Pas dy vitesh zhvillimi, konsorciumi ISC paraqiti versionin e par\u00eb stabil t\u00eb deg\u00ebs s\u00eb re t\u00eb serverit DNS BIND 9.18. Mb\u00ebshtetja p\u00ebr deg\u00ebn 9.18 do t\u00eb vazhdoj\u00eb p\u00ebr tre vjet deri n\u00eb tremujorin e dyt\u00eb t\u00eb vitit 2025 n\u00eb kuad\u00ebr t\u00eb ciklit t\u00eb zgjeruar t\u00eb mb\u00ebshtetjes. Mb\u00ebshtetja p\u00ebr deg\u00ebn 9.11 do t\u00eb p\u00ebrfundoj\u00eb n\u00eb mars, nd\u00ebrsa ajo p\u00ebr deg\u00ebn 9.16 n\u00eb mes t\u00eb vitit 2023. P\u00ebr zhvillimin e funksionaliteteve n\u00eb versionin e ardhsh\u00ebm stabil t\u00eb BIND \u00ebsht\u00eb formuar nj\u00eb deg\u00eb eksperimentale BIND 9.19.0. <\/p>\n
L\u00ebshimi i BIND 9.18.0 \u00ebsht\u00eb i r\u00ebnd\u00ebsish\u00ebm p\u00ebr implementimin e mb\u00ebshtetjes p\u00ebr teknologjit\u00eb \"DNS mbi HTTPS\" (DoH, DNS over HTTPS) dhe DNS mbi TLS (DoT, DNS over TLS), si dhe mekanizmin XoT (XFR-over-TLS) p\u00ebr transferimin e sigurt t\u00eb p\u00ebrmbajtjes s\u00eb zonave DNS midis server\u00ebve (p\u00ebrkrah p\u00ebrfshirjen dhe d\u00ebrgimin e zonave me XoT). Me konfigurime t\u00eb p\u00ebrshtatshme, nj\u00eb proces named tani mund t\u00eb sh\u00ebrbej\u00eb jo vet\u00ebm k\u00ebrkesat tradicionale DNS, por edhe k\u00ebrkesat q\u00eb d\u00ebrgohen duke p\u00ebrdorur DNS-over-HTTPS dhe DNS-over-TLS. Mb\u00ebshtetje p\u00ebr klientin DNS-over-TLS \u00ebsht\u00eb e integruar n\u00eb utilitarin dig, i cili mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb d\u00ebrguar k\u00ebrkesa mbi TLS duke specifikuar flamurin \"+tls\". <\/p>\n
Implementimi i protokollit HTTP\/2, t\u00eb p\u00ebrdorur n\u00eb DoH, bazohet n\u00eb p\u00ebrdorimin e bibliotek\u00ebs nghttp2, e cila \u00ebsht\u00eb p\u00ebrfshir\u00eb n\u00eb mesin e var\u00ebsive t\u00eb nd\u00ebrtimit opsionale. Sertifikatat p\u00ebr DoH dhe DoT mund t\u00eb sigurohen nga p\u00ebrdoruesi ose t\u00eb gjenerohen automatikisht gjat\u00eb nisjes. <\/p>\n
P\u00ebrpunimi i k\u00ebrkesave duke p\u00ebrdorur DoH dhe DoT aktivizohet p\u00ebrmes shtimit t\u00eb opsioneve \"http\" dhe \"tls\" n\u00eb direktiv\u00ebn listen-on. P\u00ebr mb\u00ebshtetje t\u00eb DNS-over-HTTP t\u00eb pa enkriptuar, konfiguratat duhet t\u00eb specifikojn\u00eb \"tls none\". \u00c7el\u00ebsat p\u00ebrcaktohen n\u00eb seksionin \"tls\". Portet standarde t\u00eb rrjetit 853 p\u00ebr DoT, 443 p\u00ebr DoH dhe 80 p\u00ebr DNS-over-HTTP mund t\u00eb anashkalohen n\u00ebp\u00ebrmjet parametrave tls-port, https-port dhe http-port. P\u00ebr shembull: <\/p>\n
tls local-tls { key-file \"\/path\/to\/priv_key.pem\"; cert-file \"\/path\/to\/cert_chain.pem\"; }; http local-http-server { endpoints { \"\/dns-query\"; }; }; options { https-port 443; listen-on port 443 tls local-tls http myserver {any;}; } <\/p>\n
Nj\u00eb nga ve\u00e7orit\u00eb e zbatimit t\u00eb DoH n\u00eb BIND \u00ebsht\u00eb mund\u00ebsia p\u00ebr t\u00eb kaluar operacionet e enkriptimit p\u00ebr TLS n\u00eb nj\u00eb server tjet\u00ebr, \u00e7ka mund t\u00eb nevojitet kur certifikatat TLS ruhen n\u00eb nj\u00eb sistem tjet\u00ebr (p.sh., n\u00eb infrastruktur\u00ebn e server\u00ebve web) dhe sh\u00ebrbehen nga personel tjet\u00ebr. Mb\u00ebshtetja p\u00ebr DNS-over-HTTP t\u00eb paenkriptuar \u00ebsht\u00eb realizuar p\u00ebr t\u00eb leht\u00ebsuar debugin dhe si nj\u00eb nivel p\u00ebr kalimin n\u00eb nj\u00eb server tjet\u00ebr brenda rrjetit (p\u00ebr t\u00eb kaluar enkriptimin n\u00eb nj\u00eb server t\u00eb ve\u00e7ant\u00eb). N\u00eb serverin e jasht\u00ebm p\u00ebr formimin e trafikut TLS mund t\u00eb p\u00ebrdoret nginx, n\u00eb p\u00ebrputhje me m\u00ebnyr\u00ebn si organizohet mb\u00ebshtetje HTTPS p\u00ebr faqet. <\/p>\n
