nusenu / ansible-relayor

An Ansible Role for Tor Relay Operators
GNU General Public License v3.0
248 stars 43 forks source link

Update tor_dnsresolver_blacklist #194

Closed goll closed 5 years ago

goll commented 5 years ago

Updates the blacklisted DNS resolvers with changes and IPv6 additions.

nusenu commented 5 years ago

hello, thanks for your interest, I'll comment directly next to the changes.

Did the currently shipped GPG key cause any issues for you?

goll commented 5 years ago

regarding the key, it was mostly syncing with the upstream repository as the current file doesn't exist anymore: https://deb.torproject.org/torproject.org/

Then add the gpg key used to sign the packages by running the following commands at your command prompt:

    # curl https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --import
    # gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add -

since relayor doesn't yet handle those keyring packages the key should always reflect upstream afaik:

We provide a Debian package to help you keep our signing key current. It is recommended you use it. Install it with the following commands:

    # apt update
    # apt install tor deb.torproject.org-keyring
nusenu commented 5 years ago

since relayor doesn't yet handle those keyring packages

the keyring package is supposed to be installed by relayor, does that not work for you?

goll commented 5 years ago

oops, ignore that keyring comment (local issue), you're right regarding the keyring package

nusenu commented 5 years ago

please make this PR only about the DNS blacklist changes and keep the other changes separate from it, thank you!

goll commented 5 years ago

thank you and sorry for the noise, hope the commit looks good now

nusenu commented 5 years ago

thanks for making this just about the dns blacklist

could you add: 2620:fe::10 – 2620:fe:0:0:0:0:0:10 2620:fe::fe:10 – 2620:fe:0:0:0:0:fe:10 from https://www.quad9.com/faq/ as well? thanks!

goll commented 5 years ago

oops, missed the secondary IPv6 addresses the first time I looked, thanks, updated!

nusenu commented 5 years ago

the regex will match much more then we blacklisted before but it will do for now, merged.

thank you for your contribution