Is mandatory to use dnsmasq?

[btxmvh]

Hi, I was following the guide KVM and it said to install dnsmasq on the host with all the other packages. Do I need to only have dnsmasq installed or also running?

I am already using sytemd-resolved for the DNSOverTLS and it will conflict if I do have dnsmasq running too.

Any input would be appreciated.

Thanks in advance

Edit: I also noted that I already dnsmasq-base package, not sure if this would be enough.

[extraextra]

https://forums.whonix.org/search?context=topic&context_id=17129&q=dnsmasq&skip_context=true

[Patrick]

Whonix KVM dnsmasq - listen port on host operating system - attack surface reduction

dnsmasq on the host operating system is increasing the attack surface. How did I find that out? Install Debian. Check open ports and write them to a file. sudo netstat -tulpen > old Install packages required for Whonix KVM according to Whonix KVM documentation. Check open ports again and write them to a different file. sudo netstat -tulpen > new Use any (graphical) diff viewer of your choice. meld old new Result: dnsmasq opens a listen port on the host operating sy…

[btxmvh]

For what I understand is not needed then? Is just because I was following the guide and it was saying it was needed for every distro.

About the surface attack, maybe a firewall on the host? Or simply not putting the service listening externally?

[Patrick]

It’s an open unresolved development ticket, which has apparently stalled. I don’t expect further progress, unless contributed.

Meanwhile documentation is up-to-date according to the latest development status.

Note: I am not a maintainer of Whonix KVM.

@btxmvh

About the surface attack, maybe a firewall on the host?

Host Firewall

[HulaHoop]

According got another user, yes it is mandatory with the way NAT networking is implemented by libvirt to have this package installed and running. He was going to create a dummy stub and change the Whonix networking files to attempt to trick it into running with dnsmasq not being active , but never reported back. Either way it’s too much hassle and not a big deal see why below:

Whonix KVM dnsmasq - listen port on host operating system - attack surface reduction

I tested setting up a brand new KVM host without dnsmasq installed and with the default KVM network deleted. I was able to import the Whonix-External network but could not start it due to an error about dnsmasq command being missing. So it appears this is required for NAT networks in particular and not purely the default network. I will test two things: Creating a stub dnsmasq executable that will simply exit 0 or halts execution so that it appears to be running in the background; and Modif…

There’s no risk of dnsmasq as installed by libvirt in being exploited because it doesn’t listen on any external interfaces and only responds to guest requests using a limited subset of its functionality. If you are running an untrusted guest, you probably don’t want it on the virbr0 interface that interacts with the clearnet anyway.