mirror of
https://github.com/Ponce/slackbuilds
synced 2024-11-18 22:06:04 +01:00
56 lines
2.3 KiB
Text
56 lines
2.3 KiB
Text
A. Setup
|
|
|
|
An init script and configuration file have been provided to run dnscrypt-proxy
|
|
as a daemon. To configure dnscrypt-proxy, edit /etc/dnscrypt-proxy.conf with
|
|
the desired settings. By default dnscrypt-proxy will use a random DNS server
|
|
and will run on localhost (127.0.0.1), port 53.
|
|
|
|
The configuration file is setup to use a dnscrypt user by default, and to
|
|
chroot into that user's home directory to maximize security. In order to use
|
|
the default configuration you should create a dnscrypt user and group with the
|
|
following commands:
|
|
|
|
groupadd -g 293 dnscrypt
|
|
useradd -u 293 -g 293 -c "DNSCrypt" -d /run/dnscrypt -s /bin/false dnscrypt
|
|
|
|
If you decide to use another user you should edit the CHROOTDIR option in
|
|
/etc/default/dnscrypt-proxy and the User setting in /etc/dnscrypt-proxy.conf
|
|
(there are example settings provided for the user 'nobody').
|
|
|
|
In order to send all DNS requests through dnscrypt-proxy, you will need to
|
|
update /etc/resolv.conf to point to localhost. If using dhcpcd, the easiest way
|
|
to set dnscrypt-proxy as the primary (but not exclusive) dns resolver is to
|
|
create file /etc/resolv.conf.head with the following line:
|
|
|
|
nameserver 127.0.0.1
|
|
|
|
You may also have to add the following line to enable EDNS:
|
|
|
|
options edns0
|
|
|
|
To start dnscrypt-proxy automatically at system start, add the following to
|
|
/etc/rc.d/rc.local:
|
|
|
|
if [ -x /etc/rc.d/rc.dnscrypt-proxy ]; then
|
|
/etc/rc.d/rc.dnscrypt-proxy start
|
|
fi
|
|
|
|
To properly stop dnscrypt-proxy on system shutdown, add the following to
|
|
/etc/rc.d/rc.local_shutdown:
|
|
|
|
if [ -x /etc/rc.d/rc.dnscrypt-proxy ]; then
|
|
/etc/rc.d/rc.dnscrypt-proxy stop
|
|
fi
|
|
|
|
B. DNS Cache
|
|
|
|
dnscrypt-proxy provides limited control over how it caches DNS queries. In
|
|
order to minimize the number of external DNS lookups, you can also run a local
|
|
caching DNS server. A sample configuration for dnsmasq (included with
|
|
Slackware) is provided at /usr/doc/dnscrypt-proxy-@VERSION@/dnsmasq.conf. A
|
|
sample configuration for bind/named that also does local DNSSEC validation (if
|
|
supported by the upstream DNS server) is also provided at
|
|
/usr/doc/dnscrypt-proxy-@VERSION@/named.conf. Both configurations run on port
|
|
53, forwarding lookups to dnscrypt-proxy running on port 55. In order to use
|
|
these configurations you will need to change the port dnscrypt-proxy runs on in
|
|
/etc/dnscrypt-proxy.conf.
|