Alternative DNS Resolver

From Whonix
(Redirected from Secondary DNS Resolver)
Jump to navigation Jump to search

Authenticated/Encrypted DNS over Tor, DNSSEC over Tor, DNSCrypt by OpenDNS, httpsdnsd by JonDos

Introduction[edit]

By Whonix™ default, Tor is used for DNS resolution. If you suspect a Tor exit relay to tamper with DNS, you can get a second opinion from another non-Tor DNS server. This may also be useful, in special cases if you want to resolve types of DNS over Tor, which are unsupported by Tor itself, such as MX [1], SRV or DNSSEC. [2]

It is recommended against to use non-Tor DNS resolvers for an extended amount of time. Although it is technically possible to completely replace DNS resolution (not using Tor for DNS resolution anymore), it is recommended against. That would add too much power to a single DNS server. Using a permanent DNS server is recommended against just as using a permanent Tor exit relay is recommended against.

Note, that even if you correctly set up all settings, it might happen that this won't work. Sometimes Tor or the DNS server causes a timeout. This gets even worse, when you additionally tunnel the DNS request through an additional proxy (for example: Tor → JonDonym → DNS server).

Read first: Stream Isolation.

Required knowledge:

Note that most applications, such as Tor Browser, will not automatically profit from setting up an alternative DNS resolver.

  • This is because applications in Whonix are configured to use SocksPort instead of Trans- or DnsPort, see Stream Isolation for details.
  • Another reason is, that many applications do not yet make use of authenticated DNS (DNSSEC).

However, you could use alternative DNS revolvers with these applications when deconfiguring socks proxy settings.

For example, Tor Browser would be unaffected by these changes alone. In theory, a user that intended to change Tor Browser DNS settings would have to enable transparent proxying in Tor Browser which however is discouraged as this changes the web fingerprint.

Advanced users only!

Recursive Authenticated DNSSEC over Tor[edit]

Introduction[edit]

DNSSEC aware, DNSSEC validating, recursive DNS resolution over TCP, over Tor using Unbound. Unencypted, because Root name serversarchive.org do not support encryption yetarchive.org, there is a DNS Security Optimization Problemarchive.org.

These instructions completely replace Tor's DNS resolver the whole Whonix-Workstation™. Not recommended for a longer amount of time, see warning above.

Installation[edit]

Everything inside Whonix-Workstation™.

1. Create folder /etc/unbound/unbound.conf.d.

mkdir --parents /etc/unbound/unbound.conf.d

2. Unbound configuration.

Open file /etc/unbound/unbound.conf.d/50_user.conf in an editor with root rights.

Non-Qubes-Whonix™

This box uses sudoedit for better security.

Qubes-Whonix™

NOTE: When using Qubes-Whonix, this needs to be done inside the Template.

Others and Alternatives

  • This is just an example. Other tools could achieve the same goal.
  • If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /etc/unbound/unbound.conf.d/50_user.conf

3. Paste the following lines.

server: hide-identity: yes hide-version: yes interface: 127.0.0.1 do-ip6: no tcp-upstream: yes ## TODO: onion resolution over Tor-only does not work yet. ## Please use search engines, see unbound documentation, ## find out how to fix this and improve this documentation! ## ## Optional to leave resolving onion to Tor. ## Feel free to comment the following 4 lines out, ## but this would break onion resolving since unbound ## cannot resolve '.onion' domains. #forward-zone: # name: "onion" # forward-addr: 10.152.152.10@9050 # forward-no-cache: yes

4. Save.

5. Install dnssec-trigger, which automatically installs and configures the unbound DNS resolver.

Install package(s) dnssec-trigger.

A. Update the package lists and upgrade the systemarchive.org.

sudo apt update && sudo apt full-upgrade

B. Install the dnssec-trigger package(s).

Using apt command line parameter --no-install-recommendsarchive.org is in most cases optional.

sudo apt install --no-install-recommends dnssec-trigger

C. Done.

The procedure of installing package(s) dnssec-trigger is complete.

6. Done.

7. Testing DNSSECarchive.org

DNSCrypt[edit]

Introduction[edit]

DNSCrypt supports encryption, DNSSEC but DNSCrypt does not validate DNSSEC signatures yetarchive.org. [10]

These instructions completely replace Tor's DNS resolver with a dnscrypt-enabled resolver for all users and the whole Whonix-Workstation™. Not recommended for a longer amount of time, see warning above.

