Posted by: deanhills - 02-12-2020, 08:24 AM - Forum: Announcements
- No Replies
Please note that if you see Hidden Refuge's user name in regular member blue, this doesn't mean he is no longer our Technical Consultant. It just means that he is busy, he is still looking at posts, but he can't contribute those wonderful long technical support responses as he had in the past. For most of the time.
Please note that Hidden has been spoiling us with his excellent support. Members who have benefited from this have been very lucky, as with some he had assisted them even to the level of active direct support. That is not what the role of Technical Consultant is expected to be. But he's been helping as a community effort when he had time to do so. He no longer has that time available as he is back at work and providing his best there now.
Please note that when you get a VPS you are supposed to be able to administrate and manage it yourself. That is the expectation when a VPS is given to you. Support in general is only expected to be for those who do not have Admin Panels or when extreme technical occurrences happen such as a VPS going off line. However, since we are a community forum, we are lucky to have very talented contributors as well, who will help you if and when they are available to do so. But please don't look at that as a given, and only look at this as a voluntary gift. As all of what you see happening here is really due to voluntary effort of both members and staff here.
Please note that Hidden has been spoiling us with his excellent support. Members who have benefited from this have been very lucky, as with some he had assisted them even to the level of active direct support. That is not what the role of Technical Consultant is expected to be. But he's been helping as a community effort when he had time to do so. He no longer has that time available as he is back at work and providing his best there now.
Please note that when you get a VPS you are supposed to be able to administrate and manage it yourself. That is the expectation when a VPS is given to you. Support in general is only expected to be for those who do not have Admin Panels or when extreme technical occurrences happen such as a VPS going off line. However, since we are a community forum, we are lucky to have very talented contributors as well, who will help you if and when they are available to do so. But please don't look at that as a given, and only look at this as a voluntary gift. As all of what you see happening here is really due to voluntary effort of both members and staff here.
Posted by: deanhills - 02-12-2020, 07:58 AM - Forum: Announcements
- No Replies
Please note that if you make a post in the Movie Sub-Forum that you are scoring credit points.
The same rules apply for the posts that are created in the hobby section as anywhere else in the Forum. There has to be discussion in the post in your own words. And if you copy paste something, you have to follow the Forum rule of putting it in quotes AND providing a link to the source of the quote.
If you list a movie, you have to tell us when you watched it. What was the movie about? Did you enjoy watching it? Why are you listing it in the movie section? Do you recommend it for other members to view and why? Or did you think it was a iffy or not really a good experience to watch and why do you think so.
Here is an example of a quality post with unique discussion in the member's own words in the "The Last movie you watched" thread:
Regarding music. The same thing. Don't list a song every day - spread your posts out across the Forum. Use this section sparingly, and if you do use it, then try to put some discussion in it in your own words.
Like here is an example in the "What are you listening to right now?" thread of a good post:
The same rules apply for the posts that are created in the hobby section as anywhere else in the Forum. There has to be discussion in the post in your own words. And if you copy paste something, you have to follow the Forum rule of putting it in quotes AND providing a link to the source of the quote.
If you list a movie, you have to tell us when you watched it. What was the movie about? Did you enjoy watching it? Why are you listing it in the movie section? Do you recommend it for other members to view and why? Or did you think it was a iffy or not really a good experience to watch and why do you think so.
Here is an example of a quality post with unique discussion in the member's own words in the "The Last movie you watched" thread:
(01-31-2020, 10:09 AM)sohamb03 Wrote: Watched the Indian movie, 'Chichchore', a couple of days ago. TBH I didn't like the movie at all. All that was good in the movie was it's plot, and nothing else.
The acting wasn't up to the mark considering the great actors who were casted in the movie, the language was awful and what I didn't like especially was the mention of sexual stuff time and again.
Just bcuz you mention such things again and again doesn't mean you're gaining popularity. Maybe it's appealing to that type of crowd, but for me and people of my standards, it doesn't deserve even a character of appreciation.
Was I to rate it it'd be anywhere between 0 to 1.5 out of 10 depending on my mood at that time. Overall not recommended, even watching Toy Story series would be productive.
Regards,
Regarding music. The same thing. Don't list a song every day - spread your posts out across the Forum. Use this section sparingly, and if you do use it, then try to put some discussion in it in your own words.
