Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You can run a DNS server (2025)

simonsafar.com

Post reply on HN
Print view View original

91–100 of 101 posts

Re: You can run a DNS server (2025)

#91

Post by jcalvinowens »

rdevilla wrote: post #82
jcalvinowens wrote: post #80

Earlier quoted context omitted.

I tried this too a couple months ago, OP is right, certbot doesn't support the CNAME aliases: it lacks logic to add the TXT record to the redirected name, instead of the name in the certificate. I use acme.sh which does support it: https://news.ycombinator.com/item?id=47066072

I still find this hard to believe without some actual example RRs and certbot configs, but this is HN, not serverfault.

I remember being annoyed because the docs don't actually say you can't do it: https://certbot-dns-rfc2136.readthedocs.io/en/stable/

...but they also don't say how to specify the zone to be updated like acme.sh does: https://github.com/acmesh-official/acme.sh/blob/master/dnsap...

So say you want a cert for *.foo.com, and you have:

    _acme-challenge.foo.com CNAME _acme-challenge.foo.bar.com
...I can make certbot talk to the foo.bar.com DNS server, but it tries to add the TXT record for _acme-challenge.foo.com, which that DNS server obviously rejects (and even if it accepted it, that obviously wouldn't work).

I'd be happy to hear there's a way to do it that I missed. Also I'm specifically talking about the rfc2136 support, maybe some of the proprietary certbot backends do support this.

EDIT: Here are more references:

https://github.com/certbot/certbot/issues/6566

https://github.com/certbot/certbot/pull/5350

https://github.com/certbot/certbot/pull/6644

Re: You can run a DNS server (2025)

#92

Post by throw0101d »

0x073 wrote: post #84
throw0101d wrote: post #65

Earlier quoted context omitted.

> If bad actors can create valid tls certs they can solve the dnssec problem. I think you have it backwards: by not running DNSSEC it can mean bad actors (at least a certain level) can MITM the DNS queries that are used to validate ACME certs. It is now mandated that public CAs have to verify DNSSEC before issuing a cert: * https://news.ycombinator.com/item?id=47392510 So if you want to reduce the risk of someone cre…

If you mean MITM between DNS Server and CA (e.g. letsencrypt), thats on a level of BGP hacking (means for me government involved) and means they can just use a CA (e.g. Fina CA 2025 with cloudflare). I think the risk didn't change much (except for big corp/bank).

At one point (pre-HTTPS ubiquity) the NSA hacked (e.g.) Belgium telecoms via injecting malware into web response from (e.g.) Slashdot:

* https://thehackernews.com/2013/11/snowden-reveals-gchq-plant...

* https://www.aclu.org/documents/quantum-insert-diagrams

* https://en.wikipedia.org/wiki/Man-on-the-side_attack

Still state-level, but probably less noticeable than BGP hijacking.

Unless you're entering IP addresses in all your applications and code, non-SEC DNS is an unsecured link in the chain of communications.

Re: You can run a DNS server (2025)

#93

Post by adiabatichottub »

fullstop wrote: post #75

I've been running tinydns for decades now. I don't even think about it anymore.

We did as well for about 20 years. It is a very solid program and does everything it promises. Unfortunately it lacks modern features, and development is sparse to say the least, so we ended up moving to Knot. I'd still recommend tinydns for really simple deployments, though.

Re: You can run a DNS server (2025)

#94

Post by m3047 »

1vuio0pswjnm7 wrote: post #90

You can also serve a root.zone on that DNS server and it does not have to a carbon copy of ICANN's root.zone. I have been doing this for over 15 years. I've tried many DNS server software projects over that time and I always come back to djbdns Multiple comments in this thread refer to TLS certificates Why is payment to and/or permission from a third party "necessary" to encrypt data in transit over the a computer ne…

Yes, you can have a different root zone which includes some or all of ICANN's root servers, or none of them. However if the root zone doesn't match ICANN's then DNSSEC will fail ("fruit of the poisoned tree"). But you could sign your alternate, custom root, and issue DNSSEC keys all the way down.

