DNS: Difference between revisions
Line 293: | Line 293: | ||
= DNS attack = | = DNS attack = | ||
[https://www.makeuseof.com/what-are-dns-attacks-and-how-do-you-prevent-them/ What Are DNS Attacks and How Do You Prevent Them?] | [https://www.makeuseof.com/what-are-dns-attacks-and-how-do-you-prevent-them/ What Are DNS Attacks and How Do You Prevent Them?] | ||
= IP spoofing = | |||
[https://www.makeuseof.com/what-is-ip-spoofing/ What Is IP Spoofing and What Is It Used For?] |
Revision as of 19:18, 11 December 2021
Resource
Managing DNS Essential Training from lynda.com
TTL
How to see Time-To-Live (TTL) for a DNS record
Records
- How to Create, Edit, and Delete DNS Records
- How can I set up an A (address) record for my domain (namecheap)?, How to edit DNS records on Namecheap?
DNSCrypt
- https://en.wikipedia.org/wiki/DNSCrypt
- dnscrypt-proxy 2 - A flexible DNS proxy, with support for encrypted DNS protocols
- Install and Enable DNSCrypt Proxy 2 in Ubuntu 18.04 Or 18.10 / Debian Unstable Or Testing
Network commands
- ping
- curl - ping alternative. It is useful if the server blocks ping requests]
- nc and telnet - How to Test Port TCP/UDP Connectivity from a Linux Server
- host
- nslookup
- dig
DNS server
Setup on Linux/Ubuntu
- https://support.rackspace.com/how-to/changing-dns-settings-on-linux/
- How to Run Your Own DNS Server on Your Local Network
- Build your own DNS name server on Linux. General discussion, not specific to Ubuntu.
- How To Configure DNS Server On Ubuntu 18.04 / Ubuntu 16.04, How to install a DNS server on Ubuntu 19.04
sudo apt install bind9 sudo nano /etc/bind/named.conf.options # update 'forwarders' key to use 1,1,1,1; 8.8.8.8; # add 'forward only;' sudo systemctl restart bind9 # open port 53, or let ufw to allow bind9
Pi-hole
Client part
- Windows/Mac/Linux
dig @192.168.1.2 linkedin.com # Suppose the DNS server ips is 192.168.1.2
- Pay attention to the Query time result. If we run the same command again, the query time will be reduced to 0 because of the cache in the DNS server.
- Wifi on Mobile
- Go to wi-fi setting and select your connected network (so each wifi network has its own DNS setting).
- Change Configure DNS from Automatic to Manual so that you can set your primary DNS server to Pi-hole. Then add the IP of your DNS server. You can add a backup server too (such as the IP address of your gateway router) so you can still visit websites when Pi-hole is offline.
- Mobile network
What is my DNS server /etc/resolv.conf or /etc/network/interfaces
PS. dig command can show my DNS server as part of its output.
Even I can change my DNS setting using the Network Manager (IPv4 -> disable Automatic -> Enter 8.8.8.8 -> Apply -> Toggle On/Off), the name solving does not work. Testing https://129.43.254.99 works but not https://brb.nci.nih.gov
Note: we are not supposed to edit /etc/resolv.conf file. See here on how to add DNS servers.
The real DNS servers IPs can be found by the network manager GUI or using the command line
nmcli dev show | grep 'IP4.DNS'
On my home computer, it just shows one line nameserver 127.0.1.1. On work computer, it shows
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8) # DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN nameserver 127.0.1.1 search XXX.XXX.gov
On the VM of my work computer, it shows
nameserver 127.0.0.53 search XXX.XXX.gov
It seems the /etc/resolv.conf file changes with the file on the host.
After any change, we can restart the network by using sudo service networking restart.
Note:
- nameserver Name-server-IP-address: Point out to your your own nameserver or to ISP’s name server. Up to 3 name servers may be listed.
- search domain.com: The search list is normally determined from the local domain name; by default, it contains only the local domain name. So when you type nslookup www, it will be matched to www.cyberciti.biz
You can also use Public Name Servers
nameserver 8.8.8.8 nameserver 8.8.4.4
On Ubuntu 18.04, it uses netplan. See
- Netplan – How To Configure Static IP Address in Ubuntu 18.04 using Netplan
- How to set DNS nameservers in Ubuntu Server 18.04
dig Command Examples
dig (domain information groper) is a DNS lookup utility.
