{"id":37892,"date":"2019-10-31T22:20:24","date_gmt":"2019-10-31T19:20:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox\/"},"modified":"2019-10-31T22:20:24","modified_gmt":"2019-10-31T19:20:24","slug":"mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","title":{"rendered":"Mozilla alustab vaikimisi DNS-over-HTTPS'i aktiveerimist Firefoxis","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Firefoxi arendajad et neil on alles ainult kaks plokki \/8.<\/a><\/noindex> teatas, et nad l\u00f5petavad DNSi \u00fcle HTTPS (DoH, DNS over HTTPS) toe testimise ja kavatsevad septembri l\u00f5pus selle tehnoloogia vaikimisi kasutusele v\u00f5tmiseks USA kasutajatele. Aktiveerimine toimub j\u00e4rk-j\u00e4rgult, alguses m\u00f5ne protsendi kasutajate hulgas ning probleemide puudumisel suurendatakse see 100%-ni. P\u00e4rast USA katmist kaalutakse DoH'i aktiveerimist ka teistes riikides.<\/p>\n

Aasta jooksul tehtud testid on n\u00e4idanud teenuse usaldusv\u00e4\u00e4rsust ja head j\u00f5udlust ning on samuti v\u00f5imaldanud tuvastada teatud olukordi, kus DoH v\u00f5ib probleeme p\u00f5hjustada ning t\u00f6\u00f6tada v\u00e4lja lahendusi nende \u00fcletamiseks (n\u00e4iteks on k\u00e4sitletud probleemile<\/a><\/noindex> liiklust optimeerimist sisu edastamise v\u00f5rkudes, vanemlikku kontrolli ja sisemisi ettev\u00f5tte DNS-zonasid). <\/p>\n

DNS-i liikluse kr\u00fcpteerimise t\u00e4htsust peetakse kasutajate kaitse seisukohalt h\u00e4davajalikuks, seet\u00f5ttu on otsustatud DoH vaikimisi aktiveerida, kuid esialgu ainult USA kasutajatele. DoH'i aktiveerimise j\u00e4rel kuvatakse kasutajale hoiatus, mis v\u00f5imaldab vajadusel keelduda kesksete DoH DNS-serveritega \u00fchendusest ja tagasi p\u00f6\u00f6rduda traditsiooniliste kr\u00fcpteerimata DNS-p\u00e4ringute edastamise skeemi juurde (DoH-is kasutatakse m\u00e4\u00e4ratlemist kindla DoH-teenusega, mis v\u00f5ib tunduda \u00fche punktina, kus v\u00f5ib s\u00fcndida t\u00f5rgete korral).<\/p>\n

DoH'i aktiveerimise korral v\u00f5ib see kahjustada vanemlikku kontrolli ja ettev\u00f5tte v\u00f5rgus\u00fcsteemide t\u00f6\u00f6d, mis kasutavad ainult sisemise v\u00f5rgu DNS-nimede struktuuri intraneti aadresside ja ettev\u00f5tte hostide lahendamiseks. Selliste s\u00fcsteemide probleemide lahendamiseks on lisatud kontrollis\u00fcsteem, mis keelab automaatselt DoH. Kontrollid viiakse l\u00e4bi iga brauseri k\u00e4ivitamise v\u00f5i alamv\u00f5rgu muutmise m\u00e4\u00e4ratlemisel.<\/p>\n

Automaatne naasmine operatsioonis\u00fcsteemi tavalise resolveri kasutamisele on samuti ette n\u00e4htud, kui esinevad probleemid DoH kaudu ressursside lahendamisel (n\u00e4iteks, kui esineb v\u00f5rgu\u00fchenduse katkemine DoH teenusepakkujaga v\u00f5i t\u00f5rkeid tema infrastruktuuris). Selliste kontrollide m\u00f5te on k\u00fcsitav, kuna pole midagi, mis takistaks r\u00fcndajatel, kes kontrollivad resolveri t\u00f6\u00f6d v\u00f5i saavad sekkuda liiklusesse, simuleerida sarnast k\u00e4itumist DNS-i liikluse kr\u00fcpteerimise keelamiseks. Probleem on lahendatud lisades seadistustesse punkti 'DoH alati' (vaikimisi mitte aktiivne), mille seadmisel automaatne v\u00e4ljal\u00fclitamine ei kehti, mis on m\u00f5istlik kompromiss.<\/p>\n

Ettev\u00f5tte resolverite m\u00e4\u00e4ramiseks viiakse l\u00e4bi ebat\u00fc\u00fcpiliste \u00fclitaseme domeenide (TLD) kontrollimine ja intraneti aadresside tagastamine s\u00fcsteemi resolveri kaudu. Vanemliku kontrolli rakendamise m\u00e4\u00e4ramiseks tehakse katse resolverida nime exampleadultsite.com, ja kui tulemus ei \u00fchti tegeliku IP-aadressiga, peetakse seda t\u00f5endiks, et DNS-i tasemel on keeld t\u00e4iskasvanutele suunatud sisu osas aktiivne. T\u00e4iendavalt kontrollitakse ka Google'i ja YouTube'i IP-aadresse, et tuvastada nende asendamine aadressidega restrict.youtube.com, forcesafesearch.google.com ja restrictmoderate.youtube.com. Lisaks Mozilla pakub<\/a><\/noindex> dona \u00fche kontrollema host use-application-dns.net<\/a><\/noindex>, mida saavad kasutada internetiteenusepakkujad ja vanemliku kontrolli teenused DoH v\u00e4lja l\u00fclitamise m\u00e4rgiks (kui hosti ei m\u00e4\u00e4rata, keelab Firefox DoH).<\/p>\n

