Pubblicità
cat /etc/resolv.conf
cat /etc/resolv.conf.head
itx@itx-MS-7851:~$ cat /etc/resolv.conf
nameserver 8.8.8.8
itx@itx-MS-7851:~$ cat /etc/resolv.conf.head
# dns.watch IPv4 nameservers
nameserver 84.200.69.80 # resolver1.dns.watch
nameserver 84.200.70.40 # resolver2.dns.watch
itx@itx-MS-7851:~$ma vuoi vedere che ubuntu non "protegge" il resolv.conf e che quindi puoi scriverlo senza problemi? OMG! :cav:
sudo apt install dnscrypt-proxy
sudo systemctl stop dnscrypt-proxy.service
sudo systemctl stop dnscrypt-proxy.socketsudo nano /etc/dnscrypt-proxy/dnscrypt-proxy.confsudo systemctl daemon-reload
sudo systemctl start dnscrypt-proxy.service
sudo systemctl status dnscrypt-proxy.servicesudo nano /etc/resolv.confnameserver 127.0.0.1######################################################
# #
# Sample configuration file for dnscrypt-proxy #
# #
######################################################
############## Resolver settings ##############
## [CHANGE THIS] Short name of the resolver to use
## Usually the only thing you need to change in this configuration file.
## This corresponds to the first column in the dnscrypt-resolvers.csv file.
## Alternatively, "random" (without quotes) picks a random random resolver
## accessible over IPv4, that doesn't log and supports DNSSEC.
ResolverName dnscrypt.eu-nl
## Full path to the list of available DNSCrypt resolvers (dnscrypt-resolvers.csv)
## An up-to-date list is available here:
## https://download.dnscrypt.org/dnscrypt-proxy/dnscrypt-resolvers.csv
## and the dnscrypt-update-resolvers.sh script can be used in order to
## automatically download and verify updates.
# ResolversList /usr/local/share/dnscrypt-proxy/dnscrypt-resolvers.csv
## Manual settings, only for a custom resolver not present in the CSV file
# ProviderName 2.dnscrypt.resolver.example
# ProviderKey E801:B84E:A606:BFB0:BAC0:CE43:445B:B15E:BA64:B02F:A3C4:AA31:AE10:636A:0790:324D
# ResolverAddress 203.0.113.1:443
############## Process options ##############
## [NOT AVAILABLE ON WINDOWS] Run the proxy as a background process.
## Unless you are using systemd, you probably want to change this to "yes"
## after having verified that the rest of the configuration works as expected.
Daemonize no
## Write the PID number to a file
## If "User" is defined, having a PID file will spawn an additional,
## minimal process, whose sole purpose is to delete the PID file
## after the main process exits.
# PidFile /var/run/dnscrypt-proxy.pid
## [NOT AVAILABLE ON WINDOWS] Start the process, bind the required ports, and
## run the server as a less-privileged system user.
## The value for this parameter is a user name.
# User _dnscrypt-proxy
############## Network/protocol settings ##############
## Local address and port to listen to.
## A 127.0.0.x address is recommended for local use, but 0.0.0.0 or
## a specific interface address can be used on a router, or to
## configure a single machine to act as a DNS proxy for different
## devices.
## If the socket is created by systemd, the proxy cannot change the address
## using this option. You should edit systemd's dnscrypt-proxy.socket file
## instead.
# LocalAddress 127.0.0.1:53
## Cache DNS responses to avoid outgoing traffic when the same queries
## are repeated multiple times in a row.
LocalCache on
## Creates a new key pair for every query.
## This prevents logging servers from correlating client public keys with
## IP addresses. However, this option implies extra CPU load, and is not
## very useful with trusted/non-logging servers.
EphemeralKeys off
## Maximum number of active requests waiting for a response.
## Keep it reasonable relative to the expected number of clients.
# MaxActiveRequests 250
## This is the maximum payload size allowed when using the UDP protocol.
## The default is safe, and rarely needs to be changed.
# EDNSPayloadSize 1252
## Ignore the time stamps when checking the certificates
## Do not enable this option ever, unless you know that you need it.
# IgnoreTimestamps no
## Do not send queries using UDP. Only use TCP.
## Even if some resolvers mitigate this, DNS over TCP is almost always slower
## than UDP and doesn't offer additional security.
## Only enable this option if UDP doesn't work on your network.
# TCPOnly no
############## Logging ##############
## Log the received DNS queries to a file, so you can watch in real-time what
## is happening on the network.
## The value for this parameter is a full path to the log file.
## The file name can be prefixed with ltsv: in order to store logs using the
## LTSV format (ex: ltsv:/tmp/dns-queries.log).
# QueryLogFile /tmp/dns-queries.log
## Log file to write server errors and information to.
## If you use this tool for privacy, keeping logs of any kind is usually not
## a good idea.
# LogFile /var/log/dnscrypt-proxy.log
## Don't log events with priority above this log level after the service has
## been started up. Default is 6.
## Valid values are between 0 (critical) to 7 (debug-level messages).
# LogLevel 6
## [NOT AVAILABLE ON WINDOWS] Send server logs to the syslog daemon
## Log entries can optionally be prefixed with a string.
# Syslog off
# SyslogPrefix dnscrypt
############## Local filtering ##############
## If your network doesn't support IPv6, chances are that your
## applications are still constantly trying to resolve IPv6 addresses,
## causing unnecessary slowdowns.
## This causes the proxy to immediately reply to IPv6 requests,
## without having to send a useless request to upstream resolvers, and
## having to wait for a response.
## This uses a plugin that requires dnscrypt-proxy to be compiled with
## the ldns library.
BlockIPv6 no
## Want to filter ads, malware, sensitive or inappropriate websites and
## domain names? This feature can block lists of IP addresses and names
## matching a list of patterns. The list of rules remains private, and
## the filtering process directly happens on your own network. In order
## to filter IP addresses, the list of IPs has to be put into a text
## file, with one IP address per line. Lists of domain names can also be
## blocked as well. Put the list into a text file, one domain per line.
## Domains can include wildcards (*) in order to match patterns. For
## example *sex* will match any name that contains the sex substring, and
## ads.* will match anything starting with ads. The Internet has plenty
## of free feeds of IP addresses and domain names used for malware,
## phishing and spam that you can use with this feature.
##
## This uses a plugin that requires dnscrypt-proxy to be compiled with
## the ldns library.
##
## To enable, uncomment one of the following definitions:
## Block query names matching the rules stored in that file:
# BlackList domains:"/etc/dnscrypt-blacklist-domains.txt"
## Block responses whose IP addresses match IPs stored in that file:
# BlackList ips:"/etc/dnscrypt-blacklist-ips.txt"
## Block both domain names and IP addresses:
# BlackList domains:"/etc/dnscrypt-blacklist-domains.txt" ips:"/etc/dnscrypt-blacklist-ips.txt"
## Same as the above + log the blocked queries in a file.
## The log file can be prefixed with ltsv: (ex: ltsv:/tmp/log.txt) in order to
## store logs using the LTSV format.
# BlackList domains:"/etc/dnscrypt-blacklist-domains.txt" logfile:"/var/log/dnscrypt-blocked.log"
# BlackList ips:"/etc/dnscrypt-blacklist-ips.txt" logfile:"/var/log/dnscrypt-blocked.log"
# BlackList domains:"/etc/dnscrypt-blacklist-domains.txt" ips:"/etc/dnscrypt-blacklist-ips.txt" logfile:"/var/log/dnscrypt-blocked.log"
