3 ms·

DNS logs are important in an enterprise. But I'm sure many would want to also use DoH. Does Chrome provide any audit logging for DNS while in DoH mode?

cosmojg 6y ago
> DNS logs are important in an enterprise. But I'm sure many would want to also use DoH. Really? Why? As someone who works in academia, I don't see why anyone would need access to my or my colleagues' DNS logs, but I understand things might be different in industry.
- egyptiankarim 6y ago
  "Important" in the sense that many IT organizations have predicated their data forensics and incident response capabilities on being able to intercept and analyze traffic at arbitrary points within their corporate networks. That's not to say that those choices reflect good architectural design, to be sure quite the opposite. But like many things in enterprise IT risk management, it comes down to where you spent your money, and things like DoH/DoT force will force certain organizations to admit "a lot in the wrong place".
  - dsl 6y ago
    Much of this comes from regulatory oversight of specific industries. DoH isn't going to fly in the banking sector for example.
  - staticassertion 6y ago
    To be clear, I'm not asking for the ability to intercept DNS requests, or encrypted traffic, at all. I'm fine (and encourage) encryption on the wire. I'm just as happy to get the logs on the local system, and ship them off.
- m3047 6y ago
  > As someone who works in academia I wouldn't blame or ride on academia. If you have no data worth exfiltration, experiments worth sabotaging or industry affiliations you might be right.
- staticassertion 6y ago
  Extremely helpful for detecting malware, or performing post-compromise IR.
m3047 6y ago
Audit logging for DNS is generally poorly done. When Vixie's hair was on fire about DoH last summer I wrote this: https://github.com/m3047/shodohflo/ https://github.com/m3047/shodohflo/ Look in app/ for a screenshot. Needs access to a recursive resolver compiled with support for Dnstap. If you've never paid attention to DNS or used web console (in Firefox) tools, I suspect you're in for a surprise. Haven't tried it with DoT, I imagine that Dnstap would lose visibility for deciding which client to attribute the traffic to. (The DNS agent is performant enough for full visibility into a workgroup of 50-100 people.)
- staticassertion 6y ago
  Great project, thanks for the link.
tptacek 6y ago
Serious enterprises already manage all their endpoints directly, and control their DNS configurations. For that matter, they also run edge TLS proxies and push internal certs to all their machines, so they control HTTPS egress as well. There are a couple security products that rely on monitoring DNS to function (the "passive DNS" products), and if you're one of those vendors, an industrywide shift to DoH is a real problem. But for everyone else, it's not so much a problem. The same enterprise people raising the alarm over DoH are the ones who tried to break TLS 1.3 to keep the non-forward-secure RSA handshake in the protocol, so their TLS sniffers would keep working. They adapted.

cosmojg 6y ago

> DNS logs are important in an enterprise. But I'm sure many would want to also use DoH. Really? Why? As someone who works in academia, I don't see why anyone would need access to my or my colleagues' DNS logs, but I understand things might be different in industry.

egyptiankarim 6y ago
"Important" in the sense that many IT organizations have predicated their data forensics and incident response capabilities on being able to intercept and analyze traffic at arbitrary points within their corporate networks. That's not to say that those choices reflect good architectural design, to be sure quite the opposite. But like many things in enterprise IT risk management, it comes down to where you spent your money, and things like DoH/DoT force will force certain organizations to admit "a lot in the wrong place".
- dsl 6y ago
  Much of this comes from regulatory oversight of specific industries. DoH isn't going to fly in the banking sector for example.
- staticassertion 6y ago
  To be clear, I'm not asking for the ability to intercept DNS requests, or encrypted traffic, at all. I'm fine (and encourage) encryption on the wire. I'm just as happy to get the logs on the local system, and ship them off.
m3047 6y ago
> As someone who works in academia I wouldn't blame or ride on academia. If you have no data worth exfiltration, experiments worth sabotaging or industry affiliations you might be right.
staticassertion 6y ago
Extremely helpful for detecting malware, or performing post-compromise IR.

m3047 6y ago

Audit logging for DNS is generally poorly done. When Vixie's hair was on fire about DoH last summer I wrote this: https://github.com/m3047/shodohflo/ https://github.com/m3047/shodohflo/ Look in app/ for a screenshot. Needs access to a recursive resolver compiled with support for Dnstap. If you've never paid attention to DNS or used web console (in Firefox) tools, I suspect you're in for a surprise. Haven't tried it with DoT, I imagine that Dnstap would lose visibility for deciding which client to attribute the traffic to. (The DNS agent is performant enough for full visibility into a workgroup of 50-100 people.)

staticassertion 6y ago
Great project, thanks for the link.

tptacek 6y ago

Serious enterprises already manage all their endpoints directly, and control their DNS configurations. For that matter, they also run edge TLS proxies and push internal certs to all their machines, so they control HTTPS egress as well. There are a couple security products that rely on monitoring DNS to function (the "passive DNS" products), and if you're one of those vendors, an industrywide shift to DoH is a real problem. But for everyone else, it's not so much a problem. The same enterprise people raising the alarm over DoH are the ones who tried to break TLS 1.3 to keep the non-forward-secure RSA handshake in the protocol, so their TLS sniffers would keep working. They adapted.