Like here is an example in the "What are you listening to right now?" thread of a good post:
ikk157 Wrote:Currently listening to My heart will go on (club remix)Source: https://post4vps.com/Thread-What-are-you...7#pid33627
https://youtu.be/557IR0VckTM
I like how they made a classic song into a much faster paced club version, definitely makes it way better in my opinion!
I have been looking at NodeBB and vanillaForums for a while now. I have been using SMF and myBB for a very long time but for a new forum I'm going to create I need something very very moblie friendly. SMF is little too heavy for this and even thought I love myBB it really not so good when it comes to reponsiveness. There are workarounds but these create their own problems. I know myBB 2.0 not gonna happen in next decade or so and I have been waiting for Beta of myBB 1.9 since 2017. So I think it's time for move on. At least for my new projects. 3 options I'm thinking right now are,
- bbPress
- NodeBB
- VanillaForums
Please help me, I just encountered an error like this:
We are not able to run rpm...
![[Image: Dh94dze.png]](https://i.imgur.com/Dh94dze.png)
Please help, thanks so much
We are not able to run rpm...
![[Image: Dh94dze.png]](https://i.imgur.com/Dh94dze.png)
Please help, thanks so much
Well, I won the VPS 12 in the 53rd Giveaway and I'm very happy with this VPS.
Specification of this VPS:
Final Ratings
Its an amazing vps for free with good specifications so I am recommending for everyone who wants good VPS for personal website.
10/10
Specification of this VPS:
![[Image: ixBmaJC.png]](https://i.imgur.com/ixBmaJC.png)
Although the server is located in the US, very far from my country Vietnam, but the download speed is excellent and the ping is very low.
![[Image: ESDjrek.png]](https://i.imgur.com/ESDjrek.png)
Control Panel
I installed CyberPanel because it is simple, easy to use and takes very little resources.
![[Image: 2f1Yfo8.png]](https://i.imgur.com/2f1Yfo8.png)
Access speed of storage hard drives with the command "dd"
![[Image: NZrGYRI.png]](https://i.imgur.com/NZrGYRI.png)
Access speed of storage hard drives with the "ioping" command
![[Image: a0MNYPS.png]](https://i.imgur.com/a0MNYPS.png)
Check the CPU core number, CPU processing speed:
![[Image: zPO72su.png]](https://i.imgur.com/zPO72su.png)
Its an amazing vps for free with good specifications so I am recommending for everyone who wants good VPS for personal website.
10/10
Hi, I hope i can explain what i exactly want.
I wanna show the first post and and last post on the thread all rest of other posts between first and last are collapsed.
Example if i created thread.
- Thread first post
- reply hidden.
- reply hidden
- last reply show.
Visitor have to click "show replies" which redirect him/her to full thread page. Hope separately show each post on same page without any redirection.
I want it for forum software called XenForo OR MyBB
Now just tell me if i need any module/plugin OR any CSS customization. Give me link if you know any similar tutorial.
And from now on i'm coming back, Will active daily *Fingercrossed*
I wanna show the first post and and last post on the thread all rest of other posts between first and last are collapsed.
Example if i created thread.
- Thread first post
- reply hidden.
- reply hidden
- last reply show.
Visitor have to click "show replies" which redirect him/her to full thread page. Hope separately show each post on same page without any redirection.
I want it for forum software called XenForo OR MyBB
Now just tell me if i need any module/plugin OR any CSS customization. Give me link if you know any similar tutorial.
And from now on i'm coming back, Will active daily *Fingercrossed*
First off, I must confess that this HowTo is nothing but a poor man's way to deploy a fully functional DoH server. It's basically my way of utilizing the available resources at hand on @Neoon's NAT-VPS on his NanoKVM platform; thus if we forget about the transparent reverse-proxy (HAProxy) at the NAT-gate, this implementation is basically concerned to tight together 3 independent pieces of software:
Systemd-resolved as the DNS resolver
Please refer to the 'A Case for systemd-resolved as the default DNS Resolver' thread for more details on this (I did specifically created it, because it deserved to be discussed thoroughly.) In here, I'll just publish systemd-resolved configuration file -located at /etc/systemd/resolved.conf- that's needed for this use case:
Now, you're supposed to start the service and enable it permanently (if you choose to), then by running this command, you'll see the service current status:
As a test:
To get an idea on the resolver stats, run this:
That should be all for the DNS resolver part (for more specifics on systemd-resolved, check the thread mentioned above.)
Setting up a DoH Server
if we run a search on Gihub public repositories on IETF-compliant DoH, three results are resturned, but m13253/DNS-over-HTTPS seems to be the most mature.
Thus we'll be using m13253/DNS-over-HTTPS as our DoH-server, which supports the following features:
To use m13253/DNS-over-HTTPS, we have to first install Google's Golang. On Centos 8, we simply have to issue the following command as an admin:
To verify that Go is installed and configured as it should, we run:
As a standard user, we'll compile m13253/DNS-over-HTTPS following these steps:
The binary should then be installed in the /usr/local/bin but the config file is located in the /etc/dns-over-https/ folder. The install also makes available the doh-server own systemd service file to control it in the standard way.
To undo the installation step, simply run:
Now, to link our DoH-server to our DNS resolver listening on 127.0.0.53:53/udp, we have to make just one edit to the '/etc/dns-over-https/doh-server.conf' file:
If you want to completely offload all the DNS resolution step to an external public DNS server, uncomment the addresses above.
Now, that we have our configuration as we wanted, time to start and enable the server:
If we check, our running services, we would find that our doh-server is listening on port 8053, as set in its config file.
At this point, we're done with the DOH-server part.
Apache 2.4 as the Web Server of this Stack
Given that I'm already running Apache 2.4 as my Web server, I won't use Nginx although it's the best suited for this job.
HTTPD is is running in mod_event and has many virtual hosts among them our generic 'doh.example.com' with the following config file:
With this last step, check your httpd config ( httpd -t ) and reload your web server.
Now, if you send this query to your doh.example.com you'll get an answer in the json format:
If you make it till this stage successfully, Congratulation, now you can test it with Firefox :-)
Testing your Custom DoH Server with Firefox
In the about:config tab, type: network.trr; a list of directives will show. We are interested in the 'network.trr.custom_uri' and 'network.trr.bootstrapAddress'(only relevant when network.trr.mode===3), which you'll set like this:
That's ALL there is to it.
Now!... Why bother you may ask?... Privacy!.. I would say!.. No one can handle your data as faithfully and diligently as you would. At least that's the assumption of this HowTo :-)
- A web server that will accept DoH's HTTPS requests. It will be the only one handling the SSL part of the communication (thus it's our SSL termination point,) while serving as a proxy for the DoH server over HTTP.
- A DoH server, running in the background and doing the grunt work of translating Wireformats between HTTP and UDP, conforming to the IETF DNS-over-HTTPS (RFC 8484).
- A DNS resolver, handling the name resolution part of this setup.
Systemd-resolved as the DNS resolver
Please refer to the 'A Case for systemd-resolved as the default DNS Resolver' thread for more details on this (I did specifically created it, because it deserved to be discussed thoroughly.) In here, I'll just publish systemd-resolved configuration file -located at /etc/systemd/resolved.conf- that's needed for this use case:
Code:
# This file is part of systemd.
# (..........)
[Resolve]
DNS=9.9.9.9
FallbackDNS=1.1.1.1 8.8.8.8
#Domains=
LLMNR=no
#MulticastDNS=no
DNSSEC=allow-downgrade
DNSOverTLS=opportunistic
#DNSOverTLS=yes
Cache=yes
#DNSStubListener=udpNow, you're supposed to start the service and enable it permanently (if you choose to), then by running this command, you'll see the service current status:
Code:
[root@vps ~]# resolvectl [OR systemd-resolve --status]
Global
LLMNR setting: no
MulticastDNS setting: no
DNSOverTLS setting: opportunistic
DNSSEC setting: allow-downgrade
DNSSEC supported: yes
DNS Servers: 9.9.9.9
Fallback DNS Servers: 1.1.1.1
8.8.8.8
DNSSEC NTA: 10.in-addr.arpa
16.172.in-addr.arpa
168.192.in-addr.arpa
17.172.in-addr.arpa
18.172.in-addr.arpa
19.172.in-addr.arpa
20.172.in-addr.arpa
21.172.in-addr.arpa
22.172.in-addr.arpa
23.172.in-addr.arpa
24.172.in-addr.arpa
25.172.in-addr.arpa
26.172.in-addr.arpa
27.172.in-addr.arpa
28.172.in-addr.arpa
29.172.in-addr.arpa
30.172.in-addr.arpa
31.172.in-addr.arpa
corp
d.f.ip6.arpa
home
internal
intranet
lan
local
private
test
(...............)As a test:
Code:
[root@vps ~]# dig google.com
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el8 <<>> google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45774
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;google.com. IN A
;; ANSWER SECTION:
google.com. 299 IN A 172.217.22.14
;; Query time: 66 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Sat Feb 08 13:33:49 +01 2020
;; MSG SIZE rcvd: 55
# A second time, to test the caching feature:
[root@natty ~]# dig google.com
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el8 <<>> google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42439
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;google.com. IN A
;; ANSWER SECTION:
google.com. 44 IN A 172.217.22.14
;; Query time: 0 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Sat Feb 08 13:38:03 +01 2020
;; MSG SIZE rcvd: 55To get an idea on the resolver stats, run this:
Code:
[root@vps ~]# systemd-resolve --statistics
DNSSEC supported by current servers: yes
Transactions
Current Transactions: 0
Total Transactions: 11
Cache
Current Cache Size: 7
Cache Hits: 3
Cache Misses: 8
DNSSEC Verdicts
Secure: 4
Insecure: 9
Bogus: 0
Indeterminate: 0That should be all for the DNS resolver part (for more specifics on systemd-resolved, check the thread mentioned above.)
Setting up a DoH Server
if we run a search on Gihub public repositories on IETF-compliant DoH, three results are resturned, but m13253/DNS-over-HTTPS seems to be the most mature.
Thus we'll be using m13253/DNS-over-HTTPS as our DoH-server, which supports the following features:
- IPv4 / IPv6
- EDNS0 large UDP packet (4 KiB by default)
- EDNS0-Client-Subnet (/24 for IPv4, /56 for IPv6 by default)
To use m13253/DNS-over-HTTPS, we have to first install Google's Golang. On Centos 8, we simply have to issue the following command as an admin:
Code:
dnf module -y install go-toolsetTo verify that Go is installed and configured as it should, we run:
Code:
[root@natty ~]# go version
go version go1.12.12 linux/amd64
#go env
GOARCH="amd64"
GOBIN=""
GOCACHE="/root/.cache/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/root/go"
GOPROXY=""
GORACE=""
GOROOT="/usr/lib/golang"
GOTMPDIR=""
GOTOOLDIR="/usr/lib/golang/pkg/tool/linux_amd64"
GCCGO="gccgo"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="......................."As a standard user, we'll compile m13253/DNS-over-HTTPS following these steps:
Code:
mkdir -p temp && cd temp
git clone https://github.com/m13253/dns-over-https.git --depth=1
cd dns-over-https
make
sudo make installThe binary should then be installed in the /usr/local/bin but the config file is located in the /etc/dns-over-https/ folder. The install also makes available the doh-server own systemd service file to control it in the standard way.
To undo the installation step, simply run:
Code:
sudo make uninstallNow, to link our DoH-server to our DNS resolver listening on 127.0.0.53:53/udp, we have to make just one edit to the '/etc/dns-over-https/doh-server.conf' file:
Code:
vi /etc/dns-over-https/doh-server.conf
(..............................)
upstream = [
#"udp:1.1.1.1:53",
#"udp:1.0.0.1:53",
#"udp:8.8.8.8:53",
#"udp:8.8.4.4:53",
"udp:127.0.0.53:53"
]
(..................................)If you want to completely offload all the DNS resolution step to an external public DNS server, uncomment the addresses above.
Now, that we have our configuration as we wanted, time to start and enable the server:
Code:
systemctl start doh-server
systemctl enable doh-serverIf we check, our running services, we would find that our doh-server is listening on port 8053, as set in its config file.
Code:
[root@natty ~]# netstat -tulpn|grep doh-server
tcp 0 0 127.0.0.1:8053 0.0.0.0:* LISTEN 14825/doh-server
tcp6 0 0 ::1:8053 :::* LISTEN 14825/doh-serverAt this point, we're done with the DOH-server part.
Apache 2.4 as the Web Server of this Stack
Given that I'm already running Apache 2.4 as my Web server, I won't use Nginx although it's the best suited for this job.
