{"id":99198,"date":"2021-02-19T10:22:43","date_gmt":"2021-02-19T08:22:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-dns-server-bind-dobavlena-eksperimentalnaya-podderzhka-dns-over-https"},"modified":"2021-02-19T10:22:43","modified_gmt":"2021-02-19T08:22:43","slug":"v-dns-server-bind-dobavlena-eksperimentalnaya-podderzhka-dns-over-https","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/v-dns-server-bind-dobavlena-eksperimentalnaya-podderzhka-dns-over-https","title":{"rendered":"Do DNS server BIND pridana experiment\u00e1lna podpora DNS-over-HTTPS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdvoj\u00e1ri DNS servera BIND ozn\u00e1mili pridan\u00edm do experiment\u00e1lneho vetvy 9.17 implement\u00e1ciu serverovej podpory technol\u00f3gi\u00ed \u201eDNS cez HTTPS\u201c (DoH, DNS over HTTPS) a DNS cez TLS (DoT, DNS over TLS), ako aj mechanizmu XFR-over-TLS pre bezpe\u010dn\u00fd prenos obsahu DNS z\u00f3n medzi servermi. DoH je k dispoz\u00edcii na testovanie vo verzii 9.17.10, podpora DoT je pr\u00edtomn\u00e1 od verzie 9.17.7. Po stabiliz\u00e1cii bude podpora DoT a DoH prenesen\u00e1 do stabilnej vetvy 9.16. <\/p>\n

Implement\u00e1cia protokolu HTTP\/2, ktor\u00fd sa pou\u017e\u00edva v DoH, je zalo\u017een\u00e1 na vyu\u017eit\u00ed kni\u017enice nghttp2, ktor\u00e1 je zahrnut\u00e1 medzi zostavovac\u00edmi z\u00e1vislos\u0165ami (v bud\u00facnosti sa pl\u00e1nuje zmeni\u0165 t\u00fato kni\u017enicu na nepovinn\u00fa z\u00e1vislos\u0165). Podporuj\u00fa sa ako \u0161ifrovan\u00e9 (TLS), tak aj ne\u0161ifrovan\u00e9 pripojenia cez HTTP\/2. Pri vhodn\u00fdch nastaveniach m\u00f4\u017ee teraz jeden proces named obsluhova\u0165 nielen tradi\u010dn\u00e9 DNS po\u017eiadavky, ale aj po\u017eiadavky zaslan\u00e9 pomocou DoH (DNS-over-HTTPS) a DoT (DNS-over-TLS). Podpora HTTPS na strane klienta (dig) zatia\u013e nie je implementovan\u00e1. Podpora XFR-over-TLS je dostupn\u00e1 ako pre prich\u00e1dzaj\u00face, tak aj pre odch\u00e1dzaj\u00face po\u017eiadavky. <\/p>\n

Spracovanie po\u017eiadaviek pomocou DoH a DoT sa aktivuje pridan\u00edm mo\u017enost\u00ed http a tls v direkt\u00edve listen-on. Pre podporu neza\u0161ifrovan\u00e9ho DNS-over-HTTP je potrebn\u00e9 v nastaveniach uvies\u0165 \u201etls none\u201c. K\u013e\u00fa\u010de s\u00fa definovan\u00e9 v sekcii \u201etls\u201c. \u0160tandardn\u00e9 sie\u0165ov\u00e9 porty 853 pre DoT, 443 pre DoH a 80 pre DNS-over-HTTP m\u00f4\u017eu by\u0165 predefinovan\u00e9 cez parametre tls-port, https-port a http-port. Napr\u00edklad: tls local-tls { key-file \u201e\/path\/to\/priv_key.pem\u201c; cert-file \u201e\/path\/to\/cert_chain.pem\u201c; }; http local-http-server { endpoints { \u201e\/dns-query\u201c; }; }; options { https-port 443; listen-on port 443 tls local-tls http myserver {any;}; } <\/p>\n

Medzi zvl\u00e1\u0161tnosti implement\u00e1cie DoH v BIND patr\u00ed integr\u00e1cia ako spolo\u010dn\u00e9ho transportu, ktor\u00fd m\u00f4\u017ee by\u0165 pou\u017eit\u00fd nielen na spracovanie po\u017eiadaviek klientov na rezolvery, ale aj pri v\u00fdmene \u00fadajov medzi servermi, pri prenose z\u00f3n autoritat\u00edvnym DNS serverom a pri spracovan\u00ed ak\u00fdchko\u013evek po\u017eiadaviek podporovan\u00fdch in\u00fdmi transportmi DNS. <\/p>\n

\u010eal\u0161ou \u010drtou je mo\u017enos\u0165 presun\u00fa\u0165 oper\u00e1cie \u0161ifrovania pre TLS na in\u00fd server, \u010do m\u00f4\u017ee by\u0165 potrebn\u00e9 v pr\u00edpadoch, ke\u010f s\u00fa TLS certifik\u00e1ty ulo\u017een\u00e9 na inej s\u00fastave (napr\u00edklad v infra\u0161trukt\u00fare s webov\u00fdmi servermi) a spravuj\u00fa ich in\u00ed zamestnanci. Podpora neza\u0161ifrovan\u00e9ho DNS-over-HTTP bola implementovan\u00e1 na u\u013eah\u010denie ladenia a ako \u00farove\u0148 na prenos v internej sieti, na b\u00e1ze ktorej m\u00f4\u017ee by\u0165 na inom serveri zorganizovan\u00e9 \u0161ifrovanie. Na externom serveri pre generovanie TLS prev\u00e1dzky m\u00f4\u017ee by\u0165 pou\u017eit\u00fd nginx, podobne ako sa organizuje obal HTTPS pre webov\u00e9 str\u00e1nky. <\/p>\n