You don't need ICANN for TLS or encryption. You can create your own CA and sign your own certs. In fact, this is typically how it's done to authenticate for example clients of a web server using certs (you install the cert in the browser).

You can use your CA to sign a cert for your ICANN-registered domain and install it in the web server; there are no internet police who are gonna stop you. Web browsers will complain about this "self-signed cert", unless you install your CA's public key in your browser. (Security-wise, you probably shouldn't go around installing random people's CA certs in your browser. You need to trust them not to issue certs for e.g. google.com. On the other hand you need to trust China and Morocco not to do that already, so maybe you're willing to accept that risk.)

> Is obtaining a domain name registration from an "ICANN-approved" registrar proof of identity for purposes of "authentication".

People make the mistake of conflating an FQDN or address with identity all the time. People point at resources in domains which don't exist (this includes DNS resources), and people register those abandoned domains and then click "forgot password" and take over whatever account was tied to that email address in that domain.

I don't know that ICANN requires any proof. There are CAs which have enhanced identity verification, this applies to the certs they issue for both servers and clients / people.

> What purpose does _purchasing_ a registration serve.

Makes you a member of ICANN's club. There are pseudo-TLDs which are registered in ICANN's tree where you can register a (sub)domain, without interacting with ICANN at all.

Rhetorically speaking, of course.

Re: You can run a DNS server (2025)

#95

Post by m3047 »

micw wrote: post #20

I'd like to run my personal DNS server for privacy reasons on a cheap VPS. But how can I make it available to me only? There's no auth on DNS, right?

Let me address a sibling comment first:

stub resolver (client) -> OPTIONAL forwarding resolver (server) -> recursing / caching resolver (server) -> authoritative server. "Personal DNS server" doesn't disambiguate whether your objective is recursive or authoritative... or both (there is dogma about not using the same server for both auth and recursion, if you're not running your resource as a public benefit you can mostly ignore it). If it's recursive I don't know why you'd run it in the cloud and not on-prem.

You'll find that you can restrict clients based on IP address, and you can configure what interfaces / addresses the server listens on. The traditional auth / nonrepudiation mechanism is TSIG, a shared secret. Traditionally utilized for zone transfers, but it can be utilized for any DNS request.

The traditional mechanism for encryption has been tunnels (VPNs) but now we have DoH (web-based DNS requests) and DoT (literally putting nginx in front of the server as a TCP connection terminator if it's not built in). These technologies are intended to protect traffic between the client and the recursing resolver. Encryption between recursing resolvers and auths is a work in progress. DNSSEC will protect the integrity of DNS traffic between recursives and auths. I don't know how big your personal network is, for privacy / anonymity of the herd you might want to forward your local recursing resolver's traffic to a cloud-based server and co-mingle it with some additional traffic; check the servers' documentation to see if you can protect that forwarder -> recursive traffic with DoT or you're not gaining any additional privacy; it's extra credit and mostly voodoo if you don't know what you're doing. I don't bother, I let my on prem recursives reach out directly to the auths. Once the DNS traffic leaves my ISP it's all going in different directions, or at least it should be notwithstanding the pervasive centralization of what passes for the federated / distributed internet at present.

Re: You can run a DNS server (2025)

#96

Post by MayeulC »

Xylakant wrote: post #44
ssl-3 wrote: post #36

Earlier quoted context omitted.

Perhaps it seems obvious to some, but it's not obvious to me so I need to ask: What's the advantage of a selectively-available DNS for kids playing Minecraft with Nintendo Switch instead of regular DNS [whether self-hosted or not]? All I can think of is that it adds obscurity, in that it makes the address of the Minecraft server more difficult to discover or guess (and thus keeps everything a bit more private/griefin…

Ok, why would I want to do that? Because when Microsoft bought Minecraft they decided to split the ecosystem into the Java Edition (everyone playing on a computer) and Bedrock Edition (Consoles, Tablets, ...) and cross-play is not possible on the official realms. That leaves out the option to just pay and rent a realm for the group. So we're hosting our own minecraft server and a suitable connector for cross-play - a…

Thank you for the explanation, it was most interesting, I had no idea Bedrock could be coerced into talking to java servers.

