LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 08-15-2017, 10:30 PM   #1
quincey543
LQ Newbie
 
Registered: Jul 2017
Posts: 7

Rep: Reputation: Disabled
dnscrypt (nothing happens)


trying to run dnscrypt, there is no change and the dnscrypt is not working. here is the output after command input, then editing IPv4 to Automatic (DHCP) addresses only and adding the dns server 127.0.0.2
then restarting the network with command- sudo service network-manager restart




mint@mint ~ $ sudo add-apt-repository ppa:anton+/dnscrypt
You are about to add the following PPA:
Packages from Vivid 15.04 now support only systemd
__________________________________________________

A protocol for securing communications between a client and a DNS resolver.

http://dnscrypt.org/

List of free, DNSCrypt-enabled resolvers
________________________________________

To get started, you can use any of the public DNS resolvers supporting DNSCrypt.

https://github.com/jedisct1/dnscrypt...-resolvers.csv

The packaging used for this branch is maintained in the official DNSCrypt git repository.

https://github.com/jedisct1
https://github.com/jedisct1/dnscrypt-proxy
https://github.com/jedisct1/libsodium

The official sources download website are

https://download.dnscrypt.org/dnscrypt-proxy/
https://download.libsodium.org/libsodium/releases/

Add the PPA, enable source code repository as well and then run:
$ apt-get source dnscrypt-proxy
$ sha256sum dnscrypt-proxy_1.4.3.orig.tar.bz2
The output should match the output of:
$ dig +short +dnssec TXT dnscrypt-proxy-1.4.3.tar.bz2.download.dnscrypt.org
And don't forget to do the same for libsodium:
$ apt-get source libsodium
$ dig +dnssec +short TXT libsodium-1.0.1.tar.gz.download.libsodium.org
You can also build the packages by yourself with debuild or:
$ dpkg-checkbuilddeps
$ dpkg-buildpackage -rfakeroot -us -uc

[NOTE]: Ubuntu has released a libsodium source for its Wily Werewolf
********15.10 which is different in size from the upstream repository.
********See https://launchpad.net/ubuntu/+source/libsodium
********Hence I am using the tar xz compression for my packages.

To get an idea of which first local address your system is using for DNS
________________________________________________________________________

$ cat /etc/resolv.conf
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
# DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 127.0.1.1

For Trusty 14.04 and Precise 12.04 Users [UPDATE]
_________________________________________________

The published packages use Upstart.

I did create a second package named dnscrypt-proxy2 to be able to have a second DNS up and running in case the first fails (like in M$ Windows).

My packages provides already 6 resolvers defined [from file /usr/share/dnscrypt-proxy/dnscrypt-resolvers.csv] in /etc/default/dnscrypt-proxy. Just uncomment the one you would like to use and comment out the default.

The default DNS resolver 1 is set to dnscrypt.eu-nl

The first DNS is defined by package dnscrypt-proxy. By default its local address is now 127.0.1.1 So don't forget to set in System Settings --> Network Settings the DNS Server Address the same 127.0.1.1 address

The default DNS resolver 2 is set to dnscrypt.eu-dk

The second DNS is defined by package dnscrypt-proxy2. By default its local address is now 127.0.1.2 It cannot be installed alone and it's only available as an addition to dnscrypt-proxy. So don't forget to add in System Settings --> Network Settings the DNS 2 Server Address. This will be IPv4 --> DNS Servers 127.0.1.1, 127.0.1.2

Select the DNS you would like to use by its ping response time, reliability and supported features.

I will provide a second DNS as well for systemd machines when I have time.

For Vivid 15.04, Wily 15.10 and Xenial 1604 Users [UPDATE]
__________________________________________________________

The published packages use Systemd.

I did create a second package named dnscrypt-proxy2 to be able to have a second DNS up and running in case the first fails (like in M$ Windows).

The default DNS resolver 1 is set to dnscrypt.eu-nl

The first DNS is defined by package dnscrypt-proxy. By default its local address is now 127.0.1.1 So don't forget to set in System Settings --> Network Settings the DNS Server Address the same 127.0.2.1 address

The default DNS resolver 2 is set to dnscrypt.eu-dk

The second DNS is defined by package dnscrypt-proxy2. By default its local address is now 127.0.1.2 It cannot be installed alone and it's only available as an addition to dnscrypt-proxy. So don't forget to add in System Settings --> Network Settings the DNS 2 Server Address. This will be IPv4 --> DNS Servers 127.0.2.1, 127.0.2.2

If you want to change the resolver look at file /usr/share/dnscrypt-proxy/dnscrypt-resolvers.csv to get the required data. Then update the config files in /etc accordingly.

Testing which DNS Resolver your System is Using
_______________________________________________

To test which DNS your system is using please visit : https://dnsleaktest.com/

Source
______

I have used for this ppa the previous work of Sergey "Shnatsel" Davidoff with some tunings:

https://launchpad.net/~shnatsel/+arc...buntu/dnscrypt

* Using the latest sources tarballs.
* Optimizing the code for Quad Core (Compiler option -O3) instead of Core
**Duo (Compiler option -O2).
* Upgrading the Debian compat to 9 as this is placing the libraries in the
**standard Debian path instead of the RPM (Red Hat) path.
* Given the home page hijack and the kept log by US based OpenDNS, these
**packages use by default the DNSCrypt.eu server based in The Hague, Holland.
**Still you can change the DNS resolver by editing the
**/etc/default/dnscrypt-proxy section # Remote DNS(Crypt) provider settings
More info: https://launchpad.net/~anton+/+archive/ubuntu/dnscrypt
Press Enter to continue or Ctrl+C to cancel

Executing: /tmp/tmp.OdAtG8opgX/gpg.1.sh --keyserver
hkp://keyserver.ubuntu.com:80
--recv-keys
72B61DBF
gpg: requesting key 72B61DBF from hkp server keyserver.ubuntu.com
gpg: key 72B61DBF: "Launchpad PPA for Pascal Mons" not changed
gpg: Total number processed: 1
gpg: unchanged: 1
mint@mint ~ $ sudo apt-get update
Ign:1 http://packages.linuxmint.com sonya InRelease
Hit:2 http://archive.ubuntu.com/ubuntu xenial InRelease
Ign:3 http://dl.google.com/linux/chrome/deb stable InRelease
Get:4 http://security.ubuntu.com/ubuntu xenial-security InRelease [102 kB]
Hit:5 http://archive.canonical.com/ubuntu xenial InRelease
Hit:6 http://ppa.launchpad.net/anton+/dnscrypt/ubuntu xenial InRelease
Hit:7 http://packages.linuxmint.com sonya Release
Hit:9 http://dl.google.com/linux/chrome/deb stable Release
Get:10 http://archive.ubuntu.com/ubuntu xenial-updates InRelease [102 kB]
Ign:12 http://archive.ubuntu.com/ubuntu xenial-backports InRelease
Get:13 http://archive.ubuntu.com/ubuntu xenial-backports Release [101 kB]
Get:14 http://archive.ubuntu.com/ubuntu xenial-backports Release.gpg [933 B]
Fetched 306 kB in 8s (38.1 kB/s)
Reading package lists... Done
mint@mint ~ $ sudo apt-get install dnscrypt-proxy
Reading package lists... Done
Building dependency tree
Reading state information... Done
dnscrypt-proxy is already the newest version (1.6.1-1pmo3~xenial).
0 upgraded, 0 newly installed, 0 to remove and 225 not upgraded.
mint@mint ~ $ sudo service network-manager restart
mint@mint ~ $








on the tutorial video i followed, the output after restarting the network manager should be:


network-manager stop/waiting
network-manager start/running, process 3453



on a previous attempt at dnscrypt following a different tutorial with a different ppa i got a message in the terminal saying 'this ppa is not supported by xenial' but this one here installed but just doesn't activate.

what's up?
 
Old 08-16-2017, 05:23 PM   #2
AwesomeMachine
LQ Guru
 
Registered: Jan 2005
Location: USA and Italy
Distribution: Debian testing/sid; OpenSuSE; Fedora; Mint
Posts: 5,524

Rep: Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015
Is the output of the network-manager restart command the reason you think DNScrypt is not working? Your post is quite long, so perhaps I missed something. Why do you think DNScrypt is not working?
 
Old 08-16-2017, 07:52 PM   #3
quincey543
LQ Newbie
 
Registered: Jul 2017
Posts: 7

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by AwesomeMachine View Post
Is the output of the network-manager restart command the reason you think DNScrypt is not working? Your post is quite long, so perhaps I missed something. Why do you think DNScrypt is not working?

yes, and also there is no change at all. changing the IPv4 and putting the dns number in has no effect.everything remains the same as if i had made no changes. are there any other changes i need to make?
 
Old 08-16-2017, 10:23 PM   #4
AwesomeMachine
LQ Guru
 
Registered: Jan 2005
Location: USA and Italy
Distribution: Debian testing/sid; OpenSuSE; Fedora; Mint
Posts: 5,524

Rep: Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015
From your post
Quote:
To test which DNS your system is using please visit : https://dnsleaktest.com
I think you should check that first.
 
  


Reply

Tags
dns, security


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
UnBound <-> Dnscrypt-Proxy Problem Peter_APIIT *BSD 3 09-08-2015 04:10 AM
UnBound <-> Dnscrypt-Proxy Problem Peter_APIIT Linux - Software 2 09-02-2015 12:06 PM
LXer: DNSCrypt, crypt your DNS request on Linux LXer Syndicated Linux News 0 07-10-2012 03:21 AM
DNSCrypt craigevil Debian 7 03-15-2012 08:27 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 07:14 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration