3 ms·

I wanted to, but the classic villain, systemd, fights its damndest to retain control of local DNS resolution. If there was a bulletproof, straightforward way t

I wanted to, but the classic villain, systemd, fights its damndest to retain control of local DNS resolution. If there was a bulletproof, straightforward way to run it, I am there (not Nix). I probably gave up too early, but my initial attempts with Unbound broke all internet access until I was able to reverse my configuration.

pabs3 3y ago
You can make /etc/resolv.conf immutable using chattr +i and then nothing can mess with your DNS. Of course if your apps aren't using /etc/resolv.conf and going direct to systemd-resolved then you'll have to deal with that instead of unbound/kresd/etc.
- 0cf8612b2e1e 3y ago
  See, that feels like bandaging over the problem. A solution that is probably fine, until it is not.
aesh2Xa1 3y ago
Why not permit systemd-resolved to act as the local resolver along with resolved.conf? You can use Unbound listening on whatever is free on (ipv4)127.0.0.0/8 and (ipv6)[:1]:9953 (or any other free port), and configure resolved.conf to use that local address as the "upstream" DNS= option. You're probably going to still need Unbound to talk to an encrypted DNS server on the Internet (DoH or DoT), or else your ISP will be capable of intercepting and manipulating your queries. https://www.freedesktop.org/software/systemd/man/systemd-resolved.service.html https://www.freedesktop.org/software/systemd/man/systemd-res... https://www.freedesktop.org/software/systemd/man/resolved.conf.html https://www.freedesktop.org/software/systemd/man/resolved.co...
- 0cf8612b2e1e 3y ago
  That feels like a brilliant strategy. Theoretically only ever requiring a one line configuration change if I ever need to reverse it. It would be a lot better if systemd would play nicely, but this is pretty minimal jank. Edit: and immediately ran into some trouble while trying to configure this. Definitely a situation where the documentation assumes you already know how DNS works

pabs3 3y ago

You can make /etc/resolv.conf immutable using chattr +i and then nothing can mess with your DNS. Of course if your apps aren't using /etc/resolv.conf and going direct to systemd-resolved then you'll have to deal with that instead of unbound/kresd/etc.

0cf8612b2e1e 3y ago
See, that feels like bandaging over the problem. A solution that is probably fine, until it is not.

aesh2Xa1 3y ago

Why not permit systemd-resolved to act as the local resolver along with resolved.conf? You can use Unbound listening on whatever is free on (ipv4)127.0.0.0/8 and (ipv6)[:1]:9953 (or any other free port), and configure resolved.conf to use that local address as the "upstream" DNS= option. You're probably going to still need Unbound to talk to an encrypted DNS server on the Internet (DoH or DoT), or else your ISP will be capable of intercepting and manipulating your queries. https://www.freedesktop.org/software/systemd/man/systemd-resolved.service.html https://www.freedesktop.org/software/systemd/man/systemd-res... https://www.freedesktop.org/software/systemd/man/resolved.conf.html https://www.freedesktop.org/software/systemd/man/resolved.co...

0cf8612b2e1e 3y ago
That feels like a brilliant strategy. Theoretically only ever requiring a one line configuration change if I ever need to reverse it. It would be a lot better if systemd would play nicely, but this is pretty minimal jank. Edit: and immediately ran into some trouble while trying to configure this. Definitely a situation where the documentation assumes you already know how DNS works