{"id":99198,"date":"2021-02-19T10:22:43","date_gmt":"2021-02-19T08:22:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-dns-server-bind-dobavlena-eksperimentalnaya-podderzhka-dns-over-https"},"modified":"2021-02-19T10:22:43","modified_gmt":"2021-02-19T08:22:43","slug":"v-dns-server-bind-dobavlena-eksperimentalnaya-podderzhka-dns-over-https","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/v-dns-server-bind-dobavlena-eksperimentalnaya-podderzhka-dns-over-https","title":{"rendered":"Do DNS serveru BIND byla p\u0159id\u00e1na experiment\u00e1ln\u00ed podpora DNS-over-HTTPS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdvoj\u00e1\u0159i DNS serveru BIND ozn\u00e1mili, \u017ee do experiment\u00e1ln\u00ed v\u011btve 9.17 p\u0159idali implementaci serverov\u00e9 podpory technologi\u00ed \u201eDNS p\u0159es HTTPS\u201c (DoH, DNS over HTTPS) a DNS p\u0159es TLS (DoT, DNS over TLS), stejn\u011b jako Mechanismus XFR-over-TLS pro bezpe\u010dn\u00fd p\u0159enos obsahu DNS z\u00f3n mezi servery. DoH je k dispozici pro testov\u00e1n\u00ed ve verzi 9.17.10, zat\u00edmco podpora DoT je k dispozici od verze 9.17.7. Po stabilizaci bude podpora DoT a DoH p\u0159evedena do stabiln\u00ed v\u011btve 9.16. <\/p>\n

Implementace protokolu HTTP\/2 pou\u017e\u00edvan\u00e9ho v DoH je zalo\u017eena na aplikaci knihovny nghttp2, kter\u00e1 je za\u0159azena mezi z\u00e1vislosti pro sestaven\u00ed (v budoucnu se pl\u00e1nuje p\u0159ev\u00e9st knihovnu na voliteln\u00e9 z\u00e1vislosti). Podporuj\u00ed se jak \u0161ifrovan\u00e1 (TLS), tak nezabezpe\u010den\u00e1 spojen\u00ed p\u0159es HTTP\/2. P\u0159i p\u0159\u00edslu\u0161n\u00e9m nastaven\u00ed nyn\u00ed m\u016f\u017ee jeden proces named obsluhovat nejen tradi\u010dn\u00ed DNS dotazy, ale tak\u00e9 dotazy pos\u00edlan\u00e9 pomoc\u00ed DoH (DNS-over-HTTPS) a DoT (DNS-over-TLS). Podpora HTTPS na klientsk\u00e9 stran\u011b (dig) zat\u00edm nen\u00ed implementov\u00e1na. Podpora XFR-over-TLS je dostupn\u00e1 jak pro p\u0159\u00edchoz\u00ed, tak pro odchoz\u00ed dotazy. <\/p>\n

Zpracov\u00e1n\u00ed po\u017eadavk\u016f pomoc\u00ed DoH a DoT se aktivuje p\u0159id\u00e1n\u00edm mo\u017enost\u00ed http a tls do direktivy listen-on. Pro podporu neza\u0161ifrovan\u00e9ho DNS-over-HTTP je t\u0159eba v nastaven\u00ed uv\u00e9st \u201etls none\u201c. Kl\u00ed\u010de jsou definov\u00e1ny v sekci \u201etls\u201c. Standardn\u00ed s\u00ed\u0165ov\u00e9 porty 853 pro DoT, 443 pro DoH a 80 pro DNS-over-HTTP mohou b\u00fdt p\u0159eps\u00e1ny prost\u0159ednictv\u00edm parametr\u016f tls-port, https-port a http-port. Nap\u0159\u00edklad: \n tls local-tls { \n key-file \"\/path\/to\/priv_key.pem\"; \n cert-file \"\/path\/to\/cert_chain.pem\"; \n }; \n http local-http-server { \n endpoints { \"\/dns-query\"; \n }; \n options { \n https-port 443; \n listen-on port 443 tls local-tls http myserver {any;}; \n } <\/p>\n

Mezi zvl\u00e1\u0161tnosti implementace DoH v BIND pat\u0159\u00ed integrace jako spole\u010dn\u00e9ho transportu, kter\u00fd m\u016f\u017ee b\u00fdt pou\u017eit nejen pro zpracov\u00e1n\u00ed po\u017eadavk\u016f klient\u016f sm\u011brem k resolveru, ale tak\u00e9 p\u0159i v\u00fdm\u011bn\u011b dat mezi servery, p\u0159i p\u0159enosu z\u00f3n autoritativn\u00edm DNS serverem a p\u0159i zpracov\u00e1n\u00ed jak\u00fdchkoliv dotaz\u016f podporovan\u00fdch jin\u00fdmi transporty DNS. <\/p>\n

Dal\u0161\u00ed vlastnost\u00ed je mo\u017enost p\u0159esunut\u00ed \u0161ifrovac\u00edch operac\u00ed pro TLS na jin\u00fd server, co\u017e m\u016f\u017ee b\u00fdt nezbytn\u00e9 v situac\u00edch, kdy jsou TLS certifik\u00e1ty ulo\u017eeny na jin\u00e9m syst\u00e9mu (nap\u0159\u00edklad v infrastruktu\u0159e s webov\u00fdmi servery) a jsou spravov\u00e1ny jin\u00fdm person\u00e1lem. Podpora neza\u0161ifrovan\u00e9ho DNS-over-HTTP byla implementov\u00e1na pro usnadn\u011bn\u00ed lad\u011bn\u00ed a jako \u00farove\u0148 pro p\u0159esm\u011brov\u00e1n\u00ed v intern\u00ed s\u00edti, na jej\u00edm\u017e z\u00e1klad\u011b m\u016f\u017ee b\u00fdt na jin\u00e9m serveru zorganizov\u00e1no \u0161ifrov\u00e1n\u00ed. Na extern\u00edm serveru pro generov\u00e1n\u00ed TLS provozu m\u016f\u017ee b\u00fdt vyu\u017eit nginx, podobn\u011b jako je organizov\u00e1no obalov\u00e1n\u00ed HTTPS pro webov\u00e9 str\u00e1nky. <\/p>\n

