Difference between revisions of "Setting up unbound DNS server"

From Alpine Linux
Jump to: navigation, search
m (Configure)
(root-hints: https and Last-Modified support)
 
(32 intermediate revisions by one other user not shown)
Line 3: Line 3:
 
= Install =
 
= Install =
  
Install the package:
+
Install the {{Pkg|unbound}} package:
 
{{Cmd|apk add unbound}}
 
{{Cmd|apk add unbound}}
  
 
= Configure =
 
= Configure =
  
The following configuration is an example of a caching name server (in a production server, it's recommended to adjust the access-control parameter to limit access to your network and perhaps change the interface directive to listen on a particular local interface address).  The forward-zone section will forward all DNS queries to the specified servers.
+
The following configuration is an example of a caching name server (in a production server, it's recommended to adjust the access-control parameter to limit access to your network).  The forward-zone(s) section will forward all DNS queries to the specified servers. Don't forget to change the 'interface' parameter to one of your local interface IP (or 0.0.0.0 to listen on all local IPv4 interfaces).  The following is a minimal example with many options commented out.
* /etc/unbound/unbound.conf
+
 
 +
{{Path|/etc/unbound/unbound.conf}}
 
<pre>
 
<pre>
 
server:
 
server:
 
         verbosity: 1
 
         verbosity: 1
         interface: 0.0.0.0
+
## Specify the interface address to listen on:
 +
         interface: 10.0.0.1
 +
## To listen on all interfaces use:
 +
#      interface: 0.0.0.0
 
         do-ip4: yes
 
         do-ip4: yes
         do-ip6: no
+
         do-ip6: yes
 
         do-udp: yes
 
         do-udp: yes
 
         do-tcp: yes
 
         do-tcp: yes
 
         do-daemonize: yes
 
         do-daemonize: yes
 
         access-control: 0.0.0.0/0 allow
 
         access-control: 0.0.0.0/0 allow
 +
## Other access control examples
 +
#access-control: 192.168.1.0/24 action
 +
## 'action' should be replaced by any one of:
 +
#deny (drop message)
 +
#refuse (sends  a  DNS  rcode REFUSED error message back)
 +
#allow (recursive ok)
 +
#allow_snoop (recursive and nonrecursive ok).
 +
## Minimum lifetime of cache entries in seconds.  Default is 0.
 +
#cache-min-ttl: 60
 +
## Maximum lifetime of cached entries. Default is 86400 seconds (1  day).
 +
#cache-max-ttl: 172800
 +
## enable to not answer id.server and hostname.bind queries.
 +
        hide-identity: yes
 +
## enable to not answer version.server and version.bind queries.
 +
        hide-version: yes
 +
## default is to use syslog, which will log to /var/log/messages.
 +
use-syslog: yes
 +
## to log elsewhere, set 'use-syