<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>DNS &#8211; Phocean.net</title>
	<atom:link href="/tag/dns/feed" rel="self" type="application/rss+xml" />
	<link>/</link>
	<description>Computer Security Blog</description>
	<lastBuildDate>Fri, 24 Feb 2017 21:17:51 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>https://wordpress.org/?v=4.9.10</generator>
	<item>
		<title>SSH timout</title>
		<link>/2007/04/21/ssh-timout.html</link>
		<pubDate>Sat, 21 Apr 2007 18:18:00 +0000</pubDate>
		<dc:creator><![CDATA[phocean]]></dc:creator>
				<category><![CDATA[Network]]></category>
		<category><![CDATA[OpenBSD]]></category>
		<category><![CDATA[System]]></category>
		<category><![CDATA[Cisco]]></category>
		<category><![CDATA[DNS]]></category>
		<category><![CDATA[Pix]]></category>
		<category><![CDATA[SSH]]></category>

		<guid isPermaLink="false">http://192.168.1.10/wordpress/?p=28</guid>
		<description><![CDATA[<p>After a fresh set up of your network, don't be surprised that your ssh connections are slow.</p>]]></description>
				<content:encoded><![CDATA[<p>After a fresh set up of your network, don&#8217;t be surprised that your ssh connections are slow.</p>
<p><span id="more-28"></span></p>
<p>Depending on the systems and equipment you use, you might encounter some timeout that make any login impossible.</p>
<p>I got such timeouts with an OpenBSD machine behind a Pix firewall. With Linux machines, it was very slow but worked.</p>
<p>This issue is related to the reverse DNS check that SSH makes by default during the login process. This is in order to improve the security. Howerver, this is not so secure as a DNS cache can also be spoofed.<br />
Considering this, you can disable this check with not much worry with the right option in your <strong>/etc/sshd_config</strong> file :</p>
<pre>UseDNS no</pre>
<p>Of course, the best solution will be that you set up a full DNS infrastructure as soon as possible.</p>
]]></content:encoded>
			</item>
		<item>
		<title>OpenVPN and DNS on a linux client</title>
		<link>/2006/12/07/openvpn-and-dns-on-a-linux-client.html</link>
		<comments>/2006/12/07/openvpn-and-dns-on-a-linux-client.html#comments</comments>
		<pubDate>Thu, 07 Dec 2006 16:42:00 +0000</pubDate>
		<dc:creator><![CDATA[phocean]]></dc:creator>
				<category><![CDATA[Cryptography]]></category>
		<category><![CDATA[Hardware]]></category>
		<category><![CDATA[Linux]]></category>
		<category><![CDATA[Network]]></category>
		<category><![CDATA[News]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[System]]></category>
		<category><![CDATA[DNS]]></category>
		<category><![CDATA[OpenVPN]]></category>
		<category><![CDATA[Protocols]]></category>

		<guid isPermaLink="false">http://192.168.1.10/wordpress/?p=12</guid>
		<description><![CDATA[<p>I got a weired issue with Linux clients while it worked fine with Windows machines. For some reason, the /etc/resolv.conf did not get updated.</p> <p>I found out a workaround thanks to <a hreflang="en" href="http://www.smop.co.uk/node/69">this page</a>.</p> Of course, your server configuration file must contain (if 192.168.1.1 is your DNS server):<br /><blockquote><p><code>push &#34;dhcp-option DNS 192.168.1.1&#34;</code></p> </blockquote><br />]]></description>
				<content:encoded><![CDATA[<p>I got a weired issue with Linux clients while it worked fine with Windows machines. For some reason, the /etc/resolv.conf did not get updated.  I found out a workaround thanks to <a hreflang="en" href="http://www.smop.co.uk/node/69">this page</a>.  Of course, your server configuration file must contain (if 192.168.1.1 is your DNS server):</p>
<pre>push &quot;dhcp-option DNS 192.168.1.1&quot;</pre>
<p><span id="more-12"></span> First, you will need the resolvconf program. In debian :</p>
<pre>$ apt-get install resolvconf</pre>
<p>Then, you will need to add these lines into the configuration file of your Linux client (let&#8217;s say /etc/openvpn/client.conf) : </p>
<pre>up /etc/openvpn/domain.up plugin /usr/lib/openvpn/openvpn-down-root.so /etc/openvpn/domain.down</pre>
<p>The plugin provided by OpenVpn gives back root privilege (when initialized, OpenVPN needs root access but drops it soon).<br />
Now let&#8217;s create the scripts :  </p>
<p><strong>/etc/openvpn/domain.up</strong> : </p>
<pre> #!/bin/sh
    # really naff script to add nameserver entry on up
    DEV=$1    
    set | sed -n &quot;      s/^foreign_option_.* DNS \(.*\)'/nameserver \1/; T next; p;
    :next; s/^foreign_option_.* DOMAIN \(.*\)'/domain \1/; T; p;
      &quot; | resolvconf -a $DEV
    resolvconf -u</pre>
<p><strong>/etc/openvpn/domain.dow</strong>n : </p>
<pre> #!/bin/sh
  # really naff script to delete nameserver entry on down
  DEV=$1
  resolvconf -d $DEV
  resolvconf -u</pre>
<p>Now let&#8217;s give them the suitable rights :</p>
<pre>$ chmod +x domain*</pre>
<p>Finally, just restart openvpn and that should be fine !</p>
<p><strong>UPDATE</strong> <strong>2008/07/11</strong> : The two scripts above are kind of obsolete, because, at least in Debian Etch, a similar script is included in the OpenVPN package.</p>
<p>There it is :</p>
<pre>
#!/bin/bash
# 
# Parses DHCP options from openvpn to update resolv.conf
# To use set as 'up' and 'down' script in your openvpn *.conf:
# up /etc/openvpn/update-resolv-conf
# down /etc/openvpn/update-resolv-conf
#
# Used snippets of resolvconf script by Thomas Hood &lt;jdthood@yahoo.co.uk&gt; 
# and Chris Hanson
# Licensed under the GNU GPL.  See /usr/share/common-licenses/GPL. 
#
# 05/2006 chlauber@bnc.ch
# 
# Example envs set from openvpn:
# foreign_option_1='dhcp-option DNS 193.43.27.132'
# foreign_option_2='dhcp-option DNS 193.43.27.133'
# foreign_option_3='dhcp-option DOMAIN be.bnc.ch'

[ -x /sbin/resolvconf ] || exit 0

case $script_type in

up)
	for optionname in ${!foreign_option_*} ; do
		option=&quot;${!optionname}&quot;
		echo $option
		part1=$(echo &quot;$option&quot; | cut -d &quot; &quot; -f 1)
		if [ &quot;$part1&quot; == &quot;dhcp-option&quot; ] ; then
			part2=$(echo &quot;$option&quot; | cut -d &quot; &quot; -f 2)
			part3=$(echo &quot;$option&quot; | cut -d &quot; &quot; -f 3)
			if [ &quot;$part2&quot; == &quot;DNS&quot; ] ; then
				IF_DNS_NAMESERVERS=&quot;$IF_DNS_NAMESERVERS $part3&quot;
			fi
			if [ &quot;$part2&quot; == &quot;DOMAIN&quot; ] ; then
				IF_DNS_SEARCH=&quot;$part3&quot;
			fi
		fi
	done
	R=&quot;&quot;
	if [ &quot;$IF_DNS_SEARCH&quot; ] ; then
        	R=&quot;${R}search $IF_DNS_SEARCH&quot;
	fi
	for NS in $IF_DNS_NAMESERVERS ; do
        	R=&quot;${R}nameserver $NS&quot;
	done
	echo -n &quot;$R&quot; | /sbin/resolvconf -a &quot;${dev}.inet&quot;
	;;
down)
	/sbin/resolvconf -d &quot;${dev}.inet&quot;
	;;
esac
</pre>
]]></content:encoded>
			<wfw:commentRss>/2006/12/07/openvpn-and-dns-on-a-linux-client.html/feed</wfw:commentRss>
		<slash:comments>13</slash:comments>
		</item>
	</channel>
</rss>
