Category Archives: Linux

Dnsmasq Isn’t Responding to All Queries

If you have a Dnsmasq server that isn’t responding to all DNS queries, it’s likely your distro (or you) set the local-service option. I assume this is to prevent servers from contributing to a DDoS attack or leaking network information; however, this setting is very restrictive and limits responses to the local subnet(s).

If you have a network with a few different subnets, you’ll need to disable this option. Please ensure your firewall is appropriately configured before proceeding.

local-service may be specified in the /etc/dnsmasq.conf file or as a command line parameter when the Dnsmasq is started. On Debian, the command line parameter is added when Dnsmasq is started by /etc/init.d/dnsmasq.

The simple solution is to add


to /etc/dnsmasq.conf, because the interfaceexcept-interfacelisten-address, and auth-server options all cause local-service to not have an effect.

Minimal dnscrypt-proxy DoH Config

dnscrypt-proxy has a lot of features and can be intimidating to setup. Issues range from understanding what dnscrypt is to how to pick list of sources to understanding what a stamp is.

While it’s not a recommended configuration, I wanted to setup a very simple/minimal dnscrypt-proxy that uses a few well known DoH servers.


  1. Install dnscrypt-proxy.
  2. Edit the configuration file (/etc/dnscrypt-proxy.toml or /etc/dnscrypt-proxy/dnscrypt-proxy.toml on Linux/UNIX systems).
    1. Delete or comment out server_names
      # server_names = ['scaleway-fr', 'google', 'yandex', 'cloudflare']
    2. Delete or comment out the entries under [sources]
    3. If present, ensure doh_servers = true
    4. Depending on the servers you configure, you might need to edit require_dnssec, require_nolog, and require_nofilter to be compatible with the servers. Since I’m explicitly configuring a small list of servers, it’s easier to turn off all restrictions
      require_* = false
    5. Add your desired servers to the [static] section (for this you should get a basic understanding of stamps)
      static entry
      Note: each static entry requires a unique name.


While you don’t need a detailed understanding of stamps, it’s good to have a basic understanding; so you can audit the servers you are adding and you can add custom servers.

A stamp is just dnscrypt-proxy’s format for encoding all relevant parameters for a DNS server. For a DoH server, that consists of:

  • Properties (required) – flags indicating if the server is DNSSEC capable, logs queries, or filters results.
  • IP address (optional) – If an IP address is not provided the Host will be used.
    Note: The spec says the port (if not 443) should be provided in this field; however, the public lists and the stamp calculator include the port in the Host field
  • Host (required) – self-explanatory
  • Hashes (optional) – doesn’t appear to be working. This should allow trusting custom cert chains; however, dnscrypt-proxy is only using the platform’s trust store to validate certificate chains.
  • Path (required) – for DoH servers this is generally “/dns-query”. This should be well documented with the information about each DoH server.

You have three options:

  1. Generate your own stamps using the stamp calculator
  2. Use stamps below
  3. Copy stamps from a public list:

For any pre-generated stamps, you can check the contents by pasting the stamp into to Stamp field of the stamp calculator.

DoH Server Stamps

Some stamps for common DoH servers. While I have verified these stamps work, I make no claim to the accuracy of the properties.



Properties: DNSSEC, Filter (malicious domain blocking), No Logging (limited per the Quad9 FAQ):

# Quad9 Secured DoH
stamp = 'sdns://AgMAAAAAAAAABzkuOS45LjkADmRuczkucXVhZDkubmV0Ci9kbnMtcXVlcnk'

# Quad9 Secured DoH
stamp = 'sdns://AgMAAAAAAAAADTE0OS4xMTIuMTEyLjkADmRuczkucXVhZDkubmV0Ci9kbnMtcXVlcnk'

# Quad9 Secured 2620:fe::9 DoH
stamp = 'sdns://AgMAAAAAAAAADFsyNjIwOmZlOjo5XQAOZG5zOS5xdWFkOS5uZXQKL2Rucy1xdWVyeQ'

# Quad9 Secured 2620:fe::fe:9 DoH
stamp = 'sdns://AgMAAAAAAAAAD1syNjIwOmZlOjpmZTo5XQAOZG5zOS5xdWFkOS5uZXQKL2Rucy1xdWVyeQ'

Properties: DNSSEC, No Filter, No Logging (limited per the Quad9 FAQ):

# Quad9 Unsecured DoH
stamp = 'sdns://AgMAAAAAAAAACDkuOS45LjEwAA9kbnMxMC5xdWFkOS5uZXQKL2Rucy1xdWVyeQ'

# Quad9 Unsecured DoH
stamp = 'sdns://AgMAAAAAAAAADjE0OS4xMTIuMTEyLjEwAA9kbnMxMC5xdWFkOS5uZXQKL2Rucy1xdWVyeQ'

# Quad9 Unsecured 2620:fe::10 DoH
stamp = 'sdns://AgMAAAAAAAAADVsyNjIwOmZlOjoxMF0AD2RuczEwLnF1YWQ5Lm5ldAovZG5zLXF1ZXJ5'

# Quad9 Unsecured 2620:fe::fe:10 DoH
stamp = 'sdns://AgMAAAAAAAAAEFsyNjIwOmZlOjpmZToxMF0AD2RuczEwLnF1YWQ5Lm5ldAovZG5zLXF1ZXJ5'