- https://www.cyberciti.biz/faq/linux-unix-dig-command-examples-usage-syntax/
- 12 Dig Command Examples To Query DNS In Linux
$ dig google.com ANY $ dig r-project.org ANY ... ;r-project.org. IN ANY ;; ANSWER SECTION: r-project.org. 7199 IN NS ns2.urbanek.info. r-project.org. 7199 IN NS ns1.urbanek.info. r-project.org. 7199 IN NS ns2.wu-wien.ac.at. r-project.org. 7199 IN NS ns3.urbanek.info. r-project.org. 7199 IN NS ns4.urbanek.info. r-project.org. 7199 IN NS ns1.wu-wien.ac.at. r-project.org. 7199 IN A 137.208.57.37 r-project.org. 7199 IN MX 5 mc1.ethz.ch. r-project.org. 7199 IN MX 5 mc4.ethz.ch. r-project.org. 7199 IN MX 5 mc3.ethz.ch. r-project.org. 7199 IN MX 5 mc2.ethz.ch. r-project.org. 7199 IN TXT "v=spf1 ip4:129.132.119.208/32 ~all" r-project.org. 7199 IN SOA ns0.wu-wien.ac.at. postmaster.wu-wien.ac.at.
- Quick hit: ‘dig’-ging Into r-project.org DNS Records with {processx}
- Doggo Is A DNS Lookup Utility With Colorful Output, DNS-over-TLS and DNS-over-HTTPS Support
DNSmasq (DNS + DHCP server)
- Man page and Setup
- Dnsmasq For Easy LAN Name Services
- https://wiki.archlinux.org/index.php/dnsmasq
- https://wiki.debian.org/HowTo/dnsmasq
- http://www.linuxjournal.com/content/dnsmasq-pint-sized-super-d%C3%A6mon
- https://blogging.dragon.org.uk/howto-setup-dnsmasq-as-dns-dhcp/
Local forwarding server
dnsmasq program is running on my Ubuntu and Linux/Mint machines.
See nameserver 127.0.1.1 in resolv.conf won't go away!
$ ps -ef | grep -i dnsmasq $ sudo netstat -anp | grep -i dnsmasq
DNS providers
- DNS Resolvers Performance compared: CloudFlare x Google x Quad9 x OpenDNS
- Best free and public DNS servers of 2020
- The 6 Best Free Dynamic DNS Providers 2021
- NextDNS: click 'Try it now for free' button and it will show the current DNS Server IP.
Change DNS setting
- Why Changing DNS Settings Increases Your Internet Speed, 5 DNS Servers Guaranteed to Improve Your Online Safety
- https://1.1.1.1/, 隱私優先、速度最快,公共DNS服務1.1.1.1上線了
- Google: 8.8.8.8 and 8.8.4.4
- OpenDNS: 208.67.220.220 and 208.67.222.222
- DNS Watch: 84.200.69.80 and 84.200.70.40
- OpenNIC: 206.125.173.29 and 45.32.230.225
- UncensoredDNS: 91.239.100.100 and 89.233.43.71
- Change DNS Settings on Windows / Mac / Android / IOS / Linux
- Setup CloudFlare DNS On Ubuntu 16.04 / 17.10 / 18.04 Desktop
- Open Ubuntu Network Manager (System settings > Network > Settings > Wired or Wireless or both)
- Select both IPv4 and IPv6 and turn off automatic DNS IP settings… then type the custom Cloudflare DNS IP addresses you want to use…
- You Can Now Use Cloudflare’s 1.1.1.1 DNS on Mobile
Domain Setup & SSL Certificates, HTTPS - NGINX & Docker Compose
Shiny Production with AWS Book
Flush DNS cache
How To Set Permanent DNS Nameservers
How To Set Permanent DNS Nameservers in Ubuntu and Debian
Test if you are using OpenDNS
I try to change the DNS ip using either Network Connection GUI or modifying /etc/resolv.conf (& calling sudo /etc/init.d/networking restart). But it does not change anything??
DNS-over-HTTPS (DoH) in Firefox
Mozilla Firefox Expands DNS-over-HTTPS (DoH) Test to Release Channel.
This does not affect the result of DNS leak test and another test.
Query DNS server
To list the current DNS servers used by my system,
Method 1:
# Ubuntu >= 15 $ nmcli dev show | grep 'IP4.DNS' $ nmcli device show <interfacename> | grep IP4.DNS # Ubuntu <= 14 $ nmcli dev list iface <interfacename> | grep IP4
Method 2:
$ cat /etc/resolv.conf
Method 3 (macOS):
scutil --dns | grep nameserver # cat /etc/resolv.conf
Another way is to use the R packages: gdns and dnsflare. More Options For Querying DNS From R with 1.1.1.1.