Nj\u00eb ve\u00e7ori tjet\u00ebr \u00ebsht\u00eb integrimi i DoH si nj\u00eb transport i p\u00ebrgjithsh\u00ebm, i cili mund t\u00eb p\u00ebrdoret jo vet\u00ebm p\u00ebr p\u00ebrpunimin e k\u00ebrkesave t\u00eb klient\u00ebve ndaj rezolverit, por edhe p\u00ebr nd\u00ebrrimin e t\u00eb dh\u00ebnave nd\u00ebrmjet server\u00ebve, p\u00ebr kalimin e zonave nga server\u00ebt autoritar\u00eb DNS dhe p\u00ebr p\u00ebrpunimin e \u00e7do k\u00ebrkese, t\u00eb mb\u00ebshtetur nga transportet e tjera DNS. <\/p>\n
Nga disavantazhet, q\u00eb mund t\u00eb kompensohen duke \u00e7aktivizuar nd\u00ebrtimin me DoH\/DoT ose duke kaluar enkriptimin n\u00eb nj\u00eb server tjet\u00ebr, dallon komplikuese e p\u00ebrgjithshme e baz\u00ebs s\u00eb kodit \u2014 i shtohet nj\u00eb server HTTP i integruar dhe nj\u00eb bibliotek\u00eb TLS, t\u00eb cilat potencialisht mund t\u00eb p\u00ebrmbajn\u00eb vulnerabilitete dhe t\u00eb veprojn\u00eb si vektor\u00eb shtes\u00eb p\u00ebr sulme. gjithashtu, p\u00ebrdorimi i DoH rrit trafikun. <\/p>\n
Kujtojm\u00eb se DNS-i mbi HTTPS mund t\u00eb jet\u00eb i dobish\u00ebm p\u00ebr t\u00eb shmangur rrjedhjet e informacionit mbi emrat e hosteve t\u00eb k\u00ebrkuar p\u00ebrmes server\u00ebve DNS t\u00eb ofruesve, p\u00ebr t\u00eb luftuar sulmet MITM dhe p\u00ebr t\u00eb falsifikuar trafikun DNS (p.sh., kur lidhemi me Wi-Fi publik), p\u00ebr t\u00eb p\u00ebrballuar bllokimet n\u00eb nivelin DNS (DNS mbi HTTPS nuk mund t\u00eb z\u00ebvend\u00ebsoj\u00eb VPN<\/a> n\u00eb fush\u00ebn e shmangies s\u00eb bllokimeve, t\u00eb realizuara n\u00eb nivelin DPI) ose p\u00ebr t\u00eb organizuar pun\u00ebn n\u00eb rastin e pamund\u00ebsis\u00eb p\u00ebr t'u drejtuar direkt n\u00eb server\u00ebt DNS (p.sh., kur punojm\u00eb p\u00ebrmes nj\u00eb proksi). N\u00eb situat\u00ebn normale, k\u00ebrkesat DNS d\u00ebrgohen drejtp\u00ebrdrejt n\u00eb server\u00ebt DNS t\u00eb caktuar n\u00eb konfigurimin e sistemit, nd\u00ebrsa n\u00eb rastin e DNS-it mbi HTTPS, k\u00ebrkesa p\u00ebr p\u00ebrcaktimin Adresa IP<\/a> e hostit inkapsulohet n\u00eb trafik HTTPS dhe d\u00ebrgohet n\u00eb nj\u00eb server HTTP, ku rezolvuesi p\u00ebrpunon k\u00ebrkesat p\u00ebrmes Web API. <\/p>\n \"DNS over TLS\" ndryshon nga \"DNS over HTTPS\" duke aplikuar protokollin standard DNS (zakonisht p\u00ebrdoret porti rrjet 853), i mb\u00ebshtjell\u00eb n\u00eb nj\u00eb kanal t\u00eb enkriptuar, i organizuar p\u00ebrmes protokollit TLS me verifikimin e vlefshm\u00ebris\u00eb s\u00eb hostit p\u00ebrmes TLS\/SSL-certifikatave t\u00eb verifikuara nga nj\u00eb qend\u00ebr shkencore. Standardi ekzistues DNSSEC p\u00ebrdor enkriptime vet\u00ebm p\u00ebr autentikimin e klientit dhe serverit, por nuk mbron trafikun nga kapja dhe nuk garanton privat\u00ebsin\u00eb e k\u00ebrkesave. <\/p>\n Disa novacione t\u00eb tjera: <\/p>\n\n