############## Forwarding ##############
## Forward queries for specific zones to one or more non-DNSCrypt resolvers.
## For instance, this can be used to redirect queries for local domains to
## the router, or queries for an internal domain to an internal DNS server.
## Multiple whitespace-delimited zones and IP addresses can be specified.
## Do not enable this unless you absolutely know you need it.
## If you see useless queries to these zones, you'd better block them with
## the BlackList feature instead of sending them in clear text to the router.
## This uses a plugin that requires dnscrypt-proxy to be compiled with
## the ldns library.
# Forward domains:"test private localdomain lan" to:"192.168.100.254"
############## User identification ##############
## Use a client public key for identification
## By default, the client uses a randomized key pair in order to make tracking
## more difficult. This option does the opposite and uses a static key pair, so
## that DNS providers can offer premium services to queries signed with a known
## set of public keys. A client cannot decrypt the received responses without
## also knowing the secret key.
## The value for this property is the path to a file containing the secret key,
## encoded as a hexadecimal string. The corresponding public key is computed
## automatically.
# ClientKey /etc/dnscrypt-client-secret.key
############## Monitoring ##############
## Do not actually start the proxy, but check that a valid certificate can be
## retrieved from the server and that it will remain valid for the specified
## time period. The process exit code is 0 if a valid certificate can be used,
## 2 if no valid certificates can be used, 3 if a timeout occurred, and 4 if a
## currently valid certificate is going to expire before the given margin.
## Useful in a cron job to monitor your own dnscrypt-servers.
## The margin is specified in minutes.
# Test 2880
############## Recursive configuration ##############
## A configuration file can include other configuration files by inserting
## the `Include` directive anywhere (the full path required, no quotes):
# Include /etc/dnscrypt-proxy-common.confitx@itx-MS-7851:~$ sudo su
sudo: impossibile risolvere l'host itx-MS-7851
[sudo] password di itx:
root@itx-MS-7851:/home/itx# sudo apt install dnscrypt-proxy
sudo: impossibile risolvere l'host itx-MS-7851
Lettura elenco dei pacchetti... Fatto
Generazione albero delle dipendenze
Lettura informazioni sullo stato... Fatto
I seguenti pacchetti NUOVI saranno installati:
dnscrypt-proxy
0 aggiornati, 1 installati, 0 da rimuovere e 8 non aggiornati.
È necessario scaricare 0 B/126 kB di archivi.
Dopo quest'operazione, verranno occupati 446 kB di spazio su disco.
Selezionato il pacchetto dnscrypt-proxy non precedentemente selezionato.
(Lettura del database... 535488 file e directory attualmente installati.)
Preparativi per estrarre .../dnscrypt-proxy_1.6.1-1_amd64.deb...
Estrazione di dnscrypt-proxy (1.6.1-1)...
Elaborazione dei trigger per systemd (229-4ubuntu21)...
Elaborazione dei trigger per ureadahead (0.100.0-19)...
ureadahead will be reprofiled on next reboot
Elaborazione dei trigger per man-db (2.7.5-1)...
Configurazione di dnscrypt-proxy (1.6.1-1)...
Job for dnscrypt-proxy.service failed because the control process exited with error code. See "systemctl status dnscrypt-proxy.service" and "journalctl -xe" for details.
invoke-rc.d: initscript dnscrypt-proxy, action "start" failed.
● dnscrypt-proxy.service - DNSCrypt proxy
Loaded: loaded (/lib/systemd/system/dnscrypt-proxy.service; enabled; vendor preset: enabled)
Active: activating (auto-restart) (Result: exit-code) since dom 2017-12-31 18:43:14 CET; 19ms ago
Docs: man:dnscrypt-proxy(8)
Process: 14862 ExecStart=/usr/sbin/dnscrypt-proxy --resolver-name=${DNSCRYPT_PROXY_RESOLVER_NAME} $DNSCRYPT_PROXY_OPTIONS (code=exited, status=1/FAILURE)
Main PID: 14862 (code=exited, status=1/FAILURE)
dic 31 18:43:14 itx-MS-7851 systemd[1]: dnscrypt-proxy.service: Failed with ....
Hint: Some lines were ellipsized, use -l to show in full.
dpkg: errore nell'elaborare il pacchetto dnscrypt-proxy (--configure):
il sottoprocesso installato script di post-installation ha restituito lo stato di errore 1
Elaborazione dei trigger per systemd (229-4ubuntu21)...
Elaborazione dei trigger per ureadahead (0.100.0-19)...
Si sono verificati degli errori nell'elaborazione:
dnscrypt-proxy
E: Sub-process /usr/bin/dpkg returned an error code (1)
root@itx-MS-7851:/home/itx#itx@itx-MS-7851:~$ sudo systemctl status dnscrypt-proxy.service
sudo: impossibile risolvere l'host itx-MS-7851
● dnscrypt-proxy.service - DNSCrypt proxy
Loaded: loaded (/lib/systemd/system/dnscrypt-proxy.service; enabled; vendor p
Active: active (running) since dom 2017-12-31 19:57:38 CET; 18s ago
Docs: man:dnscrypt-proxy(8)
Main PID: 30118 (dnscrypt-proxy)
CGroup: /system.slice/dnscrypt-proxy.service
└─30118 /usr/sbin/dnscrypt-proxy --resolver-name=cisco
dic 31 19:57:38 itx-MS-7851 dnscrypt-proxy[30118]: [WARNING] - [cisco] logs your
dic 31 19:57:38 itx-MS-7851 dnscrypt-proxy[30118]: [NOTICE] Starting dnscrypt-pr
dic 31 19:57:38 itx-MS-7851 dnscrypt-proxy[30118]: [INFO] Generating a new sessi
dic 31 19:57:38 itx-MS-7851 dnscrypt-proxy[30118]: [INFO] Done
dic 31 19:57:38 itx-MS-7851 dnscrypt-proxy[30118]: [INFO] Server certificate #14
dic 31 19:57:38 itx-MS-7851 dnscrypt-proxy[30118]: [INFO] This certificate is va
dic 31 19:57:38 itx-MS-7851 dnscrypt-proxy[30118]: [INFO] Chosen certificate #14
dic 31 19:57:38 itx-MS-7851 dnscrypt-proxy[30118]: [INFO] Server key fingerprint
dic 31 19:57:38 itx-MS-7851 dnscrypt-proxy[30118]: [NOTICE] Proxying from 127.0.
