Pas dy vjet\u00ebsh zhvillim, konsorciumi ISC prezantoi versionin e par\u00eb stabil t\u00eb deg\u00ebs s\u00eb re t\u00eb serverit DNS BIND 9.18. Mb\u00ebshtetje p\u00ebr deg\u00ebn 9.18 do t\u00eb ofrohet p\u00ebr tre vjet deri n\u00eb tremujorin e dyt\u00eb t\u00eb vitit 2025 si pjes\u00eb e nj\u00eb cikli t\u00eb zgjeruar mb\u00ebshtetjeje. Mb\u00ebshtetje p\u00ebr deg\u00ebn 9.11 do t\u00eb ndaloj\u00eb n\u00eb mars, nd\u00ebrsa p\u00ebr deg\u00ebn 9.16 n\u00eb mes t\u00eb vitit 2023. P\u00ebr zhvillimin e funksionaliteteve t\u00eb versionit tjet\u00ebr stabil t\u00eb BIND \u00ebsht\u00eb formuar nj\u00eb deg\u00eb eksperimentale BIND 9.19.0. <\/p>\n
L\u00ebshimi i BIND 9.18.0 \u00ebsht\u00eb i ve\u00e7ant\u00eb p\u00ebr implementimin e mb\u00ebshtetjes p\u00ebr teknologjit\u00eb \u201eDNS mbi HTTPS\u201c (DoH, DNS over HTTPS) dhe DNS mbi TLS (DoT, DNS over TLS), si dhe mekanizmin XoT (XFR-over-TLS) p\u00ebr transferimin e sigurt t\u00eb p\u00ebrmbajtjes s\u00eb zonave DNS midis server\u00ebve (mb\u00ebshtetet si d\u00ebrgimi ashtu edhe marrja e zonave p\u00ebrmes XoT). Me konfigurime t\u00eb p\u00ebrshtatshme, nj\u00eb proces named tani mund t\u00eb sh\u00ebrbej\u00eb jo vet\u00ebm k\u00ebrkesat tradicionale DNS, por edhe k\u00ebrkesat e d\u00ebrguara duke p\u00ebrdorur DNS-over-HTTPS dhe DNS-over-TLS. Mb\u00ebshtetja p\u00ebr klient\u00ebt e DNS-over-TLS \u00ebsht\u00eb e nd\u00ebrtuar brenda utilitarit dig, i cili mund t\u00eb p\u00ebrdoret p\u00ebr d\u00ebrgimin e k\u00ebrkesave mbi TLS duke sh\u00ebnuar flagun \u201e+tls\u201c. <\/p>\n
Implementimi i protokollit HTTP\/2, q\u00eb p\u00ebrdoret n\u00eb DoH, bazohet n\u00eb p\u00ebrdorimin e bibliotek\u00ebs nghttp2, e cila \u00ebsht\u00eb p\u00ebrfshir\u00eb n\u00eb grupin e var\u00ebsive t\u00eb nd\u00ebrtimit t\u00eb mundshme. Sertifikatat p\u00ebr DoH dhe DoT mund t\u00eb sigurohen nga p\u00ebrdoruesi ose t\u00eb krijohen automatikisht gjat\u00eb nisjes. <\/p>\n
Trajtimi i k\u00ebrkesave duke p\u00ebrdorur DoH dhe DoT aktivizohet p\u00ebrmes shtimit t\u00eb opsioneve \u201ehttp\u201c dhe \u201etls\u201c n\u00eb direktiv\u00ebn listen-on. P\u00ebr mb\u00ebshtetje t\u00eb DNS-pa-enkriptim mbi-HTTP, n\u00eb konfigurime duhet t\u00eb p\u00ebrcaktohet \u201etls none\u201c. \u00c7el\u00ebsat p\u00ebrcaktohen n\u00eb seksionin \u201etls\u201c. Portet standarde rrjet\u00ebs 853 p\u00ebr DoT, 443 p\u00ebr DoH dhe 80 p\u00ebr DNS-over-HTTP mund t\u00eb rishikohen p\u00ebrmes parametrave tls-port, https-port dhe http-port. P\u00ebr shembull: <\/p>\n
tls local-tls { key-file \"\/path\/to\/priv_key.pem\"; cert-file \"\/path\/to\/cert_chain.pem\"; }; http local-http-server { endpoints { \"\/dns-query\"; }; }; options { https-port 443; listen-on port 443 tls local-tls http myserver {any;}; } <\/p>\n
Nj\u00eb nga ve\u00e7orit\u00eb e implementimit t\u00eb DoH n\u00eb BIND \u00ebsht\u00eb mund\u00ebsia e transferimit t\u00eb operacioneve t\u00eb enkriptimit p\u00ebr TLS n\u00eb nj\u00eb server tjet\u00ebr, gj\u00eb q\u00eb mund t\u00eb jet\u00eb e nevojshme kur ruajtja e certifikatave TLS b\u00ebhet n\u00eb nj\u00eb sistem tjet\u00ebr (p.sh., n\u00eb infrastruktur\u00ebn me server\u00eb web) dhe menaxhohet nga nj\u00eb personel tjet\u00ebr. Mb\u00ebshtetja e DNS-over-HTTP t\u00eb pa enkriptuar \u00ebsht\u00eb realizuar p\u00ebr t\u00eb thjeshtuar debugging-un dhe si nj\u00eb nivel p\u00ebr kalimin n\u00eb nj\u00eb server tjet\u00ebr brenda rrjetit t\u00eb brendsh\u00ebm (p\u00ebr transferimin e enkriptimit n\u00eb nj\u00eb server t\u00eb ve\u00e7ant\u00eb). N\u00eb serverin e ve\u00e7ant\u00eb p\u00ebr formimin e trafikut TLS mund t\u00eb p\u00ebrdoret nginx, ngjash\u00ebm me m\u00ebnyr\u00ebn si organizohet mb\u00ebshtjellja HTTPS p\u00ebr faqet web. <\/p>\n
Nj\u00eb ve\u00e7ori tjet\u00ebr \u00ebsht\u00eb integrimi i DoH si nj\u00eb transport i zakonsh\u00ebm, i cili mund t\u00eb p\u00ebrdoret jo vet\u00ebm p\u00ebr p\u00ebrpunimin e k\u00ebrkesave t\u00eb klient\u00ebve ndaj rezolverit, por edhe gjat\u00eb shk\u00ebmbimit t\u00eb t\u00eb dh\u00ebnave midis server\u00ebve, gjat\u00eb transferimit t\u00eb zona nga serveri DNS autoritativ dhe gjat\u00eb p\u00ebrpunimit t\u00eb \u00e7do k\u00ebrkese mb\u00ebshtetur nga transportet e tjera DNS. <\/p>\n
Nga disavantazhet q\u00eb mund t\u00eb kompensohen duke \u00e7aktivizuar nd\u00ebrtimin me DoH\/DoT ose duke zhvendosur enkriptimin n\u00eb nj\u00eb server tjet\u00ebr, spikat p\u00ebrllogarisja e p\u00ebrgjithshme e kodit \u2014 \u00ebsht\u00eb e p\u00ebrfshir\u00eb nj\u00eb server HTTP i nd\u00ebrtuar brenda dhe nj\u00eb bibliotek\u00eb TLS, t\u00eb cilat potencialisht mund t\u00eb p\u00ebrmbajn\u00eb dob\u00ebsi dhe t\u00eb funksionojn\u00eb si vektor\u00eb t\u00eb shtes\u00eb p\u00ebr sulme. Gjithashtu, gjat\u00eb p\u00ebrdorimit t\u00eb DoH rritet trafiku. <\/p>\n
Kujtojm\u00eb se DNS-over-HTTPS mund t\u00eb jet\u00eb e dobishme p\u00ebr t\u00eb eliminuar rrjedhjen e informacioneve rreth emrave t\u00eb hosteve q\u00eb k\u00ebrkohen p\u00ebrmes server\u00ebve DNS t\u00eb ofruesve, p\u00ebr t\u00eb luftuar sulmet MITM dhe nd\u00ebrrimin e trafikut DNS (p\u00ebr shembull, gjat\u00eb lidhjes me Wi-Fi publike), dhe p\u00ebr t'u p\u00ebrballur me bllokimet n\u00eb nivel DNS (DNS-over-HTTPS nuk mund t\u00eb z\u00ebvend\u00ebsoj\u00eb) VPN<\/a> n\u00eb fush\u00ebn e anashkalimit t\u00eb bllokimeve q\u00eb zbatohen n\u00eb nivelin DPI) ose p\u00ebr t\u00eb organizuar funksionimin n\u00eb rastin e pamund\u00ebsis\u00eb p\u00ebr t'u drejtuar drejp\u00ebrdrejt te server\u00ebt DNS (p.sh., kur punoni p\u00ebrmes nj\u00eb prokse). N\u00eb nj\u00eb situat\u00eb normale, k\u00ebrkesat DNS d\u00ebrgohen drejtp\u00ebrdrejt te server\u00ebt DNS t\u00eb caktuar n\u00eb konfigurimin e sistemit, nd\u00ebrsa n\u00eb rastin e DNS-over-HTTPS, k\u00ebrkesa p\u00ebr p\u00ebrcaktimin IP t\u00eb p\u00ebrkushtuar<\/a> e hostit inkorporohet n\u00eb trafikun HTTPS dhe d\u00ebrgohet n\u00eb serverin HTTP, n\u00eb t\u00eb cilin rezolvuesi p\u00ebrpunon k\u00ebrkesat p\u00ebrmes Web API. <\/p>\n \u00abDNS over TLS\u00bb ndryshon nga \u00abDNS over HTTPS\u00bb p\u00ebr shkak t\u00eb p\u00ebrdorimit t\u00eb protokollit standard DNS (zakonisht p\u00ebrdoret porta 853), i futur n\u00eb nj\u00eb kanal t\u00eb koduar komunikimi, i organizuar p\u00ebrmes protokollit TLS me verifikimin e validitetit t\u00eb hostit p\u00ebrmes certifikatave TLS\/SSL, t\u00eb verifikuara nga nj\u00eb autoritet certifikimi. Standardi ekzistues DNSSEC p\u00ebrdor kodimin vet\u00ebm p\u00ebr autentifikimin e klientit dhe serverit, por nuk mbron trafikun nga kapja dhe nuk garanton konfidencialitetin e k\u00ebrkesave. <\/p>\n Disa risit\u00eb e tjera: <\/p>\n\n