{"id":99198,"date":"2021-02-19T10:22:43","date_gmt":"2021-02-19T08:22:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-dns-server-bind-dobavlena-eksperimentalnaya-podderzhka-dns-over-https"},"modified":"2021-02-19T10:22:43","modified_gmt":"2021-02-19T08:22:43","slug":"v-dns-server-bind-dobavlena-eksperimentalnaya-podderzhka-dns-over-https","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/v-dns-server-bind-dobavlena-eksperimentalnaya-podderzhka-dns-over-https","title":{"rendered":"W serwerze DNS BIND dodano eksperymentalne wsparcie dla DNS-over-HTTPS.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 BIND \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u0432 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0442\u043a\u0443 9.17 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u043e\u0439 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439 «DNS \u043f\u043e\u0432\u0435\u0440\u0445 HTTPS» (DoH, DNS over HTTPS) \u0438 DNS \u043f\u043e\u0432\u0435\u0440\u0445 TLS (DoT, DNS over TLS), \u0430 \u0442\u0430\u043a\u0436\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 XFR-over-TLS \u0434\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e DNS-\u0437\u043e\u043d \u043c\u0435\u0436\u0434\u0443 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438. DoH \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0434\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 9.17.10, \u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 DoT \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 9.17.7. \u041f\u043e\u0441\u043b\u0435 \u0441\u0442\u0430\u0431\u0438\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 DoT \u0438 DoH \u0431\u0443\u0434\u0435\u0442 \u0431\u044d\u043a\u043f\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0442\u043a\u0443 9.16. <\/p>\n

Implementacja protoko\u0142u HTTP\/2, u\u017cywanego w DoH, opiera si\u0119 na bibliotece nghttp2, kt\u00f3ra jest wliczona w sk\u0142ad zale\u017cno\u015bci budowy (w przysz\u0142o\u015bci planuje si\u0119 przekszta\u0142cenie tej biblioteki w zale\u017cno\u015b\u0107 opcjonaln\u0105). Obs\u0142ugiwane s\u0105 zar\u00f3wno szyfrowane (TLS), jak i nieszyfrowane po\u0142\u0105czenia przez HTTP\/2. Przy odpowiednich ustawieniach, jeden proces named mo\u017ce teraz obs\u0142ugiwa\u0107 nie tylko tradycyjne zapytania DNS, ale tak\u017ce zapytania wysy\u0142ane z u\u017cyciem DoH (DNS-over-HTTPS) i DoT (DNS-over-TLS). Wsparcie HTTPS po stronie klienta (dig) wci\u0105\u017c nie zosta\u0142o wdro\u017cone. Obs\u0142uga XFR-over-TLS jest dost\u0119pna zar\u00f3wno dla zapyta\u0144 przychodz\u0105cych, jak i wychodz\u0105cych. <\/p>\n

\u041e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0430 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c DoH \u0438 DoT \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u043f\u0446\u0438\u0439 http \u0438 tls \u0432 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u0435 listen-on. \u0414\u043b\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043d\u0435\u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e DNS-over-HTTP \u0432 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0443\u043a\u0430\u0437\u0430\u0442\u044c «tls none». \u041a\u043b\u044e\u0447\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0442\u0441\u044f \u0432 \u0441\u0435\u043a\u0446\u0438\u0438 «tls». \u0421\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u0440\u0442\u044b 853 \u0434\u043b\u044f DoT, 443 \u0434\u043b\u044f DoH \u0438 80 \u0434\u043b\u044f DNS-over-HTTP \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043f\u0435\u0440\u0435\u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u044b \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b tls-port, https-port \u0438 http-port. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440: tls local-tls { key-file «\/path\/to\/priv_key.pem»; cert-file «\/path\/to\/cert_chain.pem»; }; http local-http-server { endpoints { «\/dns-query»; }; }; options { https-port 443; listen-on port 443 tls local-tls http myserver {any;}; } <\/p>\n

W\u015br\u00f3d cech implementacji DoH w BIND zaznacza si\u0119 integracja jako wsp\u00f3lny transport, kt\u00f3ry mo\u017ce by\u0107 u\u017cywany nie tylko do obs\u0142ugi zapyta\u0144 klient\u00f3w do resolvera, ale tak\u017ce przy wymianie danych mi\u0119dzy serwerami, podczas przesy\u0142ania stref przez autorytatywny serwer DNS oraz przy obs\u0142udze wszelkich zapyta\u0144 wspieranych przez inne transporty DNS. <\/p>\n