Pripome\u0148me, \u017ee DNS-over-HTTPS m\u00f4\u017ee by\u0165 u\u017eito\u010dn\u00e9 na elimin\u00e1ciu \u00fanikov \u00fadajov o po\u017eadovan\u00fdch men\u00e1ch hostite\u013eov cez DNS servery poskytovate\u013eov, boj s MITM \u00fatokmi a podvrhnut\u00edm DNS prev\u00e1dzky (napr\u00edklad pri pripojen\u00ed k verejn\u00fdm Wi-Fi), ako aj na odol\u00e1vanie blokovaniu na \u00farovni DNS (DNS-over-HTTPS nem\u00f4\u017ee nahradi\u0165 VPN<\/a> v oblasti ob\u00eddenia blok\u00e1dy, implementovanej na \u00farovni DPI) alebo na organizovanie pr\u00e1ce v pr\u00edpade nemo\u017enosti priameho pr\u00edstupu k DNS serverom (napr\u00edklad pri pr\u00e1ci cez proxy). Ak v be\u017enej situ\u00e1cii DNS \u017eiadosti priamo posielaj\u00fa na konkr\u00e9tne v konfigur\u00e1cii syst\u00e9mu DNS servery, tak v pr\u00edpade DNS-over-HTTPS sa \u017eiados\u0165 na ur\u010denie IP adresy<\/a> hosta inkapsuluje do HTTPS prev\u00e1dzky a posiela sa na HTTP server, kde rezolver spracov\u00e1va po\u017eiadavky cez Web API. <\/p>\n

\"DNS cez TLS\" sa l\u00ed\u0161i od \"DNS cez HTTPS\" pou\u017eit\u00edm \u0161tandardn\u00e9ho protokolu DNS (zvy\u010dajne sa pou\u017e\u00edva sie\u0165ov\u00fd port 853), zabalen\u00e9ho do za\u0161ifrovan\u00e9ho komunika\u010dn\u00e9ho kan\u00e1la, ktor\u00fd je organizovan\u00fd prostredn\u00edctvom protokolu TLS s overen\u00edm platnosti hostite\u013ea prostredn\u00edctvom TLS\/SSL certifik\u00e1tov, overen\u00fdch certifika\u010dnou autoritou. Existuj\u00faci \u0161tandard DNSSEC pou\u017e\u00edva \u0161ifrovanie len na autentifik\u00e1ciu klienta a servera, ale neochra\u0148uje prev\u00e1dzku pred odposluchom a nezaru\u010duje d\u00f4vernos\u0165 dotazov.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 BIND \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u0432 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0442\u043a\u0443 9.17 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u043e\u0439 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439 «DNS \u043f\u043e\u0432\u0435\u0440\u0445 HTTPS» (DoH, DNS over HTTPS) \u0438 DNS \u043f\u043e\u0432\u0435\u0440\u0445 TLS (DoT, DNS over TLS), \u0430 \u0442\u0430\u043a\u0436\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 XFR-over-TLS \u0434\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e DNS-\u0437\u043e\u043d \u043c\u0435\u0436\u0434\u0443 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438. DoH \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0434\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 9.17.10, \u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 DoT \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 9.17.7. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99198","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Do DNS servera BIND bola pridan\u00e1 experiment\u00e1lna podpora DNS-over-HTTPS | ProHoster","description":"V\u00fdvoj\u00e1ri DNS servera BIND informovali o prid\u00e1van\u00ed do experiment\u00e1lnej vetvy 9.17 implement\u00e1cie serverovej podpory technol\u00f3gi\u00ed 'DNS cez HTTPS' (DoH, DNS over HTTPS) a DNS cez TLS (DoT, DNS over TLS), ako aj.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/v-dns-server-bind-dobavlena-eksperimentalnaya-podderzhka-dns-over-https","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 DNS-\u0441\u0435\u0440\u0432\u0435\u0440 BIND \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 DNS-over-HTTPS | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 BIND \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u0432 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0442\u043a\u0443 9.17 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u043e\u0439 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439 "DNS \u043f\u043e\u0432\u0435\u0440\u0445 HTTPS" (DoH, DNS over HTTPS) \u0438 DNS \u043f\u043e\u0432\u0435\u0440\u0445 TLS (DoT, DNS over TLS), \u0430 \u0442\u0430\u043a\u0436\u0435.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/v-dns-server-bind-dobavlena-eksperimentalnaya-podderzhka-dns-over-https","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-02-19T08:22:43+00:00","article:modified_time":"2021-02-19T08:22:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99198","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 09:54:00","updated":"2026-02-08 20:24:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/99198","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=99198"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/99198\/revisions"}],"predecessor-version":[{"id":157870,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/99198\/revisions\/157870"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=99198"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=99198"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=99198"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}