MDM integration (zerotouch configuration)

[mrbluecoat]

Somewhat similar to #63 but instead of another app controlling Rethink it would be a Mobile Device Manager (MDM), like Hexnode, Intune, etc. This would allow a large organization to deploy Rethink and configure it to safely use specific DNS servers without employees changing, stopping, or bypassing the settings.

[ignoramous]

Thanks. Are there MDM-specific APIs that Rethink must implement here? If so, which ones?

[mrbluecoat]

Thanks for the quick response! Our specific use case involves Cisco Meraki so I'll use that MDM as an example. Meraki doesn't require an API integration; instead, you provide key-value pairs to configure the app: https://documentation.meraki.com/SM/Profiles_and_Settings/Using_the_Managed_App_Settings_Payload

Here are key-value pairs that come to mind:

• blocked_domains: "example.com,example.net,example.org"
• dns_type: "Rethink DNS"
• dns_resolver: "Max"
• dns_category: "RDNS Plus"
• rdns_plus: "Adult,Vpn & proxies,Recommended,Malware,Scams & phishing,Spam,Spyware,Url-shorteners"
• website_icon_dns_logs: true
• prevent_dns_leaks: true
• enable_network_visibility: true
• use_all_available_networks: true
• ip_version: 4
• block_udp_except_dns_ntp: true
• block_when_dns_bypassed: true
• ip_port_block: "173.236.193.195"
• ip_port_allow: ""
• enable_on_device_logging: true
• check_for_app_updates: true
• auto_start_on_power_up: true
• app_notification: false

In addition, we would need a PIN-protected lock screen to prevent settings changes (this is a parental/manager PIN which is different than the "Enable app lock" which the device owner would know). Here's a code example of that: https://github.com/gdlow/brickguard/blob/master/app/src/main/java/com/gdlow/brickguard/LockActivity.java

[mrbluecoat]

P.S. Your VPN & Proxies list doesn't block Opera's default built-in VPN. You may want to compare with https://cleanbrowsing.org/filters/ Family Filter (which does) and https://www.ipaddress.com/proxy-list/ and https://iplists.firehol.org/?ipset=dronebl_anonymizers

[lessload]

• Not recommend to add MDM to main app. Dev should do something like pfSense/pfSense-Plus, seperate open source app from open source + Business-feature app , because many MDM is free to use but not open source license.

[mrbluecoat]

Oh, sorry I thought paid plans were launching soon for RethinkDNS. You can close if not planned.