Salut,
Je reprends ce fil avec une configuration mettant en place dnssec via systemd-resolved sous Ubuntu 18.04 tout en utilisant les serveurs DNS de FDN:
bionic@k72f-J48-ubgnome:~$ cat /etc/systemd/resolved.conf
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
#
# Entries in this file show the compile time defaults.
# You can change settings by editing this file.
# Defaults can be restored by simply deleting this file.
#
# See resolved.conf(5) for details
[Resolve]
#DNS=
DNS=80.67.169.12 80.67.169.40 2001:910:800::12 2001:910:800::40
#FallbackDNS=
#Domains=
#LLMNR=no
#MulticastDNS=no
#DNSSEC=no
DNSSEC=allow-downgrade
#Cache=yes
#DNSStubListener=yes
bionic@k72f-J48-ubgnome:~$
ionic@k72f-J48-ubgnome:~$ systemd-resolve --status --no-pager
Global
DNS Servers: 80.67.169.12
80.67.169.40
2001:910:800::12
2001:910:800::40
DNSSEC NTA: 10.in-addr.arpa
16.172.in-addr.arpa
168.192.in-addr.arpa
17.172.in-addr.arpa
18.172.in-addr.arpa
19.172.in-addr.arpa
20.172.in-addr.arpa
21.172.in-addr.arpa
22.172.in-addr.arpa
23.172.in-addr.arpa
24.172.in-addr.arpa
25.172.in-addr.arpa
26.172.in-addr.arpa
27.172.in-addr.arpa
28.172.in-addr.arpa
29.172.in-addr.arpa
30.172.in-addr.arpa
31.172.in-addr.arpa
corp
d.f.ip6.arpa
home
internal
intranet
lan
local
private
test
Link 3 (wls1)
Current Scopes: DNS
LLMNR setting: yes
MulticastDNS setting: no
DNSSEC setting: allow-downgrade
DNSSEC supported: no
DNS Servers: 192.168.1.1
DNS Domain: home
Link 2 (ens5)
Current Scopes: none
LLMNR setting: yes
MulticastDNS setting: no
DNSSEC setting: allow-downgrade
DNSSEC supported: yes
bionic@k72f-J48-ubgnome:~$
Cette configuration permet de résoudre les noms de domaines locaux en l'occurrence via le serveur dns d'une livebox qui ne gère pas dnssec tout en utilisant les serveurs dns de FDN pour les domaines non locaux.
La connexion active est wls1, dnssec est indiqué comme non supporté par le serveur DNS local 192.168.1.1 mais supporté par les serveurs de FDN, systemd-resolved utilise automatiquement dnssec si les serveurs dns le proposent.
Résolution en local :
bionic@k72f-J48-ubgnome:~$ systemd-resolve fixe
fixe: 192.168.1.12
(fixe.home)
-- Information acquired via protocol DNS in 8.0ms.
-- Data is authenticated: no
bionic@k72f-J48-ubgnome:~$
Résolution inverse en local :
bionic@k72f-J48-ubgnome:~$ systemd-resolve 192.168.1.12
192.168.1.12: fixe.home
-- Information acquired via protocol DNS in 8.3ms.
-- Data is authenticated: no
bionic@k72f-J48-ubgnome:~$
Résolution www :
bionic@k72f-J48-ubgnome:~$ systemd-resolve sigok.verteiltesysteme.net
sigok.verteiltesysteme.net: 134.91.78.139
-- Information acquired via protocol DNS in 250.9ms.
-- Data is authenticated: yes
bionic@k72f-J48-ubgnome:~$
Résolution inverse www :
bionic@k72f-J48-ubgnome:~$ systemd-resolve 134.91.78.139
134.91.78.139: derp.vs.uni-due.de
derp.vs.uni-duisburg-essen.de
-- Information acquired via protocol DNS in 502.5ms.
-- Data is authenticated: no
bionic@k72f-J48-ubgnome:~$
Cette configuration permet de configurer les dns tout en laissant les connexions définies via Networkmanager en DHCP automatique, donc en utilisant le serveur dns local fourni par la box tout en n'utilisant pas les serveurs DNS du fournisseur de service internet.
Cela fonctionne avec Orange.
Plus d'information sur l'activation de DNSSEC :
bionic@k72f-J48-ubgnome:~$ systemd-resolve --statistics
DNSSEC supported by current servers: yes
Transactions
Current Transactions: 0
Total Transactions: 5139
Cache
Current Cache Size: 39
Cache Hits: 1281
Cache Misses: 3611
DNSSEC Verdicts
Secure: 75
Insecure: 137
Bogus: 0
Indeterminate: 0
bionic@k72f-J48-ubgnome:~$
