{"id":99198,"date":"2021-02-19T10:22:43","date_gmt":"2021-02-19T08:22:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-dns-server-bind-dobavlena-eksperimentalnaya-podderzhka-dns-over-https"},"modified":"2021-02-19T10:22:43","modified_gmt":"2021-02-19T08:22:43","slug":"v-dns-server-bind-dobavlena-eksperimentalnaya-podderzhka-dns-over-https","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/v-dns-server-bind-dobavlena-eksperimentalnaya-podderzhka-dns-over-https","title":{"rendered":"\u00cen serverul DNS BIND a fost ad\u0103ugat suport experimental pentru DNS-over-HTTPS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dezvoltatorii serverului DNS BIND au anun\u021bat ad\u0103ugarea la ramura experimental\u0103 9.17 a implement\u0103rii suportului serverului pentru tehnologiile \u201eDNS peste HTTPS\u201d (DoH, DNS over HTTPS) \u0219i DNS peste TLS (DoT, DNS over TLS), precum \u0219i mecanismul XFR-over-TLS pentru transferul securizat al con\u021binutului zonelor DNS \u00eentre servere. DoH este disponibil pentru testare \u00een versiunea 9.17.10, iar suportul DoT este prezent \u00eencep\u00e2nd cu versiunea 9.17.7. Dup\u0103 stabilizare, suportul DoT \u0219i DoH va fi backportat \u00een ramura stabil\u0103 9.16. <\/p>\n

Implementarea protocolului HTTP\/2, utilizat \u00een DoH, se bazeaz\u0103 pe utilizarea bibliotecii nghttp2, care este inclus\u0103 \u00een num\u0103rul de dependen\u021be de construc\u021bie (\u00een viitor, biblioteca va fi planificat\u0103 s\u0103 fie transformat\u0103 \u00een dependen\u021be op\u021bionale). Se sus\u021bin at\u00e2t conexiuni criptate (TLS), c\u00e2t \u0219i necriptate prin HTTP\/2. Cu configura\u021biile corespunz\u0103toare, un proces named poate acum s\u0103 gestioneze nu doar cererile DNS tradi\u021bionale, ci \u0219i cererile trimise folosind DoH (DNS-over-HTTPS) \u0219i DoT (DNS-over-TLS). Suportul HTTPS pe partea clientului (dig) nu este \u00eenc\u0103 implementat. Suportul pentru XFR-over-TLS este disponibil at\u00e2t pentru cererile de intrare, c\u00e2t \u0219i pentru cele de ie\u0219ire. <\/p>\n

Prelucrarea cererilor folosind DoH \u0219i DoT este activat\u0103 prin ad\u0103ugarea op\u021biunilor http \u0219i tls \u00een directiva listen-on. Pentru a sus\u021bine DNS-over-HTTP nesecurizat, \u00een set\u0103ri trebuie specificat \u201etls none\u201d. Cheile sunt definite \u00een sec\u021biunea \u201etls\u201d. Porturile standard de re\u021bea 853 pentru DoT, 443 pentru DoH \u0219i 80 pentru DNS-over-HTTP pot fi redefinite prin parametrii tls-port, https-port \u0219i http-port. De exemplu: tls local-tls { key-file \u2018\/path\/to\/priv_key.pem\u2019; cert-file \u2018\/path\/to\/cert_chain.pem\u2019; }; http local-http-server { endpoints { \u2018\/dns-query\u2019; }; }; options { https-port 443; listen-on port 443 tls local-tls http myserver {any;}; } <\/p>\n

Printre caracteristicile implement\u0103rii DoH \u00een BIND se remarc\u0103 integrarea ca transport comun, care poate fi aplicat nu doar pentru procesarea cererilor clien\u021bilor c\u0103tre rezolvator, ci \u0219i \u00een schimbul de date \u00eentre servere, la transmiterea zonelor de c\u0103tre serverul DNS autoritar \u0219i la procesarea oric\u0103ror cereri sus\u021binute de alte transporturi DNS. <\/p>\n

O alt\u0103 caracteristic\u0103 este capacitatea de a externaliza opera\u021biunile de criptare pentru TLS c\u0103tre un alt server, ceea ce poate fi necesar \u00een condi\u021bii \u00een care certificatele TLS sunt stocate pe un alt sistem (de exemplu, \u00een infrastructuri cu servere web) \u0219i sunt gestionate de un alt personal. Suportul pentru DNS nesecurizat prin HTTP a fost implementat pentru a simplifica depanarea \u0219i ca un strat pentru tunelarea \u00een re\u021beaua intern\u0103, pe baza c\u0103ruia pe un alt server poate fi organizat\u0103 criptarea. Pe serverul extern pentru generarea traficului TLS se poate utiliza nginx, \u00een mod similar cu modul \u00een care este organizat\u0103 leg\u0103tura HTTPS pentru site-uri. <\/p>\n

