Archive for the ‘DNS’ Category
Posted by jpluimers on 2022/02/21
For my link archive:
- [Wayback] Informatie voor cliënten
- [Wayback/Archive.is] Cliëntportaal
- [Wayback] Aanmelden
- [Wayback] https://raamwerkcura.unit4online.com/CuraCSSProd/Home/login?ReturnUrl=%2FCuraCSSProd
- The DNS name for the above domain
raamwerkcura.unit4online.com does not exist:
- [Archive.is] SSL Server Test (Powered by Qualys SSL Labs): Unable to resolve domain name.
- [Wayback] Trace Results | WhereGoes: Error: Timeout Error when fetching URL.
- No “Answer” section in [Wayback/Archive.is] https://dns.google/resolve?name=raamwerkcura.unit4online.com&type=A:
{"Status": 3,"TC": false,"RD": true,"RA": true,"AD": false,"CD": false,"Question":[ {"name": "raamwerkcura.unit4online.com.","type": 1}],"Authority":[ {"name": "unit4online.com.","type": 6,"TTL": 899,"data": "ns1-06.azure-dns.com. hostmaster.amercom.nl. 2018011701 28800 7200 604800 86400"}],"Comment": "Response from 2620:1ec:bda::6."}
- [Wayback] https://www.hetraamwerk.nl/clientportaal/Gebruikersvoorwaarden
- [Wayback] Vragen helpdesk@hetraamwerk.nl.
- [Wayback] Instructie
- [Wayback] Log hier in bij het Cliëntportaal (which I initially missed, see the “Baffled” below).
Notes:
Baffled:
I basically got baffled by the (for me distracting) way the images and icons were situated on the “Cliëntportaal” page: it forced me to the more easily to grasp menu on the right, access the “Aanmelden” page, which had the wrong link.
The (non-blue, and unlike the other red links, non-red) “Log hier in bij het Cliëntportaal” link above the distracting images actually had the correct link to hetraamwerk-ecd.fierit.nl/WebCSS/Home/Login.
Read the rest of this entry »
Posted in DNS, Internet, LifeHacker, Power User | Leave a Comment »
Posted by jpluimers on 2022/01/27
Based on [Wayback] domain name system – Overriding some DNS entries in BIND for internal networks – Server Fault and some further reading, there seem to be two ways used in these scenarios:
I wonder how that would interact best with Pi-Hole based solutions. Would it be best to have your local network use the Pi-Hole server, then have the Pi-Hole server obtain the DNS information it cannot resolve through one of the above solutions? Or would other solutions work better?
So here are a few links:
- [Wayback] domain name system – Overriding some DNS entries in BIND for internal networks – Server Fault; A lot of information in the answers to this question; important takeaway is that BIND named does support RPZ, but the support is not as fine grained as what Unbound DNS Server supports.
- [Wayback] bind – Is it possible to split a domain using dns Bind9 – Server Fault
- [Wayback] domain name system – Redirecting time.windows.com to internal server – Server Fault: poor man’s approach for a single host.
- [Wayback] Chapter 4 DNS Configuration Types (Bind)
- [Wayback] Split horizon DNS master/slave with Bind | Jensd’s I/O buffer having a full set of steps for master and slave, explaining the how and why of each step
- [Wayback] DNS Response Policy Zones (RPZ) / [Wayback] draft-vixie-dnsop-dns-rpz-00: DNS Response Policy Zones (RPZ) (Internet-Draft, 2018):
This document describes a method for expressing DNS response policy inside a specially constructed DNS zone, and for recursive name servers to use such policy to return modified results to DNS clients. The modified DNS results can stop access to selected HTTP servers, redirect users to “walled gardens”, block objectionable email, and otherwise defend against attack. These “DNS Firewalls” are widely used in fighting Internet crime and abuse.
- [Wayback] Overriding DNS for fun and profit (with bind)
- [Wayback] Chapter 7 – Response Policy Zone (Bind)
- [Wayback] configuration – Large zone file for bind9 : ad-blocking – Unix & Linux Stack Exchange
- [Wayback] HOWTO – Configure a DNS firewall with RPZ (with examples)
- [Wayback] Jan-Piet Mens :: RPZ revisited (Bind, with very clear examples no order of processing)
- [Wayback] domain name system – Alternative ways to get past 32 rpz zone limit in BIND? …without running BIND a thousand times – Server Fault (yes, as zones can be in views)
- [Wayback] Build a Privacy-respecting and Threat-blocking DNS Server
Learn how you can install your own DNS server to protect your devices from phishing, malware and ransomware
- [Wayback] Glen Pitt-Pladdy :: Blog – DNS Firewall (blackhole malicious, like Pi-hole) with bind9
- [Wayback] DNSRPZ performance and scaleability when using multiple RPZ zones (Bind)
- [Wayback] debian – DNS server for blacklisting tons of domains and also some TLDs – Unix & Linux Stack Exchange (Bind)
- [Wayback] NLnet Labs – Unbound – About
Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. Late 2019, Unbound has been rigorously audited, which means that the code base is more resilient than ever. To help increase online privacy, Unbound supports DNS-over-TLS …
- [Wayback] NLnet Labs – News – Unbound 1.10.0 released: rpz support and serve-stale conformance
The 1.10.0 release has RPZ support and serve stale functionality according to draft draft-ietf-dnsop-serve-stale-10. And a number of other, smaller, features, and bug fixes.
- [Wayback] jimh.dev: Unbound Pi-hole without scripts
- The Internet is full of Ads and Trackers. Some of them are useful to monetize free content. Some are used in a non-ethical manner. Savvy users will configure Ad-Blocker on their Web browser. Others won’t. Most Appliance and IoT modules won’t allow third-party blocking addons. Here’s how to add an extra layer of privacy using … Continue reading “Blocking Ads using unbound(8) on OpenBSD”[Wayback] Blocking Ads using unbound(8) on OpenBSD – TuM’Fatig
The public blocklists used by Pi-Hole are the following:
I wrote a [Wayback] script that will fetch the blocklists content, parse it and create a local zone file for unbound(8). That file will contain all the blocked domains and use the redirect answer to resolve those as invalid.
- [Wayback] geoghegan.ca: unbound-adblock, The Ultimate DNS Firewall! with [Wayback] script version 0.5p4
Pi-Hole seems not interested in RPZ: [Wayback] Implement Response Zone Policies (NXDOMAIN) for end-user performance increase – Feature Requests / Implemented – Pi-hole Userspace
Pi-Hole default blacklist is mentioned in [Wayback/Archive.is] pi-hole/basic-install.sh at master · pi-hole/pi-hole (look for adlistFile which defaults to [Wayback/Archive.is] StevenBlack/hosts: 🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories.).
Since I need this for ESXi: [Wayback/Archive.is] Let’s Encrypt SSL for ESXi
–jeroen
Posted in *nix, *nix-tools, bind-named, DNS, Internet, Linux, Power User | Leave a Comment »
Posted by jpluimers on 2022/01/20
Note
Though there are .example.edu and .example.info, though used in documentation and registered by IANA, have a status is different from the official Reserved Top Level DNS Names:
This is not exactly the same situation as for say ".example.org", where IANA is the registrant *and* registrar.
Wikipedia links:
Read the rest of this entry »
Posted in Development, DNS, Documentation Development, Internet, Power User, Software Development, Testing | Leave a Comment »
Posted by jpluimers on 2021/11/05
Somehow naming of DNS resource record types and cylindrical battery types might seem for most parts mutually exclusive:
But the A and AAAA battery types, though uncommon, do exist.
–jeroen
Read the rest of this entry »
Posted in DNS, History, Internet, Power User | Leave a Comment »
Posted by jpluimers on 2021/10/22
If you think download speeds are slow for large downloads (or multi-media playback is slow or quality is low) on a fast link, then consider your DNS.
Many people report that using one of the centralised DNS services (like Google/Cloudflare/…) causes slowness because they direct CDN lookups to a small pool of servers that get overloaded.
Some links:
Via [WayBack] How to check whether DNS is working through a browser? – Super User
Google DNS also allows for interactive querying, for example [WayBack] Google Public DNS
Read the rest of this entry »
Posted in Cloud, Cloudflare, DNS, Hardware, Infrastructure, Internet, Network-and-equipment, Power User | Leave a Comment »
Posted by jpluimers on 2021/09/07
Long interesting thread at [WayBack] Thread by @sleevi_: “@SwiftOnSecurity So, some history: It used to be folks would get certs for “localhost”, just like they would from “webmail”, despite no CA e […]”
In 2019, applications were still using tricks (including shipping private keys!) to “securely” access https://127.0.0.1 on some port.
This should have stopped in 2015, but hadn’t. I wonder how bad it still is today.
Related:
- [WayBack] Tavis Ormandy on Twitter: “This turned out to be a real vulnerability! 😮 The certificate was issued by @digicert, who are now required to revoke it. It was issued before mandatory CT, so didn’t show up in …. See … for context.…”
- [WayBack] Ryan Sleevi on Twitter: “So, some history: It used to be folks would get certs for “localhost”, just like they would from “webmail”, despite no CA ever having validated the name. They just relied on pinky promises to be good. Luckily, browsers forbid that … “
- [WayBack] Ryan Sleevi on Twitter: “Look at the dates on those. Yes, it’s a things CAs used to do, and they had to be dragged kicking and screaming into not doing it (and even then, *many* ignored/“oopsied” the requirement to revoke). I regret to inform you it didn’t stop until 2015/2016 – … “
- [WayBack] Guidance on Internal Names – CAB Forum
- [Archive.is] HTTPS encryption on the web – Google Transparency Report: atlassian-domain-for-localhost-connections-only.com
- [Archive.is] HTTPS encryption on the web – Google Transparency Report
- SubjectC=AU, O=Atlassian Pty Ltd, L=Sydney, ST=New South Wales, CN=atlassian-domain-for-localhost-connections-only.com
- Serial NumberA:3E:93:53:0E:74:53:AE:CB:40:BA:20:10:12:F8:FB
- IssuerC=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CAValidity11 May 2017 — 15 May 2020
- The domain is (at the time of writing, so hopefully that is now “was”) used by the [WayBack] Administering the Atlassian Companion App – Atlassian Documentation
- At the time of writing, the interactive Google DNS showed the domain pointing to localhost [WayBack] Google Public DNS:
Result for atlassian-domain-for-localhost-connections-only.com/A with DNSSEC validation:
{
"Status": 0,
"TC": false,
"RD": true,
"RA": true,
"AD": false,
"CD": false,
"Question": [
{
"name": "atlassian-domain-for-localhost-connections-only.com.",
"type": 1
}
],
"Answer": [
{
"name": "atlassian-domain-for-localhost-connections-only.com.",
"type": 1,
"TTL": 1620,
"data": "127.0.0.1"
}
]
}
- [Archive.is/WayBack] SSL Server Test: atlassian-domain-for-localhost-connections-only.com (Powered by Qualys SSL Labs)
Assessment failed: IP address is from private address space (RFC 1918)
Read the rest of this entry »
Posted in Communications Development, Development, DNS, HTTP, Internet, Power User, Software Development, TCP, TLS | Leave a Comment »
Posted by jpluimers on 2021/09/02
DNS over HTTPS
For my link archive:
JSON DNS output
Some DNS over HTTSP providers support dns-json, which Cloudflare delivers non-pretty printed.
Read the rest of this entry »
Posted in Cloud, Cloudflare, Communications Development, Development, DNS, Encryption, HTTP, https, HTTPS/TLS security, Infrastructure, Internet, Internet protocol suite, Power User, Security, Software Development, TCP, TLS | Leave a Comment »
Posted by jpluimers on 2021/08/03
There are many reasons to disable DNS over HTTPS (DoH), of which enough are discussed in the links below.
Disabling DoH always talks about setting TTR (the abbreviation Mozilla uses for it) to 5 (like [WayBack] Thread by @isotopp: “Firefox is about to break DNS by enabling DNS-over-HTTP by default […]”), but hardly ever explains the meaning of 5, or any other potential values.
After some searching, I found [WayBack] Firefox disable trr | Knowledge Base:
0: Off by default1: Firefox chooses faster2: TRR default w/DNS fallback3: TRR only mode5: Disabled
I imagine the setting we’re all looking for is: user_pref(“network.trr.mode”, 5); (emphasis mine)
It pointed me to [WayBack] Trusted Recursive Resolver – MozillaWiki:
Read the rest of this entry »
Posted in Cloud, Cloudflare, Communications Development, Development, DNS, Firefox, Infrastructure, Internet protocol suite, Power User, TCP, Web Browsers | Leave a Comment »
Posted by jpluimers on 2021/07/27
This is a continuation of yesterdays
Listing information on all active interfaces on MacOS part 1: getting the active interface names.
It is based on ideas in these StackExchange posts:
I threw most of the implementation details in the ideas away, as they were way to much based on empirical trial and error, than proper research.
So I tried doing the research and came up with the things below.
Getting the IPv4 address and DHCP/BOOTP information of a NIC
By using the ipconfig command, you can get specific details for a NIC like an IPv4 (with the getifaddr) or DHCP (with the getpacket option to get the latest DHCP packet):
for i in $(ifconfig -l -u); do if ifconfig $i | grep -q "status: active" ; then echo $i; fi; done | xargs -n1 -I_nic_ sh -c 'echo "_nic_: $(ipconfig getifaddr _nic_)"'
or DHCP/BOOTP:
for i in $(ifconfig -l -u); do if ifconfig $i | grep -q "status: active" ; then echo $i; fi; done | xargs -n1 -I_nic_ sh -c 'echo "_nic_: $(ipconfig getpacket _nic_)"'
The latter returns a very long list, which I wanted to shorten into a more readable format.
ipconfig syntax
You can find more information in the [Archive.is] ipconfig(8) [osx man page] / [WayBack] ipconfig Man Page – macOS – SS64.com excerpt:
Read the rest of this entry »
Posted in *nix, *nix-tools, Apple, bash, Development, DNS, ifconfig, Mac OS X / OS X / MacOS, Power User, Scripting, Software Development | Leave a Comment »
Posted by jpluimers on 2021/06/02
Almost every company I know has more than one subdomain, but while researching why support.microsoft.com could not be archived in the WayBack machine, I realised how many they have and bumped into a few sites listing most of them:
All via microsoft.com subdomains – Google Search.
–jeroen
Posted in Development, DNS, Internet, Power User, Software Development, Web Development | Leave a Comment »