Here are a few ideas:

1. Geoblocking. Not ideal, but it can make your resolver public for fewer people.

2. What if your DNS only answers queries for a single domain? Depending on the system, the fallback DNS server may handle other requests?

3. You could always hand out a device that connects to the WLAN. Think a cheap esp32. Only needs to be powered on when doing the resolution. Then you have a bit more freedom: ipv6 RADV + VPN, or try hijacking DNS queries (will not work with client isolation), or set it as resolver (may need manual config on each LAN, impractical).

4. IP whitelist, but ask them to visit a HTTP server from their LAN if it does not work (the switch has a browser, I think), this will give you the IP to allow, you can even password-protect it.

I'd say 2. Is worth a try. 4. Is easy enough to implement, but not entirely frictionless.

Re: You can run a DNS server (2025)

#97

Post by ozim »

rdevilla wrote: post #55
dwedge wrote: post #34

Earlier quoted context omitted.

Can you give me an example where this is a problem? If someone can create a CNAME they can create a TXT (ignoring the possibility of an API being restricted to just one). Without CNAME redirect I wouldn't be able to automatically renew wildcard ssl for client domains with dns that has no API. Even if they do have an API, doing it this way stops me from needing to deal with two different APIs

GP comment is just vague distilled model AI slop.

I don’t need a crutch I am perfectly capable of writing vague slop on my own thank you.

Re: You can run a DNS server (2025)

#98

Post by ozim »

dwedge wrote: post #34
ozim wrote: post #18

Earlier quoted context omitted.

I think CNAME redirections being not supported is reasonable choice. Would make my life easier as well but it opens all kinds of bad possibilities that bad actors would definitely use.

Can you give me an example where this is a problem? If someone can create a CNAME they can create a TXT (ignoring the possibility of an API being restricted to just one). Without CNAME redirect I wouldn't be able to automatically renew wildcard ssl for client domains with dns that has no API. Even if they do have an API, doing it this way stops me from needing to deal with two different APIs

People forget configurations and CNAME can be left when domain it was pointing to changes owner. Then someone unauthorized can make certs for not his domain.

Re: You can run a DNS server (2025)

#99

Post by dwedge »

ozim wrote: post #98
dwedge wrote: post #34

Earlier quoted context omitted.

Can you give me an example where this is a problem? If someone can create a CNAME they can create a TXT (ignoring the possibility of an API being restricted to just one). Without CNAME redirect I wouldn't be able to automatically renew wildcard ssl for client domains with dns that has no API. Even if they do have an API, doing it this way stops me from needing to deal with two different APIs

People forget configurations and CNAME can be left when domain it was pointing to changes owner. Then someone unauthorized can make certs for not his domain.

Ok I asked for an example and you provided one, that's fair. It also makes the second domain a target.

I had someone issue a cert on one of my subdomains because I forgot to remove DNS after cancelling a VPS, and the VPS provider didn't remove the reverse DNS so they found it. Small attack, but it happened.

Re: You can run a DNS server (2025)

#100

Post by [deleted] »

adiabatichottub wrote: post #4
gerdesj wrote: post #2

I've run DNS servers in the past - BIND and pdns. I've now gone all in ... because ... well it started with ACME. As the OP states you can get a registrar to host a domain for you and then you create a subdomain anywhere you fancy and that includes at home. Do get the glue records right and do use dig to work out what is happening. Now with a domain under your own control, you can use CNAME records in other zones to…

I'm a fan of uACME: https://github.com/ndilieto/uacme Tiny, simple, reliable. What more can you ask?

[deleted]
Post reply on HN