unicolet.org

One notable thing I did in my first 25 years was in answer to an odd request I got from a customer of a customer (don't ask). This particular organization had lost control of their own authoritative DNS (public DNS) and needed a hand to recover the zone hosted there. Unfortunately this was the only DNS so taking it down to mount the disk would have resulted in unacceptable downtime and there was also the risk that the disk had been encrypted (they were not sure). So many things were unknown about this server that even a reboot was considered risky. So, what we ended up doing instead was mirroring the network traffic on the switch to a new server, run tcpdump on all DNS traffic for a couple of weeks, and then through a series of specially crafted tshark + awk commands we rebuilt the entire zone file (which was not very large, thankfully). We reviewed the zone file with the customer, loaded into a new server and then swapped it in while keeping the old system running. I never heard f...

Many moons ago I was an enthusiastic user of OpenDNS  (when it still was a standalone company), then between one move and the other I forgot to enable it again and found Google/Cloudflare to be equally capable and fast. However I always missed the protection capabilities of OpenDNS, and today I spent some time looking for alternatives. That's how I came across Quad9 : an open DNS recursive service for free security and high privacy. Importantly: Quad9 is operated by a Swiss public-benefit, not-for-profit foundation with the purpose of improving the privacy and cybersecurity of Internet users. Quad9 is headquartered in Zürich and is subject to Swiss privacy law (Swiss government extends that protection of the law to Quad9's users throughout the world, regardless of citizenship or country of residence). I enabled Quad9 on my home router and then proceeded to test it. But first I had to find a malicious url, which funnily enough is harder than I thought :D Quad9 does not support ...

NGINX has had support for dynamic upstream modules for a while in the community distribution and examples abund. I think this is probably one of the clearest I could find. Finding a similar config for stream proxies turned out to be surprisingly hard, so here I'm sharing my solution in the hope that it can be useful to somebody. Or someone more experienced can point out a better alternative. In my case my upstream is an ELB which can and will change ip address often so using the static DNS name was not an option.