|
 |
5136d3 |
From 3a593d133f91c5126105efd03246b3f61f103dd4 Mon Sep 17 00:00:00 2001
|
|
|
5136d3 |
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
|
|
|
5136d3 |
Date: Tue, 30 Jun 2020 18:06:29 +0200
|
|
|
5136d3 |
Subject: [PATCH] Modify upstream configuration to safe defaults
|
|
|
5136d3 |
|
|
|
5136d3 |
Most important change would be to listen only on localhost. Default
|
|
|
5136d3 |
configuration should not listen to request from remote hosts. Match also
|
|
|
5136d3 |
user and paths to directories shipped in Fedora.
|
|
|
5136d3 |
---
|
|
|
5136d3 |
dnsmasq.conf.example | 24 +++++++++++++++++++-----
|
|
|
5136d3 |
1 file changed, 19 insertions(+), 5 deletions(-)
|
|
|
5136d3 |
|
|
|
5136d3 |
diff --git a/dnsmasq.conf.example b/dnsmasq.conf.example
|
|
|
5136d3 |
index bf19424..36fba33 100644
|
|
|
5136d3 |
--- a/dnsmasq.conf.example
|
|
|
5136d3 |
+++ b/dnsmasq.conf.example
|
|
|
5136d3 |
@@ -22,7 +22,7 @@
|
|
|
5136d3 |
|
|
|
5136d3 |
# Uncomment these to enable DNSSEC validation and caching:
|
|
|
5136d3 |
# (Requires dnsmasq to be built with DNSSEC option.)
|
|
|
5136d3 |
-#conf-file=%%PREFIX%%/share/dnsmasq/trust-anchors.conf
|
|
|
5136d3 |
+#conf-file=/usr/share/dnsmasq/trust-anchors.conf
|
|
|
5136d3 |
#dnssec
|
|
|
5136d3 |
|
|
|
5136d3 |
# Replies which are not DNSSEC signed may be legitimate, because the domain
|
|
|
5136d3 |
@@ -96,14 +96,16 @@
|
|
|
5136d3 |
|
|
|
5136d3 |
# If you want dnsmasq to change uid and gid to something other
|
|
|
5136d3 |
# than the default, edit the following lines.
|
|
|
5136d3 |
-#user=
|
|
|
5136d3 |
-#group=
|
|
|
5136d3 |
+user=dnsmasq
|
|
|
5136d3 |
+group=dnsmasq
|
|
|
5136d3 |
|
|
|
5136d3 |
# If you want dnsmasq to listen for DHCP and DNS requests only on
|
|
|
5136d3 |
# specified interfaces (and the loopback) give the name of the
|
|
|
5136d3 |
# interface (eg eth0) here.
|
|
|
5136d3 |
# Repeat the line for more than one interface.
|
|
|
5136d3 |
#interface=
|
|
|
5136d3 |
+# Listen only on localhost by default
|
|
|
5136d3 |
+interface=lo
|
|
|
5136d3 |
# Or you can specify which interface _not_ to listen on
|
|
|
5136d3 |
#except-interface=
|
|
|
5136d3 |
# Or which to listen on by address (remember to include 127.0.0.1 if
|
|
|
5136d3 |
@@ -114,6 +116,10 @@
|
|
|
5136d3 |
# disable DHCP and TFTP on it.
|
|
|
5136d3 |
#no-dhcp-interface=
|
|
|
5136d3 |
|
|
|
5136d3 |
+# Serve DNS and DHCP only to networks directly connected to this machine.
|
|
|
5136d3 |
+# Any interface= line will override it.
|
|
|
5136d3 |
+#local-service
|
|
|
5136d3 |
+
|
|
|
5136d3 |
# On systems which support it, dnsmasq binds the wildcard address,
|
|
|
5136d3 |
# even when it is listening on only some interfaces. It then discards
|
|
|
5136d3 |
# requests that it shouldn't reply to. This has the advantage of
|
|
|
5136d3 |
@@ -121,7 +127,11 @@
|
|
|
5136d3 |
# want dnsmasq to really bind only the interfaces it is listening on,
|
|
|
5136d3 |
# uncomment this option. About the only time you may need this is when
|
|
|
5136d3 |
# running another nameserver on the same machine.
|
|
|
5136d3 |
-#bind-interfaces
|
|
|
5136d3 |
+#
|
|
|
5136d3 |
+# To listen only on localhost and do not receive packets on other
|
|
|
5136d3 |
+# interfaces, bind only to lo device. Comment out to bind on single
|
|
|
5136d3 |
+# wildcard socket.
|
|
|
5136d3 |
+bind-interfaces
|
|
|
5136d3 |
|
|
|
5136d3 |
# If you don't want dnsmasq to read /etc/hosts, uncomment the
|
|
|
5136d3 |
# following line.
|
|
|
5136d3 |
@@ -535,7 +545,7 @@
|
|
|
5136d3 |
# The DHCP server needs somewhere on disk to keep its lease database.
|
|
|
5136d3 |
# This defaults to a sane location, but if you want to change it, use
|
|
|
5136d3 |
# the line below.
|
|
|
5136d3 |
-#dhcp-leasefile=/var/lib/misc/dnsmasq.leases
|
|
|
5136d3 |
+#dhcp-leasefile=/var/lib/dnsmasq/dnsmasq.leases
|
|
|
5136d3 |
|
|
|
5136d3 |
# Set the DHCP server to authoritative mode. In this mode it will barge in
|
|
|
5136d3 |
# and take over the lease for any client which broadcasts on the network,
|
|
|
5136d3 |
@@ -673,7 +683,11 @@
|
|
|
5136d3 |
# Include all files in a directory which end in .conf
|
|
|
5136d3 |
#conf-dir=/etc/dnsmasq.d/,*.conf
|
|
|
5136d3 |
|
|
|
5136d3 |
+# Include all files in /etc/dnsmasq.d except RPM backup files
|
|
|
5136d3 |
+conf-dir=/etc/dnsmasq.d,.rpmnew,.rpmsave,.rpmorig
|
|
|
5136d3 |
+
|
|
|
5136d3 |
# If a DHCP client claims that its name is "wpad", ignore that.
|
|
|
5136d3 |
# This fixes a security hole. see CERT Vulnerability VU#598349
|
|
|
5136d3 |
#dhcp-name-match=set:wpad-ignore,wpad
|
|
|
5136d3 |
#dhcp-ignore-names=tag:wpad-ignore
|
|
|
5136d3 |
+
|
|
|
5136d3 |
--
|
|
|
5136d3 |
2.26.2
|
|
|
5136d3 |
|