On to, 01 loka 2020, Michael Catanzaro wrote:
On Thu, Oct 1, 2020 at 3:32 pm, Marius Schwarz
<fedoradev@xxxxxxxxxxxx> wrote:
I think, he meant the systemd-resolved fiallback to Cloudflare and
Google. Is that in the fedora build? If so, i suggest to patch it out.
That will fix the issue for me in perspective of the GDPR.
Unless you explain this *very* clearly, I'm going to ignore it,
because it seems farfetched. Fedora is not operating its own DNS
server or collecting any sort of DNS-related data from you.
We are not going to patch out fallback to Cloudflare or Google because
it is a non-issue. Fallback only happens when you have zero other DNS
servers configured. When was the last time you connected to a network
and there's no DHCP, no nothing? The number of users without some
other working DNS is probably under 0.1%. Even then, I think you also
have to disable NetworkManager for systemd-resolved to ever use its
fallback DNS, because NetworkManager will configure a ~. DNS domain,
causing systemd-resolved to never use its global DNS settings. (I
think. That's my reading of the manpage. Testing welcome from anyone
who wants to confirm that.)
We use the drop-in snippet configuration file in
/etc/systemd/resolved.conf.d/zzz-ipa.conf to configure this behavior on
IPA servers which deploy integrated DNS server. It works, so there is a
confirmation.
So (if I'm right) we are talking about the exceeding rare combination
of (a) no DNS set by DHCP, and also (b) user manually disabled
NetworkManager. If you're really going to do (b) you will probably
also disable systemd-resolved, right? Or make the one-line config file
change to remove the fallback DNS? Or just manually set some DNS
server? Seriously, this is a silly thing to worry about.
You can also drop a configuration snippet in
/etc/systemd/resolved.conf.d/ to contain
FallbackDNS=<servers>
This will disable global DNS servers for any case.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