3 Ways to Check DNS Propagation Status
https://www.makeuseof.com/tag/check-dns-propagation-status/
DNS tricks
5 DNS Servers Guaranteed to Improve Your Online Safety
http://www.makeuseof.com/tag/best-dns-providers-security/
5 Nifty Ways to Use DNS to Your Advantage
http://www.makeuseof.com/tag/nifty-ways-use-dns-advantage/
DNStracer
http://www.ubuntugeek.com/dnstracer-trace-dns-queries-to-the-source.html
Dyndns and ddclient
See
- https://help.ubuntu.com/community/DynamicDNS#ddclient (works)
- https://help.ubuntu.com/community/DynamicDNS#Namecheap_.26_Python (works)
- Using ddclient with Cloudflare ddclient version 3.9.0 for Ubuntu 18.04.1
nano /etc/ddclient.conf
protocol=namecheap ssl=yes use=web, web=dynamicdns.park-your-domain.com/getip server=dynamicdns.park-your-domain.com login=yourdomain.com password=a9438540ba8a449fb0ed09c3737b9e32 @
Note that the specification should depend on the domain name registrar (eg namecheap). For namecheap, the login/password is NOT your actual credential from your domain name registrar. The password should be obtained from the domain name registrar website. The last line is about the host. If I am setting it up for a subdomain, I should enter the subdomain name (and skip the domain name part). The ssl=yes is to ensure the connection is made over https instead of http.
And run sudo ddclient -daemon=0 -debug -verbose -noquiet to verify ddclient is working. You shall get a long return with the last line looks like
SUCCESS: updating YOURSUBDOMAIN: good: IP address set to XX.XXX.XXX.XXX
No matter which method we use, we can go to our DNS account (in namecheap, go to Dashboard -> MANAGE button -> Domains -> Advanced DNS) and temporarily change the global IP address to another one, run the update script and then check if the global IP address has been updated to the correct one.
namecheap
- How do I configure DDClient?
- To create a subdomain, go to Dashboard -> Manage -> Advanced DNS tab. Click + ADD NEW RECORD. In the 'HOST RECORDS' section, pick 'A + dynamic dns record' and enter the subdomain name (HOST) with the IPv4 address (Value). In the 'DYNAMIC DNS' section, we can download the client software too (scroll down to get the download link). See How can I set up an A (address) record for my domain?
- To understand different records (A record, AAAA record, CNAME record, NS record, SRV record, TXT record, URL redirect record) See How do I set up host records for a domain?
- If you've purchased an SSL certificate, you'll want to visit your Account Panel soon to enter your CSR and activate the certificate. Instructions on how to create a CSR and install the certificate on your server.
- CloudFlare
- Email forwarding
- Add https to your Namecheap Domain hosted on Github Pages
- check the option of Mail Routing: I have mail server with another name and would like to add MX hostname...
- In 'MX hostname' entering aspmx.l.google.com
- In 'Primary' choose 'Yes, use it as my primary mail relay.'
- How to Set Up Email at Your Domain for Free With Zoho Mail July 2019
- How to Use a Custom Email Address With Gmail for Professional Emails
CDN
Why You Should Use a CDN to Improve Your Website’s User Experience
no-ip
Similar to Dyndns. It has its own client program. Needs to build it yourself.
Also see the troubleshooting guide.
See http://ducky-pond.com/posts/12 for instruction of setting autostart on Debian system.
See http://www.coulterfamily.org.uk/pages/PCs/Linux/FAQ-LINUX-NO-IP-CLIENT.php for another approach.
Note: If noip2 cannot start automatically or noip2 does not update even it can be seen from ps -ef command, use sudo crontab -e command. For some reason, after I use sudo crontab, noip2 can update IP. So the only problem right now is it cannot update every 30 minutes even sudo noip2 -S says so. The problems may be 1. ps -ef shows the command runs from nobody user 2. sudo noip2 -S says it updates every 30 minutes via /dev/eth0 with NAT enabled.
Update: An alternative is to use ddclient. However, ddclient never updates the IP.
- Allow only one MX record for each host for free no-ip account.
- Click Host/Redirects > Manage Hosts > Modify.
DNS attack
What Are DNS Attacks and How Do You Prevent Them?