Is djbdns from the samboy github project supported on Ubuntu 22.04?

[mdlueck]

Greetings,

I stumbled upon samboy having kindly taken up packaging djbdns for Ubuntu 20.04 a while ago. The repo pointed to this forum area to seek support. Actually, it directly linked to an area that is now locked, so inquiring here.

I seek continuing to use djbdns on Ubuntu 22.04 LTS. Will the files here https://github.com/samboy/ndjbdns work with Ubuntu 22.04 LTS, or only with Ubuntu 20.04 LTS?

I am thankful,
Michael

[samboy]

I’ve only tried out the code in Ubuntu 20.04; apt-get dist-upgrade isn’t updating my systems to 22.04 yet, so I’m still on 20.04.

That said, N-DJBDNS doesn’t have a maze of dependencies (I went to some effort to remove the autoconf dependency which depended on an old version of autoconf) [1] Go ahead, try to compile it yourself and let us know if it works.

[1] For years, people tried to get me to make MaraDNS dependent on autoconf. I refused to do so, which was the right decision. Considering the headaches I had compiling N-DJBDNS in Ubuntu which has a newer autoconf than the one N-DJBDNS uses, autoconf would had been a moving target and a maintenance nightmare. I do not depend on moving targets for this very reason.

[mdlueck]

I assumed the following:

1. Install a clean VM of Xubuntu 22.04 LTS, apply updated, etc...
2. Add package build-essential (If correct, you might add this to the notes)
3. Download the zip file of ndjbdns-master
4. Run the ./configure and make as my normal user
5. Run sudo make install (If correct that this is the only step that needs sudo, you might add this to the notes)

Seems successful. I now need to dig into configuring djb-dns, per my old old notes here...
http://www.lueckdatasystems.com/HOW-TO_Basic_installation_of_Daniel_J_Bernstein_djbdns_TinyDNS_on_Ubuntu_Linux

Have you worked out the .deb packaging of the djb-dns files that result from your much appreciated work to get djb-dns to compile on latest Ubuntu Linux? I have several servers I run it on... would rather not have the build tools on each of them.... rather keep build tools in a build VM, package, propagate around .deb packages.

I am thankful,
Michael

[samboy]

I haven’t had a chance to build .deb packages. Not for MaraDNS; not for N-DJBDNS. I’ll gladly accept a pull request for scripts that make a .deb package, though.

— Sam

[samboy]

Since it does successfully build in Ubuntu 22.04, I will mark this as answered. Making .deb packages can be resolved by giving me a pull request. Thank you again for your interest.

— Sam

[mdlueck]

I am fine with that for now.... like I said next I will be working through my steps listed to configure djb-dns.... see if it actually works.

..... and Sam.... I assume you incorporated into your build starting from where Debian / Ubuntu packagers had left off with the source code? Or did you start from official djb source code for your version?

.... oh, were the steps to build n-djbdns I listed actually what you intended / used yourself?

[samboy]

In terms of using MaraDNS or DjbDNS here in 2022, I personally would only use either as a non-recursive caching server. Like with SMTP servers, fully recursive DNS has become something which can only be handled by well financed organizations. Sites like amazon.com are really hostile for home recursive DNS servers, and with a combination of DNSSEC and EDNS out there which is needed to resolve more and more sites on the internet, I think the only options for recursive DNS here in the 2020s are BIND, Unbound, and Knot-DNS.

I have updated MaraDNS in the 2020s to be a better caching only server which uses another recursive DNS server (e.g. 1.1.1.1, 8.8.8.8, or 9.9.9.9) to do the heavy lifting of recursion: It now has the ability to give a given name a custom IP, and to block problematic domains. The documentation has been updated to note that using MaraDNS (actually, Deadwood) as a fully recursive DNS server is deprecated, since it’s no longer feasible for a hobbyist project to run on the treadmill updating the recursor to handle all of the corner cases out there on the internet. I have no plans to remove the recursor from Deadwood, but I’m not actively maintaining that part of the code either (with the exception of security issues like CVE-2022-30256).

In terms of N-DJBDNS, it’s in maintenance only mode, and anything beyond “it won’t compile in the latest LTS of Ubuntu” or “there’s an unpatched high impact security hole with a CVE number” won’t be fixed. For example, I’m sure N-DJBDNS has the CVE-2022-30256 issue, but even that isn’t serious enough to patch N-DJBDNS (the impact is that, via some clever tricks, one can keep a name in the cache longer than desired. That’s not a “all hands on deck and patch it now” security hole).

[samboy]

I started from N-DJBDNS, since N-DJBDNS has a number of security fixes djddns-1.05 from 2001 doesn’t have. The code is GPL, not public domain.

[samboy]

I should probably blog this, but: One of the things I find incredibly ironic is that, here, over 20 years after DJB’s final update to djbdns, I’m the only one who is updating its code. And, I am no djbdns advocate: I started MaraDNS simply because, until 2007, djbdns didn’t have an open source license, BIND had a lot of security issues, and there plain simply wasn’t any other DNS server out there. The djbdns crowd was not happy; one of my first emails I got after starting MaraDNS was a flame from a djbdns user criticizing me for making MaraDNS because djbdns was good enough, in his point of view.

And, indeed, there was a lot of noise 10-20 years ago about how djbdns was the one true DNS server, better than all others because it had no security holes. They made a lot of noise online, flooding online discussion boards whenever the subject of a DNS server came up. A few of them are still on ycombinator, still criticizing anything that’s not djbdns—the excellent KnotDNS got a cold reception from them there.

Despite all of the noise these loudmouths made about djbdns, very few stepped up to plate to actually maintain djbdns’s code. You would think, with the number of poster loudly proclaiming the virtues of djbdns, the number of people who made entire websites shrines to djbdns (not to mention qmail), and so on, at least one of them would still be up to plate, maintaining djbdns.

No. That didn’t happen. The only one still here, still maintaining djbdns is me, and I made a competitor to djbdns (which has been flamed by multiple djbdns “advocates”). Not one person who went to so much effort to troll and flame other DNS servers had the basic competence and persistence to actually make and maintain code.

Years after the BIND-and-djbdns flame wars have died out everywhere except with the aging crowd of Ycombinator desperately trying to recreate a rose-tinted vision of the past (and even here the djbdns advocates are slowly conceding djbdns isn’t really usable here in the 2020s), MaraDNS is still being maintained. I have given up on making her a general purpose recursive DNS server (use BIND, Unbound, or Knot Resolver for that), although it will still work as a recursor with over 99% of sites, as long as min_ttl is used so amazon.com is usable. However, MaraDNS is still a general-purpose authoritative nameserver, and it is (via Deadwood) a usable caching resolver (useful for pi-hole type stuff).

Point being, people who make a lot of noise and spread a lot of negative energy online seem to not be very good at actually creating and maintaining something tangible like a software project.

[mdlueck]

Greetings samboy,

Probably one reason for the decline of interest in djbdns is SAMBA chose a different dns to integrate with. To enable AD in SAMBA, SAMBA expects to take control of DNS, integrating with its choice of DNS.

I have not AD activated our SAMBA domains. That causes other challenges. However fortunately we have solid DNS reliability that is NOT tied to Windows-centric administrative tools.

I am thankful,
Michael

[samboy]

djbdns users included a lot of old *NIX greybeards who didn’t care less about Windows integration. I think djbdns’s decline is:

• Security bugs were eventually found in djbdns. Arguing that djbdns is better because it has never had a security bug was no longer feasible.
• djbdns stopped being updated and maintained in 2001.
• djbdns didn’t become open source until 2007. By then, it was too late to build a community of maintainers.
• djbdns never got EDNS0, DNSSEC, etc.

[samboy]

As an aside: I have updated all my Linux instances from Ubuntu 20.04 to 22.04

[samboy]

Locking discussion to stop spam bots.