From 9ed1abcc73157de17a6dc1ed79009141246f2673 Mon Sep 17 00:00:00 2001 From: Paul Maconi Date: Wed, 12 Nov 2025 19:23:48 -0600 Subject: [PATCH] Add systemd-resolved LLMNR and mDNS configuration in response to #114 --- .../installation/postinstallation-tasks.adoc | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/modules/ROOT/pages/installation/postinstallation-tasks.adoc b/modules/ROOT/pages/installation/postinstallation-tasks.adoc index cad336f..0a154e4 100644 --- a/modules/ROOT/pages/installation/postinstallation-tasks.adoc +++ b/modules/ROOT/pages/installation/postinstallation-tasks.adoc @@ -365,7 +365,25 @@ root: real@address.for.root […]# newaliases ---- +== Disable systemd-resolved LLMNR and/or mDNS +You may want to disable LLMNR and/or mDNS depending on your environment. Both protocols are subject to trivial DNS poisoning attacks by a rogue responder. + +[source,] +----- +sudo mkdir -p /etc/systemd/resolved.conf.d +sudo touch /etc/systemd/resolved.conf.d/20-disable-llmnr-mdns.conf +sudo tee -a /etc/systemd/resolved.conf.d/20-disable-llmnr-mdns.conf > /dev/null << EOF +# see man resolved.conf for details +[Resolve] +# false = disable, true = resolve AND respond, resolve = resolve only +LLMNR=false +MulticastDNS=false +EOF +sudo systemctl restart systemd-resolved +----- + +You can view the status of LLMNR and mDNS with the following command: `sudo systemd-resolve --status` == Manage system updates