P\u0159ipom\u00edn\u00e1me, \u017ee DNS-over-HTTPS m\u016f\u017ee b\u00fdt u\u017eite\u010dn\u00e9 pro vylou\u010den\u00ed \u00fanik\u016f informac\u00ed o dotazovan\u00fdch n\u00e1zvech hostitel\u016f p\u0159es DNS servery poskytovatel\u016f, pro boj s MITM \u00fatoky a podvodem DNS provozu (nap\u0159\u00edklad p\u0159i p\u0159ipojen\u00ed k ve\u0159ejn\u00fdm Wi-Fi), pro odol\u00e1v\u00e1n\u00ed blokac\u00edm na \u00farovni DNS (DNS-over-HTTPS nem\u016f\u017ee nahradit VPN<\/a> v oblasti obch\u00e1zen\u00ed blokac\u00ed, realizovan\u00fdch na \u00farovni DPI) nebo pro organizaci pr\u00e1ce v p\u0159\u00edpad\u011b nemo\u017enosti p\u0159\u00edm\u00e9ho p\u0159\u00edstupu k DNS server\u016fm (nap\u0159\u00edklad p\u0159i pr\u00e1ci p\u0159es proxy). Pokud jsou v b\u011b\u017en\u00e9 situaci DNS dotazy p\u0159\u00edmo odes\u00edl\u00e1ny na ur\u010dit\u00e9 v konfiguraci syst\u00e9mu DNS servery, pak v p\u0159\u00edpad\u011b DNS-over-HTTPS je po\u017eadavek na ur\u010den\u00ed IP adres<\/a> hostitele enkapsulov\u00e1n v HTTPS provozu a odesl\u00e1n na HTTP server, na n\u011bm\u017e resolver zpracov\u00e1v\u00e1 po\u017eadavky prost\u0159ednictv\u00edm Web API. <\/p>\n

\u201eDNS over TLS\u201c se li\u0161\u00ed od \u201eDNS over HTTPS\u201c pou\u017eit\u00edm standardn\u00edho protokolu DNS (obvykle pou\u017e\u00edv\u00e1 s\u00ed\u0165ov\u00fd port 853), zabalen\u00e9ho do \u0161ifrovan\u00e9ho komunika\u010dn\u00edho kan\u00e1lu, kter\u00fd je vytvo\u0159en pomoc\u00ed protokolu TLS s ov\u011b\u0159en\u00edm hostitele prost\u0159ednictv\u00edm TLS\/SSL certifik\u00e1t\u016f, vydan\u00fdch certifika\u010dn\u00ed autoritou. Existuj\u00edc\u00ed standard DNSSEC pou\u017e\u00edv\u00e1 \u0161ifrov\u00e1n\u00ed pouze pro autentizaci klienta a serveru, ale nechr\u00e1n\u00ed provoz p\u0159ed odposlouch\u00e1v\u00e1n\u00edm a nezaru\u010duje d\u016fv\u011brnost dotaz\u016f.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 BIND \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u0432 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0442\u043a\u0443 9.17 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u043e\u0439 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439 «DNS \u043f\u043e\u0432\u0435\u0440\u0445 HTTPS» (DoH, DNS over HTTPS) \u0438 DNS \u043f\u043e\u0432\u0435\u0440\u0445 TLS (DoT, DNS over TLS), \u0430 \u0442\u0430\u043a\u0436\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 XFR-over-TLS \u0434\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e DNS-\u0437\u043e\u043d \u043c\u0435\u0436\u0434\u0443 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438. DoH \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0434\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 9.17.10, \u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 DoT \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 9.17.7. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99198","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Do DNS-serveru BIND byla p\u0159id\u00e1na experiment\u00e1ln\u00ed podpora DNS-over-HTTPS | ProHoster","description":"V\u00fdvoj\u00e1\u0159i DNS serveru BIND ozn\u00e1mili p\u0159id\u00e1n\u00ed do experiment\u00e1ln\u00ed v\u011btve 9.17 implementace serverov\u00e9 podpory technologi\u00ed \"DNS over HTTPS\" (DoH, DNS p\u0159es HTTPS) a DNS p\u0159es TLS (DoT, DNS over TLS), stejn\u011b jako.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/v-dns-server-bind-dobavlena-eksperimentalnaya-podderzhka-dns-over-https","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 DNS-\u0441\u0435\u0440\u0432\u0435\u0440 BIND \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 DNS-over-HTTPS | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 BIND \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u0432 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0442\u043a\u0443 9.17 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u043e\u0439 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439 "DNS \u043f\u043e\u0432\u0435\u0440\u0445 HTTPS" (DoH, DNS over HTTPS) \u0438 DNS \u043f\u043e\u0432\u0435\u0440\u0445 TLS (DoT, DNS over TLS), \u0430 \u0442\u0430\u043a\u0436\u0435.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/v-dns-server-bind-dobavlena-eksperimentalnaya-podderzhka-dns-over-https","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-02-19T08:22:43+00:00","article:modified_time":"2021-02-19T08:22:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99198","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 09:54:00","updated":"2026-02-08 20:24:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/99198","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=99198"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/99198\/revisions"}],"predecessor-version":[{"id":157870,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/99198\/revisions\/157870"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=99198"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=99198"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=99198"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}