Cloudflare DNS


Properties: DNSSEC, Filter (malicious content blocking), No Logging (limited per Privacy):

# Cloudflare Security DoH
stamp = 'sdns://AgMAAAAAAAAABzEuMS4xLjIAG3NlY3VyaXR5LmNsb3VkZmxhcmUtZG5zLmNvbQovZG5zLXF1ZXJ5'

# Cloudflare Security DoH
stamp = 'sdns://AgMAAAAAAAAABzEuMC4wLjIAG3NlY3VyaXR5LmNsb3VkZmxhcmUtZG5zLmNvbQovZG5zLXF1ZXJ5'

# Cloudflare Security 2606:4700:4700::1112 DoH
stamp = 'sdns://AgMAAAAAAAAAFlsyNjA2OjQ3MDA6NDcwMDo6MTExMl0AG3NlY3VyaXR5LmNsb3VkZmxhcmUtZG5zLmNvbQovZG5zLXF1ZXJ5'

# Cloudflare Security 2606:4700:4700::1002 DoH
stamp = 'sdns://AgMAAAAAAAAAFlsyNjA2OjQ3MDA6NDcwMDo6MTAwMl0AG3NlY3VyaXR5LmNsb3VkZmxhcmUtZG5zLmNvbQovZG5zLXF1ZXJ5'

Properties: DNSSEC, No Filter, No Logging (limited per Privacy):

# Cloudflare DNS DoH
stamp = 'sdns://AgMAAAAAAAAABzEuMS4xLjEAEmNsb3VkZmxhcmUtZG5zLmNvbQovZG5zLXF1ZXJ5'

# Cloudflare DNS DoH
stamp = 'sdns://AgMAAAAAAAAABzEuMC4wLjEAEmNsb3VkZmxhcmUtZG5zLmNvbQovZG5zLXF1ZXJ5'

# Cloudflare DNS 2606:4700:4700::1111 DoH
stamp = 'sdns://AgMAAAAAAAAAFlsyNjA2OjQ3MDA6NDcwMDo6MTExMV0AEmNsb3VkZmxhcmUtZG5zLmNvbQovZG5zLXF1ZXJ5'

# Cloudflare DNS 2606:4700:4700::1001 DoH
stamp = 'sdns://AgMAAAAAAAAAFlsyNjA2OjQ3MDA6NDcwMDo6MTAwMV0AEmNsb3VkZmxhcmUtZG5zLmNvbQovZG5zLXF1ZXJ5'

Google DNS


Properties: DNSSEC, No Filter, Logging (generally full logs are only temporary per the Privacy Statement):

# Google DNS DoH
stamp = 'sdns://AgMAAAAAAAAABzguOC44LjgACmRucy5nb29nbGUKL2Rucy1xdWVyeQ'

# Google DNS DoH
stamp = 'sdns://AgMAAAAAAAAABzguOC40LjQACmRucy5nb29nbGUKL2Rucy1xdWVyeQ'

# Google DNS 2001:4860:4860::8888 DoH
stamp = 'sdns://AgMAAAAAAAAAFlsyMDAxOjQ4NjA6NDg2MDo6ODg4OF0ACmRucy5nb29nbGUKL2Rucy1xdWVyeQ'

# Google DNS 2001:4860:4860::8844 DoH
stamp = 'sdns://AgMAAAAAAAAAFlsyMDAxOjQ4NjA6NDg2MDo6ODg0NF0ACmRucy5nb29nbGUKL2Rucy1xdWVyeQ'

Adding OIDs to XCA

Adding OIDs to XCA is a straightforward process. I was able to follow the official guide at with minimal issues.

First, ensure you download XCA v2.x from the official download page The instructions didn’t make sense at first since I was running xca v1.4.1.

Create a file named “oids.txt” in the user’s XCA directory:

  • Windows: C:\Users\<username>\AppData\Roaming\xca
  • macOS: ~/Library/Application Support/data/xca
  • Linux: ~/.xca
oids.txt on Windows

Add the OID(s) to oids.txt using the format “<oid> : <short_name> : <long_name>”. In the example below, I added a (Microsoft) Remote Desktop Authentication OID ( rdpAuth: Remote Desktop Authentication
oids.txt content

Copy the eku.txt file from the XCA installation location to the user’s XCA directory:

  • Windows: C:\Program Files\xca
  • macOS: /Applications/
    This can be accessed through the command line or right clicking on the xca application and selecting “Show Package Contents”
  • Linux: /usr/share/xca or /usr/local/share/xca

Note: The whole file eku.txt file must be copied, because xca only parses the first eku.txt it encounters.