HTTPD is is running in mod_event and has many virtual hosts among them our generic 'doh.example.com' with the following config file:
Code:
<VirtualHost *:443>
ServerName doh.example.com
ServerAdmin [email protected]
UseCanonicalName off
<IfModule http2_module>
Protocols h2 http/1.1
</IfModule>
SSLEngine on
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains;"
ProxyRequests off
# RequestHeader set X-Forwarded-Proto "https"
ProxyPreserveHost On
<Location />
SSLRequireSSL
</Location>
ProxyPass /dns-query http://127.0.0.1:8053/dns-query
ProxyPassReverse /dns-query http://127.0.0.1:8053/dns-query
</VirtualHost>With this last step, check your httpd config ( httpd -t ) and reload your web server.
Now, if you send this query to your doh.example.com you'll get an answer in the json format:
Code:
curl -s "https://doh.example.com/dns-query?name=google.com&type=A" | python -m json.tool
{
"Status": 0,
"TC": false,
"RD": true,
"RA": true,
"AD": false,
"CD": false,
"Question": [
{
"name": "google.com.",
"type": 1
}
],
"Answer": [
{
"name": "google.com.",
"type": 1,
"TTL": 299,
"Expires": "Sat, 08 Feb 2020 14:07:32 UTC",
"data": "172.217.22.14"
}
]
}If you make it till this stage successfully, Congratulation, now you can test it with Firefox :-)
Testing your Custom DoH Server with Firefox
In the about:config tab, type: network.trr; a list of directives will show. We are interested in the 'network.trr.custom_uri' and 'network.trr.bootstrapAddress'(only relevant when network.trr.mode===3), which you'll set like this:
Code:
network.trr.custom_uri https://doh.example.com/dns_query
network.trr.bootstrapAddress IP_address_Custom_DoHThat's ALL there is to it.
Now!... Why bother you may ask?... Privacy!.. I would say!.. No one can handle your data as faithfully and diligently as you would. At least that's the assumption of this HowTo :-)
THREAD UPDATED AT SATURDAY 28 MARCH AT 09:42 GMT01+00 !!!
Dear members of Post4VPS,
As you know, we previously offered free VPS with large limits from my old data center in America. A new era has arrived for HostLease and the free service! We already offered Free Shared Hosting in Luxembourg (Offshore - Host Anything) but now the Free VPS is also coming back. This time it is not as limited as the previous free VPS version. We are currently working on some preparations for the new VPS.
PHP Code:
VPS 0 (5 Posts Per Month) VPS 1 (10 Posts Per Month) VPS 2 (15 Posts Per Month)
Dedicated RAM: 128MB Dedicated RAM: 256MB Dedicated RAM: 512MB
HW RAID10 SSD: 2GB HW RAID10 SSD: 5GB HW RAID10 SSD: 10GB
Premium Bandwidth: 20GB Premium Bandwidth: 50GB Premium Bandwidth: 100GB
CPU Core(s): 1 CPU Core(s): 1 CPU Core(s): 1
IPv4: 1 IPv4: 1 IPv4: 1
IPv6: 0 IPv6: 0 IPv6: 0
IPv6 Subnet: 0 IPv6 Subnet: 0 IPv6 Subnet: 0
Port Speed: 1000MBits Port Speed: 1000MBits Port Speed: 1000MBits
VPS: OVZ, (Linux) VPS: OVZ, (Linux) VPS: OVZ, (Linux)
Data Center: Lelystad, NL Data Center: Lelystad, NL Data Center: Lelystad, NL
Control Panel: Virtualizor Control Panel: Virtualizor Control Panel: Virtualizor
Full Root Access Full Root Access Full Root Access
PHP Code:
VPS 3 (20 Posts Per Month) VPS 4 (25 Posts Per Month) VPS 5 (30 Posts Per Month)
Dedicated RAM: 768MB Dedicated RAM: 1024MB Dedicated RAM: 2048MB
HW RAID10 SSD: 15GB HW RAID10 SSD: 20GB HW RAID10 SSD: 25GB
Premium Bandwidth: 150GB Premium Bandwidth: 200GB Premium Bandwidth: UNLIMITED
CPU Core(s): 2 CPU Core(s): 3 CPU Core(s): 4
IPv4: 1 IPv4: 1 IPv4: 1
IPv6: 1 IPv6: 5 IPv6: 5
IPv6 Subnet: 1 IPv6 Subnet: 5 IPv6 Subnet: 5
Port Speed: 1000MBits Port Speed: 1000MBits Port Speed: 1000MBits
VPS: OVZ, (Linux) VPS: OVZ, (Linux) VPS: OVZ, (Linux)
Data Center: Lelystad, NL Data Center: Lelystad, NL Data Center: Lelystad, NL
Control Panel: Virtualizor Control Panel: Virtualizor Control Panel: Virtualizor
Full Root Access Full Root Access Full Root Access
UPDATE: v0.5
NOTE: Because the sponsorship will be terminated at the end of this year, we will also have to make a switch from Post4VPS to LNB-Forum, because from next year we no longer have any ties with them, we want to join forces from Post4VPS to LNB. We will also give all members who come from Post4VPS a credit of 50 points.