Reamintim c\u0103 DNS-over-HTTPS poate fi util pentru a evita scurgerile de informa\u021bii despre numele gazdelor solicitate prin serverele DNS ale furnizorilor, pentru a combate atacurile MITM \u0219i modificarea traficului DNS (de exemplu, atunci c\u00e2nd te conectezi la Wi-Fi public), fiind o solu\u021bie pentru blocajele la nivel de DNS (DNS-over-HTTPS nu poate \u00eenlocui VPN<\/a> \u00een domeniul ocolirii blocajelor implementate la nivel DPI) sau pentru a asigura func\u021bionarea \u00een cazul \u00een care accesul direct la serverele DNS nu este posibil (de exemplu, c\u00e2nd se lucreaz\u0103 printr-un proxy). Dac\u0103 \u00eentr-o situa\u021bie normal\u0103, cererile DNS sunt trimise direct la serverele DNS specificate \u00een configura\u021bia sistemului, \u00een cazul DNS-over-HTTPS, cererea pentru determinarea adrese IP<\/a> gazdei este \u00eencapsulat\u0103 \u00een traficul HTTPS \u0219i trimis\u0103 c\u0103tre un server HTTP, pe care rezolvatorul proceseaz\u0103 cererile prin intermediul API-ului Web. <\/p>\n

\u201eDNS peste TLS\u201d se deosebe\u0219te de \u201eDNS peste HTTPS\u201d prin utilizarea protocolului standard DNS (de obicei utilizat pe portul de re\u021bea 853), \u00eenglobat \u00eentr-un canal de comunicare criptat, organizat cu ajutorul protocolului TLS, cu validarea gazdelor prin certificate TLS\/SSL emise de un autoritate de certificare. Standardul existent DNSSEC utilizeaz\u0103 criptarea doar pentru autentificarea clientului \u0219i serverului, dar nu protejeaz\u0103 traficul de interceptare \u0219i nu garanteaz\u0103 confiden\u021bialitatea cererilor.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 BIND \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u0432 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0442\u043a\u0443 9.17 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u043e\u0439 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439 «DNS \u043f\u043e\u0432\u0435\u0440\u0445 HTTPS» (DoH, DNS over HTTPS) \u0438 DNS \u043f\u043e\u0432\u0435\u0440\u0445 TLS (DoT, DNS over TLS), \u0430 \u0442\u0430\u043a\u0436\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 XFR-over-TLS \u0434\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e DNS-\u0437\u043e\u043d \u043c\u0435\u0436\u0434\u0443 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438. DoH \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0434\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 9.17.10, \u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 DoT \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 9.17.7. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99198","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Suport experimental pentru DNS-over-HTTPS a fost ad\u0103ugat \u00een serverul DNS BIND | ProHoster","description":"Dezvoltatorii serverului DNS BIND au anun\u021bat ad\u0103ugarea \u00een ramura experimental\u0103 9.17 a suportului serverului pentru tehnologiile \u201eDNS peste HTTPS\u201d (DoH, DNS over HTTPS) \u0219i DNS peste TLS (DoT, DNS over TLS), precum \u0219i.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-dns-server-bind-dobavlena-eksperimentalnaya-podderzhka-dns-over-https","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 DNS-\u0441\u0435\u0440\u0432\u0435\u0440 BIND \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 DNS-over-HTTPS | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 BIND \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u0432 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0442\u043a\u0443 9.17 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u043e\u0439 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439 "DNS \u043f\u043e\u0432\u0435\u0440\u0445 HTTPS" (DoH, DNS over HTTPS) \u0438 DNS \u043f\u043e\u0432\u0435\u0440\u0445 TLS (DoT, DNS over TLS), \u0430 \u0442\u0430\u043a\u0436\u0435.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-dns-server-bind-dobavlena-eksperimentalnaya-podderzhka-dns-over-https","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-02-19T08:22:43+00:00","article:modified_time":"2021-02-19T08:22:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99198","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 09:54:00","updated":"2026-02-08 20:24:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/99198","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=99198"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/99198\/revisions"}],"predecessor-version":[{"id":157870,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/99198\/revisions\/157870"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=99198"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=99198"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=99198"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}