Encrypted DNS from Boot to Runtime: A Zero Trust Milestone in RHEL

on YouTube ↗36m

" summary

RHEL adds system-wide encrypted DNS that works during installation, early boot and runtime by changing more than 10 components (Anaconda, dracut, OpenSSL, NetworkManager, dnsconfd, Unbound, Bind, FreeIPA, SSSD, Anaconda kickstart hooks, etc.) and shipping a local resolver so applications need no changes. It uses Unbound for DoT forwarding with a local port 53 cache and TLS to upstreams on port 853, accepts kickstart CA certs and kernel args, provides enforce/relaxed policies and plans DoH support.

AI-written summary · about

" chapters (16)

1. 0:00Encrypted DNS milestone intro
2. 2:13DNS traffic privacy importance
3. 7:12Zero trust architecture needs
4. 9:03Encrypted DNS in RHEL needs
5. 10:57System integration challenges
6. 13:28Encrypted DNS protocols
7. 15:56NetworkManager for encrypted DNS
8. 17:19Install encrypted DNS
9. 19:50IPA server with encrypted DNS
10. 22:41Deploying IPA encrypted DNS
11. 25:12Future DNS over HTTPS plans
12. 27:24Q&A: Failover policies
13. 30:39Q&A: Local caching options
14. 33:00Q&A: BIND limitations
15. 34:27Q&A: NetworkManager experience
16. 35:31Closing remarks

" related talks

• 01h 27mDNS at 30Jim Hague · ACCU 2017
• 25mProtective DNS, DNS Encryption, & Zero-Trust: Tackling NSA GuidanceSteve Staden · RSAC 2022
• 34mUsing DNS as a layer of defenseSwapneel Patnekar · Rootconf Pune 2019
• 37mUsing RHEL built in Security Technologies dailyDalibor Pospíšil, Sergio Correia · DevConf.CZ 2021
• 46mDNSSECChristoph Egger · FrOSCon 2016
• 32mDNS as Added Security Against Ransomware AttacksArtsiom Holub · 34th Annual FIRST Conference 2022
• 15mRHINE: Robust and High-performance Internet Naming with E2E AuthenticityDavid Basin, Si Liu, Adrian Perrig, Huayi Duan, Rubén Fischer, Jie Lou · NSDI 2023
• 43mBlock DNS exfiltration with dnsmasq proxyMagnus Longva · NDC Security 2023