Inn\u0105 cech\u0105 jest mo\u017cliwo\u015b\u0107 przeniesienia operacji szyfrowania dla TLS na inny serwer, co mo\u017ce by\u0107 konieczne w sytuacjach, gdy certyfikaty TLS s\u0105 przechowywane na innej systemie (na przyk\u0142ad w infrastrukturze z serwerami webowymi) i s\u0105 obs\u0142ugiwane przez inny personel. Wsparcie dla nieszyfrowanego DNS-over-HTTP zosta\u0142o wdro\u017cone w celu uproszczenia debugowania i jako poziom do przechwytywania w sieci wewn\u0119trznej, na podstawie kt\u00f3rego na innym serwerze mo\u017ce by\u0107 zorganizowane szyfrowanie. Na zdalnym serwerze do generowania ruchu TLS mo\u017cna u\u017cywa\u0107 nginx, podobnie jak w przypadku organizacji obudowy HTTPS dla stron. <\/p>\n

Przypomnijmy, \u017ce DNS-over-HTTPS mo\u017ce okaza\u0107 si\u0119 pomocne w eliminowaniu wyciek\u00f3w informacji o \u017c\u0105danych nazwach host\u00f3w przez serwery DNS dostawc\u00f3w, w walce z atakami MITM oraz podmian\u0105 ruchu DNS (na przyk\u0142ad podczas pod\u0142\u0105czania si\u0119 do publicznych Wi-Fi), w przeciwdzia\u0142aniu blokadom na poziomie DNS (DNS-over-HTTPS nie mo\u017ce zast\u0105pi\u0107 VPN<\/a> w zakresie omijania blokad, zrealizowanych na poziomie DPI) lub dla organizacji pracy w przypadku braku mo\u017cliwo\u015bci bezpo\u015bredniego kontaktu z serwerami DNS (na przyk\u0142ad podczas pracy przez proxy). Je\u015bli w normalnej sytuacji zapytania DNS s\u0105 bezpo\u015brednio wysy\u0142ane do okre\u015blonych w konfiguracji systemu serwer\u00f3w DNS, to w przypadku DNS-over-HTTPS zapytanie dotycz\u0105ce adresy IP<\/a> hosta jest inkapsulowane w ruchu HTTPS i wysy\u0142ane na serwer HTTP, na kt\u00f3rym resolver przetwarza zapytania przez Web API. <\/p>\n

\u201eDNS przez TLS\u201d r\u00f3\u017cni si\u0119 od \u201eDNS przez HTTPS\u201d zastosowaniem standardowego protoko\u0142u DNS (zwykle u\u017cywa portu sieciowego 853), opakowanego w zaszyfrowany kana\u0142 komunikacyjny, utworzony przy pomocy protoko\u0142u TLS z weryfikacj\u0105 to\u017csamo\u015bci hosta przez certyfikaty TLS\/SSL, zatwierdzone przez centrum certyfikacji. Istniej\u0105cy standard DNSSEC wykorzystuje szyfrowanie jedynie do uwierzytelnienia klienta i serwera, ale nie chroni ruchu przed przechwyceniem i nie gwarantuje poufno\u015bci zapyta\u0144.
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 BIND \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u0432 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0442\u043a\u0443 9.17 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u043e\u0439 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439 «DNS \u043f\u043e\u0432\u0435\u0440\u0445 HTTPS» (DoH, DNS over HTTPS) \u0438 DNS \u043f\u043e\u0432\u0435\u0440\u0445 TLS (DoT, DNS over TLS), \u0430 \u0442\u0430\u043a\u0436\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 XFR-over-TLS \u0434\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e DNS-\u0437\u043e\u043d \u043c\u0435\u0436\u0434\u0443 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438. DoH \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0434\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 9.17.10, \u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 DoT \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 9.17.7. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99198","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Do serwera DNS BIND dodano eksperymentalne wsparcie dla DNS-over-HTTPS | ProHoster","description":"Deweloperzy serwera DNS BIND poinformowali o dodaniu do eksperymentalnej ga\u0142\u0119zi 9.17 realizacji wsparcia serwera dla technologii \u201eDNS over HTTPS\u201d (DoH, DNS over HTTPS) oraz DNS over TLS (DoT, DNS over TLS), a tak\u017ce.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/v-dns-server-bind-dobavlena-eksperimentalnaya-podderzhka-dns-over-https","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 DNS-\u0441\u0435\u0440\u0432\u0435\u0440 BIND \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 DNS-over-HTTPS | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 BIND \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u0432 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0442\u043a\u0443 9.17 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u043e\u0439 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439 "DNS \u043f\u043e\u0432\u0435\u0440\u0445 HTTPS" (DoH, DNS over HTTPS) \u0438 DNS \u043f\u043e\u0432\u0435\u0440\u0445 TLS (DoT, DNS over TLS), \u0430 \u0442\u0430\u043a\u0436\u0435.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/v-dns-server-bind-dobavlena-eksperimentalnaya-podderzhka-dns-over-https","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-02-19T08:22:43+00:00","article:modified_time":"2021-02-19T08:22:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99198","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 09:54:00","updated":"2026-02-08 20:24:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/99198","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=99198"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/99198\/revisions"}],"predecessor-version":[{"id":157870,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/99198\/revisions\/157870"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=99198"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=99198"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=99198"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}