T\u00f6\u00f6tamine \u00fcheaegselt DoH-teenuse kaudu v\u00f5ib potentsiaalselt tekitada probleeme sisu edastamise v\u00f5rkudes (CDN), mis teostavad liikluse tasakaalustamist DNS-i kaudu (CDN-v\u00f5rgu DNS-server koostab vastuse, arvestades resolveri aadressi ja edastab l\u00e4hima hosti sisu saamiseks). DNS-p\u00e4ringu saatmine kasutajale l\u00e4himast resolverist toob CDN-is tagasi l\u00e4hima hosti aadressi, kuid keskse resolveri kaudu DNS-p\u00e4ringu saatmine annab DNS-over-HTTPS-serverile l\u00e4hima hosti aadressi. Praktilised testid n\u00e4itasid, et DNS-over-HTTP rakendamine CDN-ide kasutamisel ei p\u00f5hjustanud peaaegu viivitusi sisu edastamise alguses (kiirete \u00fchenduste korral ei \u00fcletanud viivitused 10 millisekundit ning aeglasemate sidekanalite puhul t\u00e4heldati isegi kiiruskasv). CDN-i resolverile kliendi asukoha edastamiseks kaaluti ka EDNS Client Subnet laienduse kasutamist.<\/p>\n

Tuletame meelde, et DoH v\u00f5ib olla kasulik, et v\u00e4ltida DNS-serverite kaudu teenusepakkujatelt saadud hostinimede lekkeid, kaitsta MITM-r\u00fcnnakute ja DNS-i liikluse h\u00e4irimise eest, vastanduda DNS-tasandi blokeeringutele v\u00f5i korraldada t\u00f6\u00f6d juhul, kui otsene juurdep\u00e4\u00e4s DNS-serveritele pole v\u00f5imalik (n\u00e4iteks proxy kaudu t\u00f6\u00f6tades). Kui tavaliselt saadetakse DNS-i p\u00e4ringud otse s\u00fcsteemi konfigureeritud DNS-serveritele, siis DoH-i puhul kapseldatakse hosti IP-aadressi m\u00e4\u00e4ramise p\u00e4ring HTTPS-i liiklusesse ja saadetakse HTTP-serverisse, kus resolver t\u00f6\u00f6tleb p\u00e4ringud l\u00e4bi Web API. Praegune standard DNSSEC kasutab kr\u00fcptimist vaid kliendi ja serveri autentimiseks, kuid ei kaitse liiklust pealtkuulamise eest ega garanteeri p\u00e4ringute privaatsust. <\/p>\n

DoH aktiveerimiseks tuleb about:config-is muuta muutuja network.trr.mode v\u00e4\u00e4rtust, mis on toetatud alates Firefox 60-st. V\u00e4\u00e4rtus 0 keelab t\u00e4ielikult DoH; 1 — kasutatakse DNS-i v\u00f5i DoH-d, s\u00f5ltuvalt sellest, kumb on kiirem; 2 — kasutatakse vaikimisi DoH-d ja DNS-i tagavarana; 3 — kasutatakse ainult DoH-d; 4 — peegeldusre\u017eiim, kus DoH ja DNS on paralleelselt tegevuses. Vaikimisi kasutatakse CloudFlare'i DNS-serverit, kuid seda saab muuta parameetri network.trr.uri kaudu, n\u00e4iteks saab seadistada «https:\/\/dns.google.com\/experimental» v\u00f5i «https:\/\/9.9.9.9\/dns-query».<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Firefox \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 DNS \u043f\u043e\u0432\u0435\u0440\u0445 HTTPS (DoH, DNS over HTTPS) \u0438 \u043d\u0430\u043c\u0435\u0440\u0435\u043d\u0438\u0438 \u0432 \u043a\u043e\u043d\u0446\u0435 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0434\u0430\u043d\u043d\u0443\u044e \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0421\u0428\u0410. \u0412\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0431\u0443\u0434\u0435\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0441\u0442\u0443\u043f\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0432\u043d\u0430\u0447\u0430\u043b\u0435 \u0434\u043b\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u043d\u0442\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0430 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u043f\u043e\u0441\u0442\u0435\u043f\u0435\u043d\u043d\u043e \u0434\u043e\u0432\u043e\u0434\u044f \u0434\u043e 100%. \u041f\u043e\u0441\u043b\u0435 \u043e\u0445\u0432\u0430\u0442\u0430 \u0421\u0428\u0410 \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f DoH \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37892","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mozilla kavatseb vaikimisi aktiveerida DNS-over-HTTPS Firefoxis | ProHoster","description":"Firefoxi arendajad kuulutasid v\u00e4lja testimise l\u00f5petamise toetuse osas.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Mozilla \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u0442 \u043a \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e DNS-over-HTTPS \u0432 Firefox | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Firefox \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:20:24+00:00","article:modified_time":"2019-10-31T19:20:24+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37892","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 19:39:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:39:22","updated":"2026-01-23 19:39:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/37892","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=37892"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/37892\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=37892"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=37892"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=37892"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}