Add a line to the user’s eku.txt referencing your new EKU:

Add the new EKU to the list of pre-defined EKUs

Close and re-open XCA and your new EKU will be available:

xca: Remote Desktop Authentication EKU
XCA Key Usage Tab

After adding the Remote Desktop Authentication EKU, I found out it is no longer supported/recognized. The Microsoft Remote Desktop 10 app on macOS and Windows 10 both report the EKU as invalid/unknown.

Unknown Key Usage
Unknown Key Usage

OpenVPN Authentication Script

Edit May 3, 2018: Updated to use a GitHub gist to enable syntax highlighting and added a link to GitHub.

My work related to OpenVPN can be found at

I’ve been working on updating my OpenVPN installation and decided I wanted to switch to username/password authentication, so I don’t have to deal with managing client certificates. Personally, I use head -c 32 /dev/urandom | base64 to generate my client passwords, so they are as strong as any certificate authentication. I wrote the following script to perform username/password authentication for OpenVPN using the auth-user-pass-verify option and allow easy management of accounts.

This script uses /etc/openvpn/shadow as its username/password repository. The shadow file must be readable by the OpenVPN process; however, I suggest it is not writable by the OpenVPN process. I have the owner = root and group = openvpn, and permissions 640.

The script takes at least 1 second to verify a password. Passwords are salted with a unique 16 byte value and hashed 100,000 times.

The script works to verify that only one password verification is performed at any time.

Avoid misuse from special characters by Base64 encoding all values in the shadow file.


  • ./ <credential file> – how the script is invoked by OpenVPN to verify a username and password.
  • ./ -a <username> [<password>] – add or update <username>. You will be prompted for a password if you do not provide one on the command line.
  • ./ -g <username> [<password>] – generate a string that contians the encoded username, salt, and hashed password. This can be useful if you want to generate strings and add them to the script (list of strings in the shadow_contents variable).
  • ./ -d <username> – delete the credentials for <username>.
  • ./ -l – list the configured usernames.


# Username/Password Authentication Script for use with OpenVPN
# Copyright (c) 2018 Kenji Yoshino
# This script is released under the Version 3 of the GNU General Public
# License

import sys
import os
from hashlib import pbkdf2_hmac
from time import time, sleep
from binascii import b2a_base64, a2b_base64
from getpass import getpass

BASE_TIME=1.0 # set a minimum time in seconds for check function
# If SHADOW_FILE is None, shadow_contents can be configured as a list of strings
# using the format :: for each line. Each value is base64
# encoded. Strings can be generated using the -g option

def usage():
   print "./ "
   print "./ -[g|a|d]  [password]"
   print "./ -l"

def getHash(salt, password):
   return b2a_base64(pbkdf2_hmac(HASH, password, salt, ITTERATIONS)).strip()

def check(pw_file):
   while os.path.isfile(LOCK_FILE):
   with open(LOCK_FILE, 'a'):

      with open(pw_file, 'r') as f:
         username=b2a_base64(f.readline(MAX_UN_PW_LEN).rstrip("\r\n")).strip() + ":"
         if len(f.readline(MAX_UN_PW_LEN)) > 0:
            return INVALID
   except Exception as e:
      print e
      return INVALID

      if SHADOW_FILE is not None:
         with open(SHADOW_FILE, 'r') as f:
      for line in shadow_contents:
         if line.startswith(username):
            if len(parts) != 3:
            if password == parts[2].strip():
   except Exception as e:
      print e

   # make this function run in constant time
   if t > 0.0:
   for x in range(3): #try to remove the lock file 3 times
      except Exception:
   return rtn

def delete(username):
   if not os.path.isfile(SHADOW_FILE):
   username=b2a_base64(username).strip() + ":"
   with open(SHADOW_FILE, 'r') as f:
   with open(SHADOW_FILE, 'w') as f:
      for line in shadow_contents:
         if not line.startswith(username):

def generate(username, password, add):
   while password is None:
      password=getpass("Enter a password for %s: " % username)
      verifypass=getpass("Verify password: ")
      if password != verifypass:
         print("Passwords do not match. Try again.\n")
   #TODO: warn the user if SHADOW_FILE is larger than max shawow length
   if add:
      with open(SHADOW_FILE, 'a') as f:
         f.write("%s:%s:%s\n" % (encusername, salt, password))
      print("%f seconds to compute hash" % (time()-start))
      print("%s:%s:%s" % (encusername, salt, password))

def list():
      if SHADOW_FILE is not None:
         with open(SHADOW_FILE, 'r') as f:
      for line in shadow_contents:
         if len(parts) != 3:
         print(a2b_base64(parts[0]) + "\n")
   except Exception as e:
      print e

if args == 2:
   if sys.argv[1] == "-l":
elif args == 3 or args == 4:
   if sys.argv[1] == "-g" or sys.argv[1] == "-a":
      if sys.argv[1] == "-a" and SHADOW_FILE is None:
         print("Error: You must configure a SHADOW_FILE to use -a.\n")
         if args == 4:
         generate(sys.argv[2], password, sys.argv[1] == "-a")
   elif sys.argv[1] == "-d":