blob: 5fbdc4698639e4459bdffc99ee611c026cba63f9 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
|
A. Setup
An init script and configuration file have been provided to run dnscrypt-proxy
as a daemon. To configure dnscrypt-proxy, edit /etc/default/dnscrypt-proxy with
the desired settings. By default dnscrypt-proxy will use an OpenDNS server and
will run on localhost (127.0.0.1), port 53.
The configuration file is setup to use a dnscrypt user by default, and to
chroot into that user's home directory to maximize security. In order to use
the default configuration you should create a dnscrypt user and group with the
following commands:
groupadd -g 293 dnscrypt
useradd -u 293 -g 293 -c "DNSCrypt" -d /run/dnscrypt -s /bin/false dnscrypt
If you decide to use another user you should edit the CHROOTDIR and USER
options in /etc/default/dnscrypt-proxy (there are example settings provided for
the user 'nobody').
In order to send all DNS requests through dnscrypt-proxy, you will need to
update /etc/resolv.conf to point to localhost. If using dhcpcd, the easiest way
to set dnscrypt-proxy as the primary (but not exclusive) dns resolver is to
create file /etc/resolv.conf.head with the following line:
nameserver 127.0.0.1
You may also have to add the following line to enable EDNS:
options edns0
To start dnscrypt-proxy automatically at system start, add the following to
/etc/rc.d/rc.local:
if [ -x /etc/rc.d/rc.dnscrypt-proxy ]; then
/etc/rc.d/rc.dnscrypt-proxy start
fi
To properly stop dnscrypt-proxy on system shutdown, add the following to
/etc/rc.d/rc.local_shutdown:
if [ -x /etc/rc.d/rc.dnscrypt-proxy ]; then
/etc/rc.d/rc.dnscrypt-proxy stop
fi
B. DNS Cache
dnscrypt-proxy is just a DNS resolver and does not cache DNS queries. In order
to minimize the number of external DNS lookups, you can also run a local
caching DNS server. A sample configuration for dnsmasq (included with
Slackware) is provided at /usr/doc/dnscrypt-proxy-@VERSION@/dnsmasq.conf. A
sample configuration for bind/named that also does local DNSSEC validation (if
supported by the upstream DNS server) is also provided at
/usr/doc/dnscrypt-proxy-@VERSION@/named.conf. Both configurations run on port
53, forwarding lookups to dnscrypt-proxy running on port 55. In order to use
these configurations you will need to change the port dnscrypt-proxy runs on in
/etc/default/dnscrypt-proxy.
|