RULES & INFORMATION TO OBITAIN A VPS! - DUE TO PREVENT SPAMMERS AND ABUSERS:
1.) You must be Joined our Discord and our FORUM (Prevent spammers and abusers)
2.) You must have 50 Points to qualify for a free VPS
3.) Thanks the admins with the list of VPS'es
4.) You must keep 50 points per month at LNB-Hosting to hold your VPS.
FAQS:
Q: What if I don't make 50 Points per month?
A: Your VPS will be deleted and be placed for empty space
Q: I have a VPS plan, can I downgrade my higher VPS plan to a lower one?
A: No, once you upgrade your VPS you cannot downgrade. You will need to terminate your VPS and wait 5 days to request again.
Q: Where can I see all VPS Plans?
A: To view all VPS plans, please see this thread ->CLICK ME TO SEE THE VPS PLANS<-
Q: I lost my VPS can I apply again?
A: No, you must wait at least 5 days.
Q: I had a VPS before the closure of the previous VPS, can I get it directly?
A: Yes, users who claimed a VPS can obitain a free VPS without doing anything 1st month. (Verification is needed)
Q: How many VPS can I claim?
A: just 1 (one).
Q: My VPS cannot be started, how does this come?
A: it can take 2-4 hours till templates are synced fine.
Q: What happend if my VPS is unused?
A: If you haven't you use VPS within 48h then will we terminate it.
Any questions? No fine, let me know if you have any :
And tell me if you like 
ONCE your request is done and requirements then will we send private via Discord a link to order.
Posted by: fChk - 02-07-2020, 11:52 AM - Forum: Internet Technology
- No Replies
When I was trying to deploy my own DoH (DNS-over-HTTPS) server, I did have to rethink my DNS caching solution and finally settle for systemd-resolved as my VPS's default resolver.
A Little Background
systemd-resolved is a stub resolver that is part of systemd; that's to say that it's already installed -by default- on your system if it's systemd-based. However, I can only attest that it's the case for RedHat-based systems (RHEL, CentOS and Fedora.)
This little jewel of software implements a caching and validating DNS/DNSSEC stub resolver, as well as an LLMNR (Link-Local Multicast Name Resolution) and MulticastDNS resolver and responder. Referring to it as a stub resolver means that it does not support recursive mode.
As part of systemd, it integrates with the system's NetworkManager, so that it will automatically use the network-assigned DNS servers, unless overridden in its configuration file. This said, what has most tilted the balance in its favour for my use case, was its supports for DNS-over-TLS (DoT) out-of-the-box.
Unfortunately, although my VPS is using the latest release and packages from CentOS repos (ie, CentOS Linux release 8.1.1911), the systemd version is still 239:
.. which makes it only able to run DoT in an opportunistic mode.
Compare this to Fedora 31:
.. which makes possible running DoT in the strict mode.
A mini-timeline of systemd's supports for DNS over TLS:
Configuration Tips
systemd-resolved configuration file is located in /etc/systemd/resolved.conf and, for my use case, looks like this:
By setting the DNS directive, I'm overriding the DHCP's assigned DNS server, and I've disabled LLMNR for its uselessness and potential vulnerabilities in my case. The next big thing to note is that the Cache directive is activated (not set by default) and the DNSStubListener must be set to udp to activate the local DNS stub listener on the local loopback interface's IP address 127.0.0.53.
To be clear, systemd-resolved's DoT in the opportunistic mode is unreliable, as both 53 and 853 traffics are used; so NO confidentiality assurance here!
Now is the time to activate our DNS resolver:
Testing using the deprecated netstat:
testing using the new ss command:
Now, to let our local programs issuing DNS requests to this local DNS stub listener, we have to override the default /etc/resolv.conf
The content of this static resolv.conf is:
That should be it; all local clients that bypass local DNS APIs are connected to systemd-resolved.
Next post will expand on the monitoring, operations and troubleshooting issues of systemd-resolved.
last Edited on 8/02/2020
Fixed few typos, rephrased few sentences and added new content as code snippets.
A Little Background
systemd-resolved is a stub resolver that is part of systemd; that's to say that it's already installed -by default- on your system if it's systemd-based. However, I can only attest that it's the case for RedHat-based systems (RHEL, CentOS and Fedora.)
This little jewel of software implements a caching and validating DNS/DNSSEC stub resolver, as well as an LLMNR (Link-Local Multicast Name Resolution) and MulticastDNS resolver and responder. Referring to it as a stub resolver means that it does not support recursive mode.
As part of systemd, it integrates with the system's NetworkManager, so that it will automatically use the network-assigned DNS servers, unless overridden in its configuration file. This said, what has most tilted the balance in its favour for my use case, was its supports for DNS-over-TLS (DoT) out-of-the-box.
Unfortunately, although my VPS is using the latest release and packages from CentOS repos (ie, CentOS Linux release 8.1.1911), the systemd version is still 239:
Code:
[root@vps ~]# systemctl --version
systemd 239
(....)Compare this to Fedora 31:
Code:
[root@vps ~]# systemctl --version
systemd 243 (v243.5-1.fc31)
(....)A mini-timeline of systemd's supports for DNS over TLS:
- version 236 DNSSEC support for RFC 8080 (ed25519 keys and signatures)
- version 239 systemd-resolved now supports opportunistic DNS-over-TLS, Off by default
- version 243 systemd-resolved gained support for a new strict DNS-over-TLS mode
Configuration Tips
systemd-resolved configuration file is located in /etc/systemd/resolved.conf and, for my use case, looks like this:
Code:
# This file is part of systemd.
# (..........)
[Resolve]
DNS=9.9.9.9
FallbackDNS=1.1.1.1 8.8.8.8
#Domains=
LLMNR=no
#MulticastDNS=yes
DNSSEC=allow-downgrade
DNSOverTLS=opportunistic
#DNSOverTLS=yes
Cache=yes
#DNSStubListener=udpBy setting the DNS directive, I'm overriding the DHCP's assigned DNS server, and I've disabled LLMNR for its uselessness and potential vulnerabilities in my case. The next big thing to note is that the Cache directive is activated (not set by default) and the DNSStubListener must be set to udp to activate the local DNS stub listener on the local loopback interface's IP address 127.0.0.53.
To be clear, systemd-resolved's DoT in the opportunistic mode is unreliable, as both 53 and 853 traffics are used; so NO confidentiality assurance here!
Now is the time to activate our DNS resolver:
Code:
# starting the service
systemctl start systemd-resolved
#Permanently enabling the service
systemctl enable systemd-resolvedTesting using the deprecated netstat:
Code:
netstat -tulpn|grep 53
udp 0 0 127.0.0.53:53 0.0.0.0:* 18478/systemd-resolCode:
ss -tuna | grep :53
udp UNCONN 0 0 127.0.0.53%lo:53 0.0.0.0:*Now, to let our local programs issuing DNS requests to this local DNS stub listener, we have to override the default /etc/resolv.conf
Code:
ln -fsv /usr/lib/systemd/resolv.conf /etcThe content of this static resolv.conf is:
Code:
# This file belongs to man:systemd-resolved(8). Do not edit.
#
# This is a static resolv.conf file for connecting local clients to the
# internal DNS stub resolver of systemd-resolved. This file lists no search
# domains.
#
# Run "resolvectl status" to see details about the uplink DNS servers
# currently in use.
#
# Third party programs must not access this file directly, but only through the
# symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a different way,
# replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.
nameserver 127.0.0.53
~ That should be it; all local clients that bypass local DNS APIs are connected to systemd-resolved.