dic 31 19:57:38 itx-MS-7851 systemd[1]: Started DNSCrypt proxy.
lines 1-18/18 (END)sudo nano /etc/dnscrypt-proxy.confsembra partito...
itx@itx-MS-7851:~$ sudo systemctl status dnscrypt-proxy.service
sudo: impossibile risolvere l'host itx-MS-7851
[sudo] password di itx:
● dnscrypt-proxy.service - DNSCrypt proxy
Loaded: loaded (/lib/systemd/system/dnscrypt-proxy.service; enabled; vendor p
Active: active (running) since dom 2017-12-31 23:40:31 CET; 57min left
Docs: man:dnscrypt-proxy(8)
Main PID: 1200 (dnscrypt-proxy)
CGroup: /system.slice/dnscrypt-proxy.service
└─1200 /usr/sbin/dnscrypt-proxy --resolver-name=cisco
dic 31 23:40:26 itx-MS-7851 dnscrypt-proxy[1200]: [WARNING] - [cisco] logs your
dic 31 23:40:26 itx-MS-7851 dnscrypt-proxy[1200]: [NOTICE] Starting dnscrypt-pro
dic 31 23:40:26 itx-MS-7851 dnscrypt-proxy[1200]: [INFO] Generating a new sessio
dic 31 23:40:26 itx-MS-7851 dnscrypt-proxy[1200]: [INFO] Done
dic 31 23:40:31 itx-MS-7851 dnscrypt-proxy[1200]: [INFO] Server certificate #149
dic 31 23:40:31 itx-MS-7851 dnscrypt-proxy[1200]: [INFO] This certificate is val
dic 31 23:40:31 itx-MS-7851 dnscrypt-proxy[1200]: [INFO] Chosen certificate #149
dic 31 23:40:31 itx-MS-7851 dnscrypt-proxy[1200]: [INFO] Server key fingerprint
dic 31 23:40:31 itx-MS-7851 dnscrypt-proxy[1200]: [NOTICE] Proxying from 127.0.2
dic 31 23:40:31 itx-MS-7851 systemd[1]: Started DNSCrypt proxy.
lines 1-18/18 (END)itx@itx-MS-7851:~$ cat /lib/systemd/system/dnscrypt-proxy.socket
[Unit]
Description=dnscrypt-proxy listening socket
Documentation=man:dnscrypt-proxy(8)
After=network.target
Wants=dnscrypt-proxy-resolvconf.service
[Socket]
ListenStream=127.0.2.1:53
ListenDatagram=127.0.2.1:53
[Install]
WantedBy=sockets.target
itx@itx-MS-7851:~$sudo systemctl stop dnscrypt-proxy.service dnscrypt-proxy.socket
sudo nano /lib/systemd/system/dnscrypt-proxy.socketsudo systemctl start dnscrypt-proxy.service
)
bella marck, bentornato! iniziavo a sentire la tua mancanza e stavo per affogare tutta la mia solitudine nella birra analcolica... dato che non posso nemmeno bere :'(
il "lampo di genio" si è rivelato corretto! quel disgraziato di systemd richiede la configurazione dell'ip nel .socket e non nel .conf (colpa mia, mi ero dimenticato di questa cosa. riguardando il sample del .conf ho visto la riga di commento e mi sono ricordato)
segui in ordine:
poi editi i due indirizzi ip sotto [Socket], in modo che siano entrambi 127.0.0.1 (e non 127.0.2.1:53).Codice:sudo systemctl stop dnscrypt-proxy.service dnscrypt-proxy.socket sudo nano /lib/systemd/system/dnscrypt-proxy.socket
salva, esci
fine. se ho ragione, finalmente dnsleaktest ci darà ragione :luxhello:Codice:sudo systemctl start dnscrypt-proxy.service
dai su, che iniziamo il 2018 col botto ahuahuahuah (poi ritorneremo nella depressione, configurando tails)