Installation[edit]

Apply all instructions inside your Whonix-Workstation.

1) Install the dnscrypt-proxy package.

Install package(s) dnscrypt-proxy.

A. Update the package lists and upgrade the systemarchive.org.

sudo apt update && sudo apt full-upgrade

B. Install the dnscrypt-proxy package(s).

Using apt command line parameter --no-install-recommendsarchive.org is in most cases optional.

sudo apt install --no-install-recommends dnscrypt-proxy

C. Done.

The procedure of installing package(s) dnscrypt-proxy is complete.

2) Open file /etc/dnscrypt-proxy/dnscrypt-proxy.toml in an editor with root rights.

Non-Qubes-Whonix™

This box uses sudoedit for better security.

Qubes-Whonix™

NOTE: When using Qubes-Whonix, this needs to be done inside the Template.

Others and Alternatives

  • This is just an example. Other tools could achieve the same goal.
  • If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /etc/dnscrypt-proxy/dnscrypt-proxy.toml

Add the following text at the very top of the file. Note: The default server did not work for the author of this page. Therefore the following instructions advice to comment that server out and add a random alternative server was chosen which worked. [11] This is not an endorsement or non-endorsement of any server. Pick your own server. DNSCrypt publishes a list of servers herearchive.org.

force_tcp = true #proxy = "socks5://127.0.0.1:9050" server_names = ['arvind-io']

Comment out:

server_names = ['cloudflare']

In other words, rewrite server_names = ['cloudflare'] to #server_names = ['cloudflare'] by adding a hash # in front of it. So it would look like this.

#server_names = ['cloudflare']

Save.

Restart dnscrypt-proxy.service.

sudo systemctl restart dnscrypt-proxy.service

Restart dnscrypt-proxy.socket.

sudo systemctl restart dnscrypt-proxy.socket

3) Open file /etc/resolv.conf in an editor with root rights.

Non-Qubes-Whonix™

This box uses sudoedit for better security.

Qubes-Whonix™

NOTE: When using Qubes-Whonix, this needs to be done inside the Template.

Others and Alternatives

  • This is just an example. Other tools could achieve the same goal.
  • If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /etc/resolv.conf

4) Comment out everything and add [12] (It is not 127.0.0.1. It really is 127.0.2.1.):

options use-vc nameserver 127.0.2.1

Save.

Testing[edit]

DNSCrypt In Use[edit]

Stop dnscrypt-proxy systemd socket.

sudo systemctl stop dnscrypt-proxy.socket

Test again. Now it is expected to fail.

Restart dnscrypt-proxy systemd socket.

sudo systemctl restart dnscrypt-proxy.socket

Test again. Now it is expected to work.

FAQ[edit]

Why not Use DNSCrypt by Default in Whonix?[edit]

DNSCryptarchive.org may have good use cases for clearnet activities. However, it is not useful in Whonix and therefore should not be installed and activated by default for everyone. Although some users may have high expectations, DNSCrypt does not magically solve all DNS-related security issues, nor does it implement end-to-end DNS encryption to the destination server. [13] Most important of all, the server will still see all DNS requests in cleartext. [14]

There are several other reasons why DNSCrypt is not activated by default. Firstly, Tor distributes trust because the DNS server changes as circuits are rotated. For pre-installed applications, circuits are also stream-isolated and change every ten minutes by default. Notably, in early 2018 there are 78 open resolversarchive.org that support the protocol.

Public resolvers supporting DNSCrypt have not yet acted in a way to cause mistrust. However, even if the operators were absolutely trustworthy, complete confidence is also needed in their servers - it is unwise to let the DNS security for all Whonix users depend on a few servers. Another consideration is load balancing. If Whonix relied upon a DNSCrypt supporting server by default, DNS would break for all users if that server ever decided to forbid connections from the Tor network [15] or if the servers went down for maintenance.

Would result in a unique web fingerprint, i.e. visited websites can distinguish Whonix users using DNSCrypt from other Tor users using Tor to resolve DNS.

Can I Use DNSCrypt on the Host or Router for Clearnet?[edit]

This configuration is possible; read the next section before proceeding.

Does DNSCrypt on the Host or Router Harm Anonymity when Using Tor / Whonix?[edit]

The short answer to this question is no. The longer answer is DNSCrypt on the host or in the router only affects clearnet activities. Tor assumes in advance that a user's local network and ISP are completely unsafe and untrustworthy. Tor and Whonix are unaffected by DNS settings that are made on the host or in the router.

It is debatable whether DNSCrypt is useful or not for clearnet activities since there are various pros and cons. It is useful when using foreign or untrusted Wi-Fi networks that are shared with others, since DNS requests could potentially be modified or read. That said, trust is just shifted from the ISP to a DNSCrypt-supporting DNS server, such as OpenDNS. If the DNS server supporting DNSCrypt leaks a user's network address and/or logs queries as part of their business model, then it might actually be worse than using the ISP! It is hard to mount an argument for which party is more trustworthy, the ISP or a third party provider.

Footnotes[edit]

  1. ↑ Required for some Mixmaster servers over Tor.
  2. ↑
  3. ↑ Starting from Whonix version 0.2.1, traffic from Whonix-Gateway is also routed over Tor. This approach conceals the use of Whonix from entities monitoring the network.
  4. ↑ For preserving the anonymity of a user's Whonix-Workstation activities, it isn't essential to route Whonix-Gateway's own traffic through Tor.
  5. ↑ For those interested: Altering DNS settings on Whonix-Gateway in /etc/resolv.conf only impacts DNS requests made by Whonix-Gateway's applications that utilize the system's default DNS resolver. By default, no applications on Whonix-Gateway that generate network traffic utilize this default resolver. All default applications on Whonix-Gateway that produce network traffic (like apt, systemcheckarchive.org, sdwdate) are explicitly configured, or force by uwt wrappers, to use their dedicated Tor SocksPort (refer to Stream Isolation).
  6. ↑ Whonix-Workstation's default applications are configured to use dedicated Tor SocksPorts (see Stream Isolation), avoiding the system's default DNS resolver. Any applications in Whonix-Workstation not set up for stream isolation - such as nslookup - will employ the default DNS server configured in Whonix-Workstation (through /etc/network/interfaces), which points to Whonix-Gateway. These DNS requests are then redirected to Tor's DnsPort by the Whonix-Gateway firewall. Changes in Whonix-Gateway's /etc/resolv.conf don't influence Whonix-Workstation's DNS queries.
  7. ↑ Traffic produced by the Tor process, which by Debian's default operates under the user debian-tor originating from Whonix-Gateway, can access the internet directly. This is permitted because Linux user account debian-tor is exempted in the Whonix-Gateway Firewall and allowed to use the "regular" internet.
  8. ↑ Tor version 0.4.5.6 (with no changes announced at the time of writing), the Tor software predominantly relies on TCP traffic. For further details, see Tor wiki page, chapter UDP. For DNS, please refer to the next footnote.
  9. ↑ Tor doesn't depend on, nor uses a functional (system) DNS for most of its operations. IP addresses of Tor directory authorities are hardcoded in the Tor software by Tor developers. Exceptions are:
    • Proxy settings that use proxies with domain names instead of IP addresses.
    • Some Tor pluggable transports such as meek lite, which resolves domains set in url= and front= to IP addresses or snowflake's -front.
  10. ↑ Quote https://github.com/DNSCrypt/dnscrypt-proxy/issues/167#issuecomment-367689381archive.org

    dnscrypt-proxy doesn't validate dnssec signatures yet :)
  11. ↑ Test was done using: dig +dnssec google.com
  12. ↑ options use-vc is optional as in it also works without it.
  13. ↑ Conceptually, end-end DNS encryption is illogical. If the IP address of the destination server was known in advance, then DNS would not be required in the first place.
  14. ↑ https://security.stackexchange.com/questions/162601/what-are-the-privacy-advantages-of-a-dns-encryption-service-such-as-dnscryptarchive.org
  15. ↑ Due to the Tor network abuse such as DDOS attacks on their servers.
Your support makes
all the difference!

We believe security software like Whonix needs to remain open source and independent. Would you help sustain and grow the project? Learn more about our 10 year success story and maybe DONATE!

Retrieved from "https://www.whonix.org/w/index.php?title=Alternative_DNS_Resolver&oldid=96967"