Next post will expand on the monitoring, operations and troubleshooting issues of systemd-resolved.
last Edited on 8/02/2020
Fixed few typos, rephrased few sentences and added new content as code snippets.
Please note due to a request by the sponsor - Shadow Hosting - who wants a more dynamic use of the specs of his VPSs to increase their marketability, the two VPS 5s will be returned to the Giveaway Process with effect of March.
The current VPS holders of VPS 5 will be allowed to compete for the VPSs too during the March Giveaway but are encouraged to apply for other VPSs as well.
The process of adding VPS 5 back to the Giveaway process will be ongoing until VPS holders have been found who maximize the functionality of the VPSs. Obviously the sponsor is looking for VPS Holders of the same category ownership of VPS 4.
Please note that for VPS 4 and 5 the VPSs are monitored for performance. VPS 9 and VPS 16 fall in this category too and are also monitored. However since there is availability for VPS 9 it is not as carefully monitored. Requirement for spec justification and maintaining higher value and content for VPS 9 is the same however.
Members who wish to apply for VPS 5 in March should also note that there is an additional requirement for writing a review of the VPS within 30 days of taking ownership.
The current VPS holders of VPS 5 will be allowed to compete for the VPSs too during the March Giveaway but are encouraged to apply for other VPSs as well.
The process of adding VPS 5 back to the Giveaway process will be ongoing until VPS holders have been found who maximize the functionality of the VPSs. Obviously the sponsor is looking for VPS Holders of the same category ownership of VPS 4.
Please note that for VPS 4 and 5 the VPSs are monitored for performance. VPS 9 and VPS 16 fall in this category too and are also monitored. However since there is availability for VPS 9 it is not as carefully monitored. Requirement for spec justification and maintaining higher value and content for VPS 9 is the same however.
Members who wish to apply for VPS 5 in March should also note that there is an additional requirement for writing a review of the VPS within 30 days of taking ownership.
| Welcome, Guest |
|
You have to register before you can post on our site. |
| Search Forums |
|
(Advanced Search) |
| Forum Statistics |
|
» Members: 2,271 » Latest member: orzpainter » Forum threads: 3,100 » Forum posts: 34,783 Full Statistics |
| Online Users |
|
There are currently 443 online users. » 0 Member(s) | 441 Guest(s) Applebot, Bing |
| Latest Threads |
|
⚡ EnjoyVPS.Com : 35+ Glob...
Forum: Others Last Post: RIYAD 01-06-2026, 01:21 AM » Replies: 0 » Views: 528 |
|
Get LLHOST Netherlands Fe...
Forum: Others Last Post: LLHOST 09-29-2025, 03:02 AM » Replies: 0 » Views: 977 |
|
Super Fast LLHOST Netherl...
Forum: Value VPS Providers Last Post: LLHOST 09-16-2025, 05:01 AM » Replies: 0 » Views: 681 |
|
Get LLHOST Netherlands Fe...
Forum: Cheap Providers Last Post: LLHOST 09-08-2025, 01:33 PM » Replies: 0 » Views: 812 |
|
Windows VPS @ $31.5/Year ...
Forum: Cheap Providers Last Post: DewlanceHosting 08-16-2025, 03:12 AM » Replies: 0 » Views: 946 |
|
Buy DemoTiger Videos on c...
Forum: Others Last Post: DewlanceHosting 08-16-2025, 03:10 AM » Replies: 8 » Views: 6,517 |
|
Budget Dedicated Servers ...
Forum: Others Last Post: HostNamaste 08-13-2025, 04:54 AM » Replies: 2 » Views: 1,974 |
|
☁️ How to Use VCCPRO Virt...
Forum: Cheap Providers Last Post: bestadvisor 07-13-2025, 09:36 AM » Replies: 0 » Views: 1,408 |
|
[Promo] 30% Discount – VP...
Forum: Cheap Providers Last Post: LLHOST 07-11-2025, 12:56 PM » Replies: 0 » Views: 1,000 |
|
✅ Affordable VPS Hosting ...
Forum: Cheap VPS Providers Last Post: RIYAD 07-02-2025, 03:02 AM » Replies: 0 » Views: 2,234 |
. Overall not recommended, even watching Toy Story series would be productive.