<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">If your users has admins permissions you probably will not find any open source tool which support that. For restricted accounts on Win - create policies.</div><br class=""><div>BR,</div><div>Vadim<br class=""><blockquote type="cite" class=""><div class="">On May 10, 2020, at 23:52, Blason R <<a href="mailto:blason16@gmail.com" class="">blason16@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div class="">Thats a nice starting point -</div><div class=""><br class=""></div><div class="">
<a href="https://www.nginx.com/blog/using-nginx-as-dot-doh-gateway/" class="">https://www.nginx.com/blog/using-nginx-as-dot-doh-gateway/</a> <br class=""></div><div class=""><br class=""></div><div class="">But still looking for any client utility so that users can not shutdown or can not suspend the service<br class=""></div></div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, May 11, 2020 at 12:18 PM Blason R <<a href="mailto:blason16@gmail.com" class="">blason16@gmail.com</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr" class="">Hmm- Any docs on configuring DOH Proxy? <br class=""></div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, May 11, 2020 at 11:56 AM Daniel Stirnimann <<a href="mailto:daniel.stirnimann@switch.ch" target="_blank" class="">daniel.stirnimann@switch.ch</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br class="">
<br class="">
On 11.05.20 08:18, Vadim Pavlov via bind-users wrote:<br class="">
> The main issue that bind does’t provide an authentication method. So in<br class="">
> any case you somehow should manage the access to the DNS server vice<br class="">
> versa it will became open resolver and will be used for DDoS attacks.<br class="">
<br class="">
If you were to use DoH, you could use Basic Authentication. The DoH URL<br class="">
you could configure on your client systems could be something like this:<br class="">
<br class="">
<a href="https://username:password@doh.example.com/dns-query" rel="noreferrer" target="_blank" class="">https://username:password@doh.example.com/dns-query</a><br class="">
<br class="">
<br class="">
Daniel<br class="">
</blockquote></div>
</blockquote></div>
</div></blockquote></div><br class=""></body></html>