--- title: "Stubby: DoT DNS client on OpenBSD (EXPERIMENTAL) " date: 2018-03-22T14:21:09+01:00 description: "Stubby installation experimentation, a DoT and DNSSEC client, on OpenBSD (6.3)." draft: false lastmod: 2018-10-11T21:24:09+01:00 tags: ["OpenBSD", "stubby", "experimental", "DNS", "DoT", "DNSSEC"] --- ## Description [Stubby](https://github.com/getdnsapi/stubby) is a DNS client, using secure protocol *({{< abbr DoT "DNS-over-TLS" >}})*. This encrypts DNS queries sent from your machine to a DNS resolver, or an authoritative DNS server to increase the confidentiality. It can request queries according DNSSEC protocol, too. {{< note warning >}} Warning: it does not act as DNS cache resolver, nor as an authoritative DNS server; it's only a DNS client! In addition, there is no package, nor port on OpenBSD stable. Hence is the reason of title "EXPERIMENTAL". We're going to retrieve sources, compil, install and configure them. {{< /note >}} ## Installation The **stubby** client is/will be installed on OpenBSD stable. * at this day, now: 6.3 ### Prerequisite * `OpenSSL` : install by default * `Libyaml` : to install… * `autoconf`, `automake` : to install to configure, and build before installation. {{< code "sys-openbsd-stubby-pkg-add-autoconf-automake" sh >}} Then, we will follow the official installation recommandations from [sources](https://dnsprivacy.org/wiki/pages/viewpage.action?pageId=3145786), by adapting them to OpenBSD, step by step. ### Download {{< code "sys-openbsd-stubby-git-clone" sh >}} The second command `git` permits us to get/obtain the most recent sources . ### Configuration {{< code "sys-openbsd-stubby-config-src" sh >}} ### Compilation `$ make`
`# make install` Of course, if you had configured *{{< man doas >}}*, you can executed the ultimate command, as:
`$ doas make install` ### resolv.conf It's necessary to modify your `/etc/resolv.conf` file in order to communicate directly with stubby:
`nameserver 127.0.0.1`
`nameserver ::1` ### stubby.yml The stubby's configuration file is: `/usr/local/etc/stubby/stubby.yml`. You can create your personal, as `~/.stubby.yml`. It will be read in first. ## Execution To execute **stubby**, run as: {{< code "sys-openbsd-stubby-start" sh >}} Some interesting informations, about flags: * `-C`: to specify other configuration file. * `-g`: to run in background mode. * `-i`: to check the configuration! * `-l`: to log. Actually, the output is only on the standard `stdout`! ### Test We use `dig`: => IPv4 {{< code "sys-openbsd-stubby-test-ipv4" sh >}} => IPv6 : {{< code "sys-openbsd-stubby-test-ipv6" sh >}} ------------------------------------------------------------------------