SecureDNS Agent User Guide (2.3.X)

1 Introduction

The SecureDNS Agent is a robust tool developed to enhance DNS security for devices outside the SecureDNS-protected network.

This manual provides a comprehensive guide for users, administrators, and IT professionals on installing, configuring, and using the client software.

1.1 Prerequisites

Once we have received the information on how many agents are needed, we will provide
you with a download and a license key.

• Make sure you are able to log in to https://portal.secutec.com to download the
  agent. The installation folder is located at Documents -> Configuration.

1.1.1 System requirements

2 Downloading the installer

To obtain the installer folder, please download it from the Secutec portal under Documents. Here You can Install the SecureDNS Agent by clicking on the eye icon on the right side

3 Installation

3.1 Microsoft Windows

3.1.1 Installation Parameters

3.1.2 Installation Wizzard

1. Log in with a user account that has administrative privileges.
2. Navigate to the folder where you downloaded the SecureDNS agent installer.
3. Double-click on the msi installer and follow the on-screen instructions. When prompted, copy and paste your company key into the Company ID field.
4. After completing the installation, a green or blue icon will appear in the system tray. This means that your device is protected. Refer to the SecureDNS Agent Status section for additional information.
   

3.1.3 Windows Command Line

1. Open the Windows Start menu and type cmd.exe.
2. Next, right-click on cmd.exe from the programs list, then click on run as administrator.
3. Go to the folder where you downloaded the installer, e.g. 'cd Downloads'.
4. Enter the following command, providing the correct COMPANYID value.

msiexec.exe /q /i dnsagent_win64_x.y.z.msi COMPANYID=xyz

After completing the installation, a green or blue icon will appear in the system tray. This means that your device is protected. Refer to the SecureDNS Agent Status section for additional information.

3.1.4 Other Installation Methods

The SecureDNS agent can be installed via a Group Policy Object or Microsoft Intune, using the following command line argument: COMPANYID=x-y-z. Substitute x-y-z with your company key.

For comprehensive guidance on these automated deployment options, please refer to the relevant Microsoft documentation.

3.2 Linux

1. Log in to your Linux machine.
    
2. Start a terminal and find the folder where you downloaded the SecureDNS agent installer.

   1. cd Downloads

3. Change the installer's default permissions.

   1. chmod +x dnsagent_lin64_x.y.z

4. Start the installation and follow the on-screen instructions.

   1. sudo ./dnsagent_lin64_x.y.z

5. When prompted, copy and paste your company key into the Company ID field.
6. After completing the installation, a green or blue icon will appear in the system tray. This means that your device is protected. Refer to the SecureDNS Agent Status section for additional information.
   

3.3 macOS

1. Double-click the DMG file to extract the installer.
2. Once the installer is extracted, click on it to start the installation. When prompted, copy and paste your company key into the Company ID field.
3. After completing the installation, a green or blue icon will appear in the system tray. This means that your device is protected. Refer to the SecureDNS Agent Status section for additional information.

3.1.1 Other Installation Method(s)

The SecureDNS agent can be installed via Microsoft Intune, using the following guide and script.

1. Log into the O365 - Intune Admin Centre

2. Open the Intune Admin "Apps" -> MacOS -> Click on "Create" to create a new application deployment/availability

   

3. You will receive a extended window to select the application type
   1. Choose the App type "macOS app (PKG)" 
   2. Click on "Select" at the bottom of the window

4. Please follow and fill in the 7 steps to complete the package configuration

   1. Click "Select app package file" -> Upload the provided "SecureDNS.pkg file -> click on OK

   2. Fill in the required "App Information"

      APPLICATION NAME	will be automatically filled by the .pkg
      DESCRIPTION	will be automatically filled by the .pkg
      PUBLISHER	Please fill in "Secutec BV"

      

   3. "Optional", fill in extra Notes if whished for your corporation

5. Next add the post installation script to the application package

   

6. Now click on "next" -> choose the "required minimum operating system" -> click on "next"

7. Under the detection rules everything should be automatically filled and "Ignore app version" should be enabled.

8. Choose the corresponding "Scope tags" relevant to your environment -> click on "next"
   = these tags are "administrative labels" used to control the viewing permissions for IT admins within the company, should be linked to the RBAC.

9. Under the Assignment tab you should add the groups, users or devices as needed for the application to be deployed OR viewable.
   We do advice to use the "required" section if automatic deployment is needed onto multiple devices

   Required:	Any user, device or group placed under this section will automatically receive the .pkg application onto their device (automatic push)
   Available for enrolled devices:	Any user, device or group placed under this section will NOT automatically receive the .pkg application onto their device. They will however see the application in the Company Portal Application view -> available for installation

10. Check if the necessary sections are enabled/filled in before creating the Intune package -> OK, click on "create"
    ! It could take up to 20 minutes for the application to be created + another 5-30 minutes to be available in the "Company Portal"

    

11. To monitor the installation progress go to the device "devices" -> macOS

12. Click on the corresponding device -> Applications Tab -> view the status (if the installation is successful, it should receive the status "Installed")

    

4 SecureDNS Agent Status

In this section, we explain the meaning of various icons that may appear in the system tray.

Icon	Description
	Home Agent is in bypass mode. The agent is not active because the network is already protected by SecureDNS.
	Running Agent is active. The agent established an active connection with our environment because the network was not protected by SecureDNS.
	Timeout The agent was disabled manually.
	Error Error with agent. Multiple possibilities, check status or logs for more details. Example: No network connectivity, Maximum of licenses reached, …

5 Testing the Agent 

You can test the agent by using the nslookup or the dig command. Use one of the following Fully Qualified Domain Names (FQDNs) to evaluate your configuration.

6 Uninstalling the Agent

To uninstall the SecureDNS agent, run the installer, select Uninstall DNS Agent and follow the on-screen instructions. This procedure is the same for all operating systems.

7 Changing your Company ID

If the Company ID needs updating, run the installer, select Change Company Key, and follow the on-screen instructions. This procedure is consistent across all operating systems.

8 SecureDNS Agent Logs

The SecureDNS client-side logs serve as a valuable resource, providing detailed insights into DNS activity on individual devices and the status of the DNS agent itself.

The logs capture information such as queried domains and API response codes, offering administrators a comprehensive view of the DNS transactions and a method for troubleshooting.

To view the logs, simply click on the tray icon and select Open logs.

9 Additional information

Executables

C:\Program Files\DNSAgent\DNSClient\dnsclient.exe
C:\Program Files\DNSAgent\DNSClient\dnsproxy.exe

Registry

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\SECUREDNS\DNSClient