{"id":99198,"date":"2021-02-19T10:22:43","date_gmt":"2021-02-19T08:22:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-dns-server-bind-dobavlena-eksperimentalnaya-podderzhka-dns-over-https"},"modified":"2021-02-19T10:22:43","modified_gmt":"2021-02-19T08:22:43","slug":"v-dns-server-bind-dobavlena-eksperimentalnaya-podderzhka-dns-over-https","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/v-dns-server-bind-dobavlena-eksperimentalnaya-podderzhka-dns-over-https","title":{"rendered":"DNS-server BIND on lisatud katsetuslik tugi DNS-over-HTTPS-ile.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
BIND DNS server developers have announced the addition of server support for the technologies 'DNS over HTTPS' (DoH) and DNS over TLS (DoT) to the experimental branch 9.17, as well as the XFR-over-TLS mechanism for secure DNS zone transfers between servers. DoH is available for testing in release 9.17.10, while DoT support has been present since release 9.17.7. After stabilization, support for DoT and DoH will be backported to the stable branch 9.16. <\/p>\n
HTTP\/2 protokolli teostus, mida kasutatakse DoH\u2019is, p\u00f5hineb raamatukogu nghttp2 kasutamisel, mis on lisatud ehituslike s\u00f5ltuvuste hulka (hiljem plaanitakse raamatukogu viia valikuliste s\u00f5ltuvuste hulka). Toetatakse nii kr\u00fcpteeritud (TLS) kui ka kr\u00fcpteerimata \u00fchendusi HTTP\/2 kaudu. Vastavalt seadistustele v\u00f5ib \u00fcks named protsess n\u00fc\u00fcd teenindada mitte ainult traditsioonilisi DNS-p\u00e4ringuid, vaid ka p\u00e4ringuid, mis saadetakse DoH (DNS-over-HTTPS) ja DoT (DNS-over-TLS) abil. Klientide poolne HTTPS toetus (dig) pole veel teostatud. Toetuseks XFR-over-TLS on saadaval nii sisend- kui ka v\u00e4ljundp\u00e4ringutele. <\/p>\n
Request handling using DoH and DoT is enabled by adding http and tls options in the listen-on directive. To support unencrypted DNS-over-HTTP in the settings, 'tls none' should be specified. Keys are defined in the 'tls' section. The standard network ports 853 for DoT, 443 for DoH, and 80 for DNS-over-HTTP can be overridden via the tls-port, https-port, and http-port parameters. For example: tls local-tls { key-file '\/path\/to\/priv_key.pem'; cert-file '\/path\/to\/cert_chain.pem'; }; http local-http-server { endpoints { '\/dns-query'; }; }; options { https-port 443; listen-on port 443 tls local-tls http myserver {any;}; } <\/p>\n
BIND\u2019i DoH teostuse erip\u00e4ra on integreerimine \u00fcldiseks transpordiks, mida saab kasutada mitte ainult kliendi p\u00e4ringute t\u00f6\u00f6tlemiseks resolvri poole, vaid ka andmevahetuseks serverite vahel, autoriteetse DNS-serveri tsoonide edastamiseks ja k\u00f5igi p\u00e4ringute t\u00f6\u00f6tlemiseks, mida toetavad muud DNS-i transpordid. <\/p>\n
Teise erip\u00e4ra on TLS-kr\u00fcptimise operatsioonide viimine teisele serverile, mis v\u00f5ib olla vajalik olukordades, kus TLS-sertifikaadid on ladustatud teistes s\u00fcsteemides (n\u00e4iteks veebiserverite infrastruktuuris) ja neid haldab teine personal. Tugi kr\u00fcptimata DNS-over-HTTP-le on rakendatud silumise lihtsustamiseks ja sisemise v\u00f5rgu edastamiseks, mille p\u00f5hjal saab teisel serveril organiseerida kr\u00fcptimist. TLS-liikluse genereerimiseks v\u00f5ib v\u00e4listeenuse serveris kasutada nginx'i, nii nagu HTTPS-i sidumise korraldamine veebisaitide jaoks. <\/p>\n