not updated. Thus allow-downgrade may be better for non-tech people, even with the potential downgrade attack. There are also captive portals, affecting DNSOverTLS. Both take true or false or their own special option, for DNSSEC the allow-downgrade, for DNSOverTLS opportunistic.
    • Then again when was any system that outdated to not have working DNSSEC?
      • TODO: return to this configuration should that actually happen?
      • I am actually running Unbound simultaneously with resolv.conf pointing to both with options rotate edns0 trust-ad which might workaround that potential issue.

Other links I have found important and my files are based on: