{"id":37892,"date":"2019-10-31T22:20:24","date_gmt":"2019-10-31T19:20:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox\/"},"modified":"2019-10-31T22:20:24","modified_gmt":"2019-10-31T19:20:24","slug":"mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","title":{"rendered":"Mozilla za\u010d\u00edn\u00e1 ve Firefoxu standardn\u011b aktivovat DNS-over-HTTPS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdvoj\u00e1\u0159i Firefoxu so napovedali<\/a><\/noindex> o ukon\u010den\u00ed testov\u00e1n\u00ed podpory DNS p\u0159es HTTPS (DoH, DNS over HTTPS) a z\u00e1m\u011bru na konci z\u00e1\u0159\u00ed tuto technologii standardn\u011b aktivovat pro u\u017eivatele ve Spojen\u00fdch st\u00e1tech. Aktivace prob\u011bhne postupn\u011b, nejprve pro n\u011bkolik procent u\u017eivatel\u016f a v p\u0159\u00edpad\u011b absence probl\u00e9m\u016f se postupn\u011b zv\u00fd\u0161\u00ed na 100 %. Po pokryt\u00ed USA bude zva\u017eov\u00e1na mo\u017enost aktivace DoH i v dal\u0161\u00edch zem\u00edch.<\/p>\n

Testy prov\u00e1d\u011bn\u00e9 po cel\u00fd rok prok\u00e1zaly spolehlivost a dobr\u00fd v\u00fdkon slu\u017eby, a tak\u00e9 umo\u017enily identifikovat n\u011bkter\u00e9 situace, kdy DoH m\u016f\u017ee zp\u016fsobovat probl\u00e9my, a vypracovat \u0159e\u0161en\u00ed pro jejich obch\u00e1zen\u00ed (nap\u0159\u00edklad bylo diskutov\u00e1no probleme<\/a><\/noindex> o optimalizaci provozu v s\u00edt\u00edch dod\u00e1n\u00ed obsahu, rodi\u010dovsk\u00e9 kontrole a intern\u00edch DNS z\u00f3n\u00e1ch podnik\u016f). <\/p>\n

V\u00fdznam \u0161ifrov\u00e1n\u00ed DNS provozu je pova\u017eov\u00e1n za z\u00e1sadn\u00ed faktor ochrany u\u017eivatel\u016f, a proto bylo rozhodnuto aktivovat DoH jako v\u00fdchoz\u00ed, av\u0161ak v prvn\u00ed f\u00e1zi pouze pro u\u017eivatele ve Spojen\u00fdch st\u00e1tech. Po aktivaci DoH se u\u017eivateli zobraz\u00ed upozorn\u011bn\u00ed, kter\u00e9 mu umo\u017en\u00ed p\u0159\u00edpadn\u011b se vzd\u00e1t p\u0159\u00edstupu k centralizovan\u00fdm DoH DNS server\u016fm a vr\u00e1tit se k tradi\u010dn\u00edmu zas\u00edl\u00e1n\u00ed ne\u0161ifrovan\u00fdch dotaz\u016f k DNS serveru poskytovatele (na rozd\u00edl od decentralizovan\u00e9 infrastruktu\u0159e resolver\u016f DNS, ve DoH se pou\u017e\u00edv\u00e1 vazba na konkr\u00e9tn\u00ed DoH slu\u017ebu, kter\u00e1 m\u016f\u017ee b\u00fdt pova\u017eov\u00e1na za jedin\u00fd bod selh\u00e1n\u00ed).<\/p>\n

P\u0159i aktivaci DoH m\u016f\u017ee doj\u00edt k naru\u0161en\u00ed funkce syst\u00e9m\u016f rodi\u010dovsk\u00e9 kontroly a podnikov\u00fdch s\u00edt\u00ed, kter\u00e9 pou\u017e\u00edvaj\u00ed strukturu n\u00e1zv\u016f DNS dostupnou pouze pro intern\u00ed s\u00ed\u0165 k p\u0159ekladu intranetov\u00fdch adres a podnikov\u00fdch hostitel\u016f. Pro \u0159e\u0161en\u00ed probl\u00e9m\u016f s t\u011bmito syst\u00e9my byla p\u0159id\u00e1na kontroln\u00ed syst\u00e9m, kter\u00fd automaticky deaktivuje DoH. Kontroly se prov\u00e1d\u011bj\u00ed p\u0159i ka\u017ed\u00e9m spu\u0161t\u011bn\u00ed prohl\u00ed\u017ee\u010de nebo p\u0159i zji\u0161t\u011bn\u00ed zm\u011bny pods\u00edt\u011b.<\/p>\n

Samodejno vra\u010danje na uporabo sistemskega resolverja je prav tako predvideno ob napakah pri re\u0161evanju prek DoH (na primer, ob izgubi omre\u017ene dostopnosti s ponudnikom DoH ali ob okvarah v njegovi infrastrukturi). Smisel tak\u0161nih preverjanj je vpra\u0161ljiv, saj napadalcem, ki nadzorujejo delovanje resolverja ali lahko posredujejo promet, nih\u010de ne prepre\u010duje, da simulirajo tak\u0161no vedenje za izklop \u0161ifriranja DNS prometa. Te\u017eava je re\u0161ena z dodajanjem mo\u017enosti 'DoH always' v nastavitve (privzeto ni aktivna), kjer se ob njegovi izbiri samodejno izklapljanje ne uporablja, kar predstavlja razumljen kompromis.<\/p>\n

Za dolo\u010ditev korporativnih rezolverskih sistemov se izvajajo preverjanja nenavadnih domen prve stopnje (TLD) in vra\u010danje intranetnih naslovov s sistemskega rezolverja. Za dolo\u010danje vklju\u010ditve star\u0161evskega nadzora se izvaja poskus rezolvovanja imena exampleadultsite.com in \u010de rezultat ne ustreza dejanskemu IP, se \u0161teje, da je aktivna blokada vsebin za odrasle na ravni DNS. Kot znak se prav tako preverjajo IP-naslovi Google in YouTube glede njihove zamenjave z restrict.youtube.com, forcesafesearch.google.com in restrictmoderate.youtube.com. Dodatno Mozilla ponuja<\/a><\/noindex> vklju\u010diti enotni preveritveni gostiteljski naslov use-application-dns.net<\/a><\/noindex>, ki ga lahko internetni ponudniki in storitve star\u0161evskega nadzora uporabljajo kot oznako za onemogo\u010danje DoH (\u010de gostitelj ni dolo\u010den, Firefox onemogo\u010di DoH).<\/p>\n

Deloz z enotno storitvijo DoH lahko potencialno povzro\u010di te\u017eave pri optimizaciji prometa v omre\u017ejih za dostavo vsebine, ki uravnavajo promet s pomo\u010djo DNS (DNS stre\u017enik omre\u017eja CDN oblikuje odgovor ob upo\u0161tevanju naslova resolverja in vrne najbli\u017eji gostitelj za pridobitev vsebine). Po\u0161iljanje DNS poizvedbe z najbli\u017ejega resolverja bo v takih CDN-ih vrnilo naslov najbli\u017ejega gostitelja uporabniku, vendar bo ob po\u0161iljanju DNS poizvedbe s centraliziranega resolverja izdan naslov gostitelja, ki je najbli\u017eji stre\u017eniku DNS-over-HTTPS. Testiranje v praksi je pokazalo, da uporaba DNS-over-HTTP v povezavi z CDN-jem prakti\u010dno ni povzro\u010dala zamud pred za\u010detkom prenosa vsebine (pri hitrih povezavah zamude niso presegale 10 milisekund, na po\u010dasenih povezavah pa je bilo celo zaznati pospe\u0161itev delovanja). Za prenos podatkov o lokaciji stranke do resolverja CDN je bilo prav tako obravnavano uporabo raz\u0161iritve EDNS Client Subnet.<\/p>\n

Omenimo, da je DoH lahko koristen za izklju\u010ditev pu\u0161\u010danja podatkov o zahtevanih imenih gostiteljev preko DNS stre\u017enikov ponudnikov, za boj proti MITM napadom in zamenjavi DNS prometa, za prepre\u010devanje blokad na ravni DNS ali za omogo\u010danje delovanja v primeru nezmo\u017enosti neposrednega dostopa do DNS stre\u017enikov (na primer pri delovanju preko proxy). V obi\u010dajni situaciji se DNS poizvedbe neposredno po\u0161iljajo na dolo\u010dene DNS stre\u017enike, ki jih dolo\u010da konfiguracija sistema, medtem ko se v primeru DoH poizvedba za dolo\u010ditev IP naslova gostitelja inkapsulira v HTTPS promet in po\u0161lje na HTTP stre\u017enik, kjer resolver obdeluje poizvedbe preko Web API. Obstoje\u010di standard DNSSEC uporablja \u0161ifriranje le za avtentikacijo stranke in stre\u017enika, vendar ne \u0161\u010diti prometa pred prestrezanjem in ne zagotavlja zasebnosti poizvedb. <\/p>\n

Za omogo\u010danje DoH v about:config je treba spremeniti vrednost spremenljivke network.trr.mode, ki je podprta od razli\u010dice Firefox 60 naprej. Vrednost 0 popolnoma onemogo\u010di DoH; 1 \u2014 uporablja DNS ali DoH, odvisno od tega, katera je hitrej\u0161a; 2 \u2014 uporablja DoH privzeto, DNS pa kot rezervno mo\u017enost; 3 \u2014 uporablja samo DoH; 4 \u2014 na\u010din ugledovanja, pri katerem se DoH in DNS uporabljata hkrati. Privzeto se uporablja DNS stre\u017enik CloudFlare, vendar ga je mogo\u010de spremeniti preko parametra network.trr.uri, na primer, lahko nastavite «https:\/\/dns.google.com\/experimental» ali «https:\/\/9.9.9.9\/dns-query».<\/p>\n

<\/a><\/noindex><\/p>\n

Izvor: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Firefox \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 DNS \u043f\u043e\u0432\u0435\u0440\u0445 HTTPS (DoH, DNS over HTTPS) \u0438 \u043d\u0430\u043c\u0435\u0440\u0435\u043d\u0438\u0438 \u0432 \u043a\u043e\u043d\u0446\u0435 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0434\u0430\u043d\u043d\u0443\u044e \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0421\u0428\u0410. \u0412\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0431\u0443\u0434\u0435\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0441\u0442\u0443\u043f\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0432\u043d\u0430\u0447\u0430\u043b\u0435 \u0434\u043b\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u043f\u0440\u043e\u0446\u0435\u043d\u0442\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0430 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u043f\u043e\u0441\u0442\u0435\u043f\u0435\u043d\u043d\u043e \u0434\u043e\u0432\u043e\u0434\u044f \u0434\u043e 100%. \u041f\u043e\u0441\u043b\u0435 \u043e\u0445\u0432\u0430\u0442\u0430 \u0421\u0428\u0410 \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f DoH \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37892","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mozilla prehaja na privzeto vklju\u010ditev DNS-over-HTTPS v Firefox | ProHoster","description":"Razvijalci Firefox so napovedali konec testiranja podpore.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Mozilla \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u0442 \u043a \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e DNS-over-HTTPS \u0432 Firefox | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Firefox \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438.","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/mozilla-perehodit-k-vklyucheniyu-po-umolchaniyu-dns-over-https-v-firefox","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:20:24+00:00","article:modified_time":"2019-10-31T19:20:24+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37892","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 19:39:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:39:22","updated":"2026-01-23 19:39:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/37892","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=37892"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/37892\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=37892"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=37892"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=37892"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}