Slackware-14.2-Unbound-1.6.3-Dnssec-Dnscrypt-Part-1
Posted 06-17-2017 at 06:57 PM by arniekat
INTRODUCTION
Source - ArchLinux Wiki and linoxide.com and Unbound Website
DNSCrypt-Proxy is a tool for securing communications between a client and a DNS resolver. It provides a local service which can be used directly as your local resolver or as a DNS forwarder, encrypting and authenticating requests using the DNSCrypt protocol and passing them to an upstream server. By default dnscrypt-proxy is configured to use OpenDNS' servers.
DNSSEC allows a zone (such as a domain) to be signed by its owner, and allows a resolver (for instance, Comcast's DNS servers) to verify the signature, and therefore be sure that the zone data it gets is authentic. It protects the resolver from receiving bad data, but does nothing to prevent MITM or snooping between you and the resolver.
In this tutorial, we will configure unbound with dnssec and dnscrypt-proxy along with Adblocking. What happens is you configure unbound to use 3 (three) instances of dnscrypt-proxy and the DNS Servers. In their turn, the dnscrypt-proxy servers MUST be DNSSEC-Enabled, thus enabling the dnssec extensions. Then you will also create an additional hosts file at /etc/unbound/adblock.nsakey.20170526 which will contain in total approximately 70,000 entries with adservers, webbugs, malicious websites and trackers in the standard hosts format except the address will be 0.0.0.0 which is NXDOMAIN or Non-Existent Domain.
If you are using some sort of Null Server like PixelServ, NullServ or Kwakd, you will need to set the IP Address to 127.0.0.1
Since Unbound will be listening in at 127.0.0.1:53, we will have to make dnscrypt-proxy listen on another port or on another address. I chose different ports located at 127.0.0.1:5353, 127.0.0.1:5354 and 127.0.0.1:5355 There will be three (3) instances of dnscrypt-proxy running on non-priveleged ports for redundancy.
DNSCRYPT-PROXY ISSUES/SOLUTIONS
1) When I first booted dnscrypt-proxy, dmesg warned me that "cisco" keeps dns logs so I changed the default Resolver Name to "fvz-rec-us-lax-01" since it is closer and problably not logged. I then received the following error:
# cat /var/log/dnscrypt-proxy/dnscrypt-proxy.log
[NOTICE] Starting dnscrypt-proxy 1.9.5
[INFO] Generating a new session key pair
[INFO] Done
[ERROR] Unable to retrieve server certificates
[INFO] Refetching server certificates
The dns server names from the source package file dnscrypt-proxy-1.9.5/dnscrypt-resolvers.csv (LibreOffice-Calc will open it) tend to get stale. When they go stale, you will get the error shown above and you will not be able to access the Internet.
Get a fresh file from:
https://github.com/jedisct1/dnscrypt...-resolvers.csv
and copy/overwrite it to: /usr/share/dnscrypt-proxy/dnscrypt-resolvers.csv
Be sure to use one of the entries from the fresh dnscrypt-resolvers.csv file in your dnscrypt-proxy configuration file!
2) If you are using DNSSEC Security Extensions, try to pick IPv6-Ready Dnssec-Capable Resolvers from the dnscrypt-resolvers.csv list so that it will be 100% Compliant with the test from https://en.internet.nl If you have any IPv4 dns servers in dnscrypt-proxy, the test from https://en.internet.nl WILL NOT BE 100% compliant. I will use three (3) IPv6 DNS Servers.
3) You will also see some dnscrypt-proxy servers in the main list that are listed as "Adguard DNS Family Protection" and "Remove ads and protect your computer from malware". Dnscrypt runs its own DNS Servers with lists of malware and adserver sites, however, they are NOT DNSSEC-Enabled so I did not use them. Also, I will be creating my own list of Malware and Ad Servers List with approximately 70,000 entries which works perfectly for me.
4) You can also use OpenNIC DNS Servers. They have a list of Servers that are Dnscrypt-Capable and Dnssec-Enabled. Use the "ping" (included in Slackware) or "fping" (available in SlackBuilds.org) command to test for which one(s) are the fastest and place those in the /usr/share/dnscrypt-proxy/dnscrypt-resolvers.csv. Be sure to list them in the configuration file /etc/default/dnscrypt-proxy
DNSCRYPT-PROXY SETUP/CONFIGURATION
DNSCrypt-Proxy secures your communication between your computer and a DNS Resolver. This particular setup caches the DNS entries on-disk with Unbound, which speeds things up for DNS queries.
Compile and install:
libsodium-1.0.12
dnscrypt-proxy-1.9.5
The configuration file is setup to use the "dnscrypt" user by default, and to chroot into that user's home directory to maximize security. In order to use the default configuration you should create a dnscrypt user and group with the following commands:
# groupadd -g 293 dnscrypt
# useradd -u 293 -g 293 -c "DNSCrypt" -d /run/dnscrypt -s /bin/false dnscrypt
If you decide to use another user you should edit the CHROOTDIR and USER options in /etc/default/dnscrypt-proxy (there are example settings provided for the user 'nobody'). Compile and install the three applications.
Edit the file /etc/default/dnscrypt-proxy and place three instances of dnscrypt-proxy for redundancy. Since I will be using the DNS Security Extensions, I need to find three different IPv6 servers from the dnscrypt-resolvers.csv file that are DNSSEC enabled. The three I chose are DNS Servers that are dnssec-enabled and do not keep logs.
Country Name
Netherlands dnscrypt.eu-nl-ipv6
Denmark dnscrypt.eu-dk-ipv6
Poland soltysiak-ipv6
# vi /etc/default/dnscrypt-proxy
CHROOTDIR[0]="/run/dnscrypt"
LOCALADDRESS[0]="127.0.0.1:5353"
PIDFILE[0]="/var/run/dnscrypt-proxy/dnscrypt-proxy-0.pid"
USER[0]="dnscrypt"
RESOLVERNAME[0]="dnscrypt.eu-nl-ipv6"
RESOLVERSLIST[0]="/usr/share/dnscrypt-proxy/dnscrypt-resolvers.csv"
EDNSPAYLOADSIZE[0]="4096"
LOGFILE[0]="/var/log/dnscrypt-proxy/dnscrypt-proxy-0.log"
CHROOTDIR[1]="/run/dnscrypt"
LOCALADDRESS[1]="127.0.0.1:5354"
PIDFILE[1]="/var/run/dnscrypt-proxy/dnscrypt-proxy-1.pid"
USER[1]="dnscrypt"
RESOLVERNAME[1]="dnscrypt.eu-dk-ipv6"
RESOLVERSLIST[1]="/usr/share/dnscrypt-proxy/dnscrypt-resolvers.csv"
LOGFILE[1]="/var/log/dnscrypt-proxy/dnscrypt-proxy-1.log"
CHROOTDIR[2]="/run/dnscrypt"
LOCALADDRESS[2]="127.0.0.1:5355"
PIDFILE[2]="/var/run/dnscrypt-proxy/dnscrypt-proxy-2.pid"
USER[2]="dnscrypt"
RESOLVERNAME[2]="soltysiak-ipv6"
RESOLVERSLIST[2]="/usr/share/dnscrypt-proxy/dnscrypt-resolvers.csv"
LOGFILE[2]="/var/log/dnscrypt-proxy/dnscrypt-proxy-2.log"
Save the file and exit.
Here is the format for dnscrypt-proxy if you were using different IP Addresses instead of different Ports. The Port will default to Port 53
LOCALADDRESS[0]="127.0.0.2"
LOCALADDRESS[1]="127.0.0.3"
LOCALADDRESS[2]="127.0.0.4"
Make sure the file /etc/rc.d/rc.dnscrypt-proxy is executable. If is not, then use the following command:
# chmod +x /etc/rc.d/rc.dnscrypt-proxy
Now, edit the file /etc/rc.d/rc.local and add these lines:
# Start DNSCrypt-Proxy
if [ -x /etc/rc.d/rc.dnscrypt-proxy ]; then
/etc/rc.d/rc.dnscrypt-proxy start
fi
To properly stop dnscrypt-proxy on system shutdown, add the following to /etc/rc.d/rc.local_shutdown
# vi /etc/rc.d/rc.local_shutdown
# Stop DNSCrypt-Proxy
if [ -x /etc/rc.d/rc.dnscrypt-proxy ]; then
/etc/rc.d/rc.dnscrypt-proxy stop
fi
Save the file and exit.
RESOLV.CONF AND DHCLIENT.CONF
You need to make two changes to system files in order to use Dnscrypt-Proxy and Unbound.
Here is the flow of information:
DNS Request > Unbound > Dnscrypt-Proxy (With DNSSEC Vefification)
In order to send all DNS requests through, then out to dnscrypt-proxy, you will need to update /etc/resolv.conf to point to localhost. DHCP will overwrite this file on every reboot, so you need to enter the information and make the /etc/resolv.conf file immutable. I enabled EDNS by using the "options edns0" directive.
# vi /etc/resolv.conf
nameserver 127.0.0.1
options edns0
Save the file and exit. Change the immutable attribute to make this file immutable so your DHCP System does not change this at the next reboot.
# chattr +i /etc/resolv.conf
# lsattr /etc/resolv.conf
----i---------e---- /etc/resolv.conf
NOTE - If your /etc/resolv.conf file keeps changing back to your old setting even after editing it, the reason is that the networking system is locking the file. When my computer did this, I turned off the wicd script (or NetworkManager)
# chmod -x /etc/rc.d/rc.wicd
# chmod -x /etc/rc.d/rc.networkmanager
and rebooted so that my Wireless Network was not turned on. Then I edited the file /etc/resolv.conf and made it immutable. After that I changed the rc.wicd or rc.networkmanager script to executable
# chmod +x /etc/rc.d/rc.wicd
# chmod +x /etc/rc.d/rc.networkmanager
and rebooted. The file /etc/resolv.conf accepted the changes and became immutable and everything worked fine.
If you need to edit this file again, remove the executable bit from the file:
# chattr -i /etc/resolv.conf
then edit the file, save and set the immutable bit again.
Open and edit the file /etc/dhclient.conf and add the following line:
# vi /etc/dhclient.conf
prepend domain-name-servers 127.0.0.1;
Save the file and exit.
UNBOUND SETUP/CONFIGURATION
Compile and install the application/dependencies in the following order:
perl-Sub-Uplevel-0.25
perl-Test-Exception-0.43
perl-IO-CaptureOutput-1.1104
perl-Devel-CheckLib-1.107
ldns-1.7.0
unbound-1.6.3
Create the UID/GID for Slackware before running the unbound.SlackBuild The current SlackBuild Framework (Unbound-1.5.10) works fine except you will need to add the the compile flag --enable-dnscrypt to the SlackBuild before compiling the package! You must use Unbound-1.6.2 or greater to have support for dnscrypt-proxy!
# groupadd -g 304 unbound
# useradd -r -u 304 -g 304 -d /etc/unbound/ -s /sbin/nologin -c 'Unbound DNS resolver' unbound
Now, compile and install the Unbound Package.
Move the default configuration file and create a new configuration file. The last five lines in the server section (num-threads, msg-cache-slabs, rrset-cache-slabs, infra-cache-slabs and key-cache-slabs) are tuning settings to increase throughput on a dual-core system. You can look here to see more information on tuning Unbound.
https://www.unbound.net/documentatio..._optimise.html
# mv /etc/unbound/unbound.conf /etc/unbound/unbound.conf.default
# vi /etc/unbound/unbound.conf
server:
access-control: 192.168.1.0/24 allow
root-hints: /etc/unbound/root.hints
do-not-query-localhost: no
include: /etc/unbound/adblock.nsakey.20170526
username: unbound
verbosity: 1
num-threads: 2
msg-cache-slabs: 2
rrset-cache-slabs: 2
infra-cache-slabs: 2
key-cache-slabs: 2
forward-zone:
name: "."
forward-addr: 127.0.0.1@5353 # DNSCrypt-Proxy-0
forward-addr: 127.0.0.1@5354 # DNSCrypt-Proxy-1
forward-addr: 127.0.0.1@5355 # DNSCrypt-Proxy-2
remote-control:
control-enable: yes
control-interface: 127.0.0.1
Save the configuration file and exit. If you are using different IP Addresses, this will be the format of the forward-zone section.
forward-zone:
name: "."
forward-addr: 127.0.0.2 # DNSCrypt-Proxy-0
forward-addr: 127.0.0.3 # DNSCrypt-Proxy-1
forward-addr: 127.0.0.4 # DNSCrypt-Proxy-2
UNBOUND ROOT-HINTS
Root-hints: is the file which contains the listing of primary root DNS servers. Unbound does have a listing of root DNS servers in its code, but if you want to make sure you are completely up to date we should obtain our own. Update root-hints every couple of months.
To query a hostname Unbound has to start at the top at the root DNS servers and work its way down to the authoritative servers. Download a copy of the root hints from Internic and place it in the /etc/unbound/root.hints file. This file will be called by the root-hints: directive in the unbound.conf file. To obtain this file we will use wget! Must run as root or use sudo!
The last current update is April 11, 2017
wget ftp://FTP.INTERNIC.NET/domain/named.cache -O /etc/unbound/root.hints
--2017-04-30 11:23:30-- ftp://ftp.internic.net/domain/named.cache
=> 'named.cache'
Resolving ftp.internic.net (ftp.internic.net)... 2620:0:2d0:200::9, 192.0.32.9
Connecting to ftp.internic.net (ftp.internic.net)|2620:0:2d0:200::9|:21... connected.
Logging in as anonymous ... Logged in!
==> SYST ... done. ==> PWD ... done.
==> TYPE I ... done. ==> CWD (1) /domain ... done.
==> SIZE named.cache ... 3289
==> EPSV ... done. ==> RETR named.cache ... done.
Length: 3289 (3.2K) (unauthoritative)
named.cache 100%[===================>] 3.21K --.-KB/s in 0.004s
2017-04-30 11:23:32 (820 KB/s) - '/etc/unbound/root.hints' saved [3289]
UNBOUND ADDITIONAL CONFIGURATION
Next the auto-trust-anchor! This file which contains the key for the root server so DNSSEC can be validated. We need to tell Unbound that we trust the root server so it can start to develop a chain of trust down to the hostname we want resolved and validated using DNSSEC. Again this command must be run with root privileges! Unbound has a tool to get a trust anchor just run:
# unbound-anchor
Change the file /etc/rc.d/rc.unbound to make it executable.
# chmod +x /etc/rc.d/rc.unbound
Add the following to /etc/rc.d/rc.local Be sure Unbound starts AFTER Dnscrypt-Proxy.
# vi /etc/rc.d/rc.local
# Start DNSCrypt-Proxy
if [ -x /etc/rc.d/rc.dnscrypt-proxy ]; then
/etc/rc.d/rc.dnscrypt-proxy start
fi
# Start Unbound DNS Cache Server
if [ -x /etc/rc.d/rc.unbound ]; then
/etc/rc.d/rc.unbound start
fi
Save the file and exit.
After everything is configured and setup, change the ownership of the unbound configuration files.
# chown -R unbound:unbound /etc/unbound
Now, run the unbound-control-setup command to generate the TLS Key Files.
# unbound-control-setup
setup in directory /etc/unbound
generating unbound_server.key
Generating RSA private key, 3072 bit long modulus
...........++
...........++
e is 65537 (0x10001)
generating unbound_control.key
Generating RSA private key, 3072 bit long modulus
...........++
...........++
e is 65537 (0x10001)
create unbound_server.pem (self signed certificate)
create unbound_control.pem (signed client certificate)
Signature ok
subject=/CN=unbound-control
Getting CA Private Key
Setup success. Certificates created. Enable in unbound.conf file to use
UNBOUND NSA ADBLOCKING SCRIPT
https://github.com/jodrell/unbound-block-hosts
A script to convert Dan Pollock's ad blocking hosts file into Unbound local-data format. The IP that is used is 127.0.0.1 which goes to localhost. You can covert it to 0.0.0.0 which means MXDOMAIN or "No Domain". There are approximately 70,000 entries. It gets several hosts files from 6 different websites and combines/sorts them into one big list.
When you run it, it will create a "tmp" and "lists" folder that can be deleted. The two files in the current directory are "block.conf" and "hosts". The "hosts" file can be appended to /etc/hosts if you want to adblock by that method. The "block.conf" is for use by Unbound. Edit the Unbound Configuration File /etc/unbound/unbound.conf and add the following in the server: section:
server:
include: /etc/unbound/adblock.nsakey.20170526
Save the file and exit. Here are the first 5 entries from this file so you can see the format.
local-data: "0.r.msn.com A 0.0.0.0"
local-data: "005.free-counter.co.uk A 0.0.0.0"
local-data: "006.free-adult-counters.x-xtra.com A 0.0.0.0"
local-data: "006.free-counter.co.uk A 0.0.0.0"
local-data: "0adblock.nsakey.2017050306.freecounters.co.uk A 0.0.0.0"
When you first start Unbound, you may get errors in formatting of the hosts file. I just delete the lines and try to start Unbound. The hosts script has been averaging 4 errors per run everytime I create a new unbound hosts file.
# /etc/rc.d/rc.unbound start
UNBLOCKING ADS FOR DOMAINS
Let's say you want to unblock a domain that is getting blocked by your adblocker. The domain for this example is "doubleclick.com"
$ grep -insr "doubleclick.com" /etc/unbound/adblock.nsakey.20170526
34495:local-data: "doubleclick.com A 0.0.0.0"
37497:local-data: "ftp.doubleclick.com A 0.0.0.0"
43140:local-data: "m.doubleclick.com A 0.0.0.0"
44260:local-data: "mediavisor.doubleclick.com A 0.0.0.0"
50575:local-data: "reports.doubleclick.com A 0.0.0.0"
51942:local-data: "search.doubleclick.com A 0.0.0.0"
53883:local-data: "static.doubleclick.com A 0.0.0.0"
54546:local-data: "studio.doubleclick.com A 0.0.0.0"
65140:local-data: "www.doubleclick.com A 0.0.0.0"
68473:local-data: "www2.doubleclick.com A 0.0.0.0"
68538:local-data: "www3.doubleclick.com A 0.0.0.0"
I want to unblock Line 43140 of that file. Use vi and the goto feature to find and delete the line.
# vi /etc/unbound/adblock.nsakey.20170526
Hit ESC two times. Type the line number, and then press Shift-g . If you press Esc and then Shift-g without specifying a line number, it will take you to the last line in the file.
43140:local-data: "m.doubleclick.com A 0.0.0.0"
You will be placed at Line 43140. Press dd to delete the line and :wq to save the file and exit.
Source - ArchLinux Wiki and linoxide.com and Unbound Website
DNSCrypt-Proxy is a tool for securing communications between a client and a DNS resolver. It provides a local service which can be used directly as your local resolver or as a DNS forwarder, encrypting and authenticating requests using the DNSCrypt protocol and passing them to an upstream server. By default dnscrypt-proxy is configured to use OpenDNS' servers.
DNSSEC allows a zone (such as a domain) to be signed by its owner, and allows a resolver (for instance, Comcast's DNS servers) to verify the signature, and therefore be sure that the zone data it gets is authentic. It protects the resolver from receiving bad data, but does nothing to prevent MITM or snooping between you and the resolver.
In this tutorial, we will configure unbound with dnssec and dnscrypt-proxy along with Adblocking. What happens is you configure unbound to use 3 (three) instances of dnscrypt-proxy and the DNS Servers. In their turn, the dnscrypt-proxy servers MUST be DNSSEC-Enabled, thus enabling the dnssec extensions. Then you will also create an additional hosts file at /etc/unbound/adblock.nsakey.20170526 which will contain in total approximately 70,000 entries with adservers, webbugs, malicious websites and trackers in the standard hosts format except the address will be 0.0.0.0 which is NXDOMAIN or Non-Existent Domain.
If you are using some sort of Null Server like PixelServ, NullServ or Kwakd, you will need to set the IP Address to 127.0.0.1
Since Unbound will be listening in at 127.0.0.1:53, we will have to make dnscrypt-proxy listen on another port or on another address. I chose different ports located at 127.0.0.1:5353, 127.0.0.1:5354 and 127.0.0.1:5355 There will be three (3) instances of dnscrypt-proxy running on non-priveleged ports for redundancy.
DNSCRYPT-PROXY ISSUES/SOLUTIONS
1) When I first booted dnscrypt-proxy, dmesg warned me that "cisco" keeps dns logs so I changed the default Resolver Name to "fvz-rec-us-lax-01" since it is closer and problably not logged. I then received the following error:
# cat /var/log/dnscrypt-proxy/dnscrypt-proxy.log
[NOTICE] Starting dnscrypt-proxy 1.9.5
[INFO] Generating a new session key pair
[INFO] Done
[ERROR] Unable to retrieve server certificates
[INFO] Refetching server certificates
The dns server names from the source package file dnscrypt-proxy-1.9.5/dnscrypt-resolvers.csv (LibreOffice-Calc will open it) tend to get stale. When they go stale, you will get the error shown above and you will not be able to access the Internet.
Get a fresh file from:
https://github.com/jedisct1/dnscrypt...-resolvers.csv
and copy/overwrite it to: /usr/share/dnscrypt-proxy/dnscrypt-resolvers.csv
Be sure to use one of the entries from the fresh dnscrypt-resolvers.csv file in your dnscrypt-proxy configuration file!
2) If you are using DNSSEC Security Extensions, try to pick IPv6-Ready Dnssec-Capable Resolvers from the dnscrypt-resolvers.csv list so that it will be 100% Compliant with the test from https://en.internet.nl If you have any IPv4 dns servers in dnscrypt-proxy, the test from https://en.internet.nl WILL NOT BE 100% compliant. I will use three (3) IPv6 DNS Servers.
3) You will also see some dnscrypt-proxy servers in the main list that are listed as "Adguard DNS Family Protection" and "Remove ads and protect your computer from malware". Dnscrypt runs its own DNS Servers with lists of malware and adserver sites, however, they are NOT DNSSEC-Enabled so I did not use them. Also, I will be creating my own list of Malware and Ad Servers List with approximately 70,000 entries which works perfectly for me.
4) You can also use OpenNIC DNS Servers. They have a list of Servers that are Dnscrypt-Capable and Dnssec-Enabled. Use the "ping" (included in Slackware) or "fping" (available in SlackBuilds.org) command to test for which one(s) are the fastest and place those in the /usr/share/dnscrypt-proxy/dnscrypt-resolvers.csv. Be sure to list them in the configuration file /etc/default/dnscrypt-proxy
DNSCRYPT-PROXY SETUP/CONFIGURATION
DNSCrypt-Proxy secures your communication between your computer and a DNS Resolver. This particular setup caches the DNS entries on-disk with Unbound, which speeds things up for DNS queries.
Compile and install:
libsodium-1.0.12
dnscrypt-proxy-1.9.5
The configuration file is setup to use the "dnscrypt" user by default, and to chroot into that user's home directory to maximize security. In order to use the default configuration you should create a dnscrypt user and group with the following commands:
# groupadd -g 293 dnscrypt
# useradd -u 293 -g 293 -c "DNSCrypt" -d /run/dnscrypt -s /bin/false dnscrypt
If you decide to use another user you should edit the CHROOTDIR and USER options in /etc/default/dnscrypt-proxy (there are example settings provided for the user 'nobody'). Compile and install the three applications.
Edit the file /etc/default/dnscrypt-proxy and place three instances of dnscrypt-proxy for redundancy. Since I will be using the DNS Security Extensions, I need to find three different IPv6 servers from the dnscrypt-resolvers.csv file that are DNSSEC enabled. The three I chose are DNS Servers that are dnssec-enabled and do not keep logs.
Country Name
Netherlands dnscrypt.eu-nl-ipv6
Denmark dnscrypt.eu-dk-ipv6
Poland soltysiak-ipv6
# vi /etc/default/dnscrypt-proxy
CHROOTDIR[0]="/run/dnscrypt"
LOCALADDRESS[0]="127.0.0.1:5353"
PIDFILE[0]="/var/run/dnscrypt-proxy/dnscrypt-proxy-0.pid"
USER[0]="dnscrypt"
RESOLVERNAME[0]="dnscrypt.eu-nl-ipv6"
RESOLVERSLIST[0]="/usr/share/dnscrypt-proxy/dnscrypt-resolvers.csv"
EDNSPAYLOADSIZE[0]="4096"
LOGFILE[0]="/var/log/dnscrypt-proxy/dnscrypt-proxy-0.log"
CHROOTDIR[1]="/run/dnscrypt"
LOCALADDRESS[1]="127.0.0.1:5354"
PIDFILE[1]="/var/run/dnscrypt-proxy/dnscrypt-proxy-1.pid"
USER[1]="dnscrypt"
RESOLVERNAME[1]="dnscrypt.eu-dk-ipv6"
RESOLVERSLIST[1]="/usr/share/dnscrypt-proxy/dnscrypt-resolvers.csv"
LOGFILE[1]="/var/log/dnscrypt-proxy/dnscrypt-proxy-1.log"
CHROOTDIR[2]="/run/dnscrypt"
LOCALADDRESS[2]="127.0.0.1:5355"
PIDFILE[2]="/var/run/dnscrypt-proxy/dnscrypt-proxy-2.pid"
USER[2]="dnscrypt"
RESOLVERNAME[2]="soltysiak-ipv6"
RESOLVERSLIST[2]="/usr/share/dnscrypt-proxy/dnscrypt-resolvers.csv"
LOGFILE[2]="/var/log/dnscrypt-proxy/dnscrypt-proxy-2.log"
Save the file and exit.
Here is the format for dnscrypt-proxy if you were using different IP Addresses instead of different Ports. The Port will default to Port 53
LOCALADDRESS[0]="127.0.0.2"
LOCALADDRESS[1]="127.0.0.3"
LOCALADDRESS[2]="127.0.0.4"
Make sure the file /etc/rc.d/rc.dnscrypt-proxy is executable. If is not, then use the following command:
# chmod +x /etc/rc.d/rc.dnscrypt-proxy
Now, edit the file /etc/rc.d/rc.local and add these lines:
# Start DNSCrypt-Proxy
if [ -x /etc/rc.d/rc.dnscrypt-proxy ]; then
/etc/rc.d/rc.dnscrypt-proxy start
fi
To properly stop dnscrypt-proxy on system shutdown, add the following to /etc/rc.d/rc.local_shutdown
# vi /etc/rc.d/rc.local_shutdown
# Stop DNSCrypt-Proxy
if [ -x /etc/rc.d/rc.dnscrypt-proxy ]; then
/etc/rc.d/rc.dnscrypt-proxy stop
fi
Save the file and exit.
RESOLV.CONF AND DHCLIENT.CONF
You need to make two changes to system files in order to use Dnscrypt-Proxy and Unbound.
Here is the flow of information:
DNS Request > Unbound > Dnscrypt-Proxy (With DNSSEC Vefification)
In order to send all DNS requests through, then out to dnscrypt-proxy, you will need to update /etc/resolv.conf to point to localhost. DHCP will overwrite this file on every reboot, so you need to enter the information and make the /etc/resolv.conf file immutable. I enabled EDNS by using the "options edns0" directive.
# vi /etc/resolv.conf
nameserver 127.0.0.1
options edns0
Save the file and exit. Change the immutable attribute to make this file immutable so your DHCP System does not change this at the next reboot.
# chattr +i /etc/resolv.conf
# lsattr /etc/resolv.conf
----i---------e---- /etc/resolv.conf
NOTE - If your /etc/resolv.conf file keeps changing back to your old setting even after editing it, the reason is that the networking system is locking the file. When my computer did this, I turned off the wicd script (or NetworkManager)
# chmod -x /etc/rc.d/rc.wicd
# chmod -x /etc/rc.d/rc.networkmanager
and rebooted so that my Wireless Network was not turned on. Then I edited the file /etc/resolv.conf and made it immutable. After that I changed the rc.wicd or rc.networkmanager script to executable
# chmod +x /etc/rc.d/rc.wicd
# chmod +x /etc/rc.d/rc.networkmanager
and rebooted. The file /etc/resolv.conf accepted the changes and became immutable and everything worked fine.
If you need to edit this file again, remove the executable bit from the file:
# chattr -i /etc/resolv.conf
then edit the file, save and set the immutable bit again.
Open and edit the file /etc/dhclient.conf and add the following line:
# vi /etc/dhclient.conf
prepend domain-name-servers 127.0.0.1;
Save the file and exit.
UNBOUND SETUP/CONFIGURATION
Compile and install the application/dependencies in the following order:
perl-Sub-Uplevel-0.25
perl-Test-Exception-0.43
perl-IO-CaptureOutput-1.1104
perl-Devel-CheckLib-1.107
ldns-1.7.0
unbound-1.6.3
Create the UID/GID for Slackware before running the unbound.SlackBuild The current SlackBuild Framework (Unbound-1.5.10) works fine except you will need to add the the compile flag --enable-dnscrypt to the SlackBuild before compiling the package! You must use Unbound-1.6.2 or greater to have support for dnscrypt-proxy!
# groupadd -g 304 unbound
# useradd -r -u 304 -g 304 -d /etc/unbound/ -s /sbin/nologin -c 'Unbound DNS resolver' unbound
Now, compile and install the Unbound Package.
Move the default configuration file and create a new configuration file. The last five lines in the server section (num-threads, msg-cache-slabs, rrset-cache-slabs, infra-cache-slabs and key-cache-slabs) are tuning settings to increase throughput on a dual-core system. You can look here to see more information on tuning Unbound.
https://www.unbound.net/documentatio..._optimise.html
# mv /etc/unbound/unbound.conf /etc/unbound/unbound.conf.default
# vi /etc/unbound/unbound.conf
server:
access-control: 192.168.1.0/24 allow
root-hints: /etc/unbound/root.hints
do-not-query-localhost: no
include: /etc/unbound/adblock.nsakey.20170526
username: unbound
verbosity: 1
num-threads: 2
msg-cache-slabs: 2
rrset-cache-slabs: 2
infra-cache-slabs: 2
key-cache-slabs: 2
forward-zone:
name: "."
forward-addr: 127.0.0.1@5353 # DNSCrypt-Proxy-0
forward-addr: 127.0.0.1@5354 # DNSCrypt-Proxy-1
forward-addr: 127.0.0.1@5355 # DNSCrypt-Proxy-2
remote-control:
control-enable: yes
control-interface: 127.0.0.1
Save the configuration file and exit. If you are using different IP Addresses, this will be the format of the forward-zone section.
forward-zone:
name: "."
forward-addr: 127.0.0.2 # DNSCrypt-Proxy-0
forward-addr: 127.0.0.3 # DNSCrypt-Proxy-1
forward-addr: 127.0.0.4 # DNSCrypt-Proxy-2
UNBOUND ROOT-HINTS
Root-hints: is the file which contains the listing of primary root DNS servers. Unbound does have a listing of root DNS servers in its code, but if you want to make sure you are completely up to date we should obtain our own. Update root-hints every couple of months.
To query a hostname Unbound has to start at the top at the root DNS servers and work its way down to the authoritative servers. Download a copy of the root hints from Internic and place it in the /etc/unbound/root.hints file. This file will be called by the root-hints: directive in the unbound.conf file. To obtain this file we will use wget! Must run as root or use sudo!
The last current update is April 11, 2017
wget ftp://FTP.INTERNIC.NET/domain/named.cache -O /etc/unbound/root.hints
--2017-04-30 11:23:30-- ftp://ftp.internic.net/domain/named.cache
=> 'named.cache'
Resolving ftp.internic.net (ftp.internic.net)... 2620:0:2d0:200::9, 192.0.32.9
Connecting to ftp.internic.net (ftp.internic.net)|2620:0:2d0:200::9|:21... connected.
Logging in as anonymous ... Logged in!
==> SYST ... done. ==> PWD ... done.
==> TYPE I ... done. ==> CWD (1) /domain ... done.
==> SIZE named.cache ... 3289
==> EPSV ... done. ==> RETR named.cache ... done.
Length: 3289 (3.2K) (unauthoritative)
named.cache 100%[===================>] 3.21K --.-KB/s in 0.004s
2017-04-30 11:23:32 (820 KB/s) - '/etc/unbound/root.hints' saved [3289]
UNBOUND ADDITIONAL CONFIGURATION
Next the auto-trust-anchor! This file which contains the key for the root server so DNSSEC can be validated. We need to tell Unbound that we trust the root server so it can start to develop a chain of trust down to the hostname we want resolved and validated using DNSSEC. Again this command must be run with root privileges! Unbound has a tool to get a trust anchor just run:
# unbound-anchor
Change the file /etc/rc.d/rc.unbound to make it executable.
# chmod +x /etc/rc.d/rc.unbound
Add the following to /etc/rc.d/rc.local Be sure Unbound starts AFTER Dnscrypt-Proxy.
# vi /etc/rc.d/rc.local
# Start DNSCrypt-Proxy
if [ -x /etc/rc.d/rc.dnscrypt-proxy ]; then
/etc/rc.d/rc.dnscrypt-proxy start
fi
# Start Unbound DNS Cache Server
if [ -x /etc/rc.d/rc.unbound ]; then
/etc/rc.d/rc.unbound start
fi
Save the file and exit.
After everything is configured and setup, change the ownership of the unbound configuration files.
# chown -R unbound:unbound /etc/unbound
Now, run the unbound-control-setup command to generate the TLS Key Files.
# unbound-control-setup
setup in directory /etc/unbound
generating unbound_server.key
Generating RSA private key, 3072 bit long modulus
...........++
...........++
e is 65537 (0x10001)
generating unbound_control.key
Generating RSA private key, 3072 bit long modulus
...........++
...........++
e is 65537 (0x10001)
create unbound_server.pem (self signed certificate)
create unbound_control.pem (signed client certificate)
Signature ok
subject=/CN=unbound-control
Getting CA Private Key
Setup success. Certificates created. Enable in unbound.conf file to use
UNBOUND NSA ADBLOCKING SCRIPT
https://github.com/jodrell/unbound-block-hosts
A script to convert Dan Pollock's ad blocking hosts file into Unbound local-data format. The IP that is used is 127.0.0.1 which goes to localhost. You can covert it to 0.0.0.0 which means MXDOMAIN or "No Domain". There are approximately 70,000 entries. It gets several hosts files from 6 different websites and combines/sorts them into one big list.
When you run it, it will create a "tmp" and "lists" folder that can be deleted. The two files in the current directory are "block.conf" and "hosts". The "hosts" file can be appended to /etc/hosts if you want to adblock by that method. The "block.conf" is for use by Unbound. Edit the Unbound Configuration File /etc/unbound/unbound.conf and add the following in the server: section:
server:
include: /etc/unbound/adblock.nsakey.20170526
Save the file and exit. Here are the first 5 entries from this file so you can see the format.
local-data: "0.r.msn.com A 0.0.0.0"
local-data: "005.free-counter.co.uk A 0.0.0.0"
local-data: "006.free-adult-counters.x-xtra.com A 0.0.0.0"
local-data: "006.free-counter.co.uk A 0.0.0.0"
local-data: "0adblock.nsakey.2017050306.freecounters.co.uk A 0.0.0.0"
When you first start Unbound, you may get errors in formatting of the hosts file. I just delete the lines and try to start Unbound. The hosts script has been averaging 4 errors per run everytime I create a new unbound hosts file.
# /etc/rc.d/rc.unbound start
UNBLOCKING ADS FOR DOMAINS
Let's say you want to unblock a domain that is getting blocked by your adblocker. The domain for this example is "doubleclick.com"
$ grep -insr "doubleclick.com" /etc/unbound/adblock.nsakey.20170526
34495:local-data: "doubleclick.com A 0.0.0.0"
37497:local-data: "ftp.doubleclick.com A 0.0.0.0"
43140:local-data: "m.doubleclick.com A 0.0.0.0"
44260:local-data: "mediavisor.doubleclick.com A 0.0.0.0"
50575:local-data: "reports.doubleclick.com A 0.0.0.0"
51942:local-data: "search.doubleclick.com A 0.0.0.0"
53883:local-data: "static.doubleclick.com A 0.0.0.0"
54546:local-data: "studio.doubleclick.com A 0.0.0.0"
65140:local-data: "www.doubleclick.com A 0.0.0.0"
68473:local-data: "www2.doubleclick.com A 0.0.0.0"
68538:local-data: "www3.doubleclick.com A 0.0.0.0"
I want to unblock Line 43140 of that file. Use vi and the goto feature to find and delete the line.
# vi /etc/unbound/adblock.nsakey.20170526
Hit ESC two times. Type the line number, and then press Shift-g . If you press Esc and then Shift-g without specifying a line number, it will take you to the last line in the file.
43140:local-data: "m.doubleclick.com A 0.0.0.0"
You will be placed at Line 43140. Press dd to delete the line and :wq to save the file and exit.
Total Comments 0
