Slackware-specific nss-tls HOWTO
--------------------------------
1. Make sure /etc/nss-tls.conf has at least one DNS-over-HTTPS server URL
listed. The default config file has 3, so you shouldn't need to
change it unless you don't trust the default servers (one of which
belongs to Google). Although it's possible to use hostnames in the
config file, I highly recommend using IP addresses.
2. Add this code to your /etc/rc.d/rc.local:
[ -x /etc/rc.d/rc.nss-tlsd ] && /etc/rc.d/rc.nss-tlsd start
3. Make sure /etc/rc.d/rc.nss-tlsd is executable (it is, by default).
4. Manually start the daemon with the command: /etc/rc.d/rc.nss-tlsd start
Or, you could reboot instead.
At this point, you should be able to use the tlslookup(1) tool to
do some test lookups. Try "tlslookup www.slackware.com". You should
get output similar to:
$ tlslookup www.slackware.com
23.218.93.137
23.218.93.171
2600:1402:9800:d::b833:2ac7
2600:1402:9800:d::b833:2acd
5. Edit /etc/nsswitch.conf and find the line that reads "hosts: files dns".
Replace the "dns" with "tls", so the line looks like:
hosts: files tls
Now, try "ping www.slackware.com". If this works, you should be
able to use normal clients (web browsers, mail, etc). nss-tls
transparently replaces the DNS resolver... but not everything
will work. In particular, git, curl, and alpine (the mail client)
are known not to work in this configuration. To support these
applications, see the next step.
6. To keep regular DNS as a fallback option, change the line in
/etc/nss-tls.conf again, so it looks like:
hosts: files tls dns
This allows applications that don't work with nss-tls to use regular
DNS instead. Notably, git won't work without fallback DNS.
7. Optional: users can run their own instances of the daemon, with
caching support. Run the command /usr/bin/nss-tlsd-user from
your startup scripts (~/.bash_profile for console logins, or
whatever your desktop environment uses if you use GUI login).
This isn't really required, though it can provide some extra
security on multi-user systems. If you're the only person who uses
your Slackware box, you probably don't need this.
Running a server
----------------
nss-tls is just the client side of DNS-over-HTTPS. If you want to run
a server, look into unbound (on SBo). In future Slackware versions,
you may be able to use Slackware's bind for this (the version in 15.0
doesn't support it, but the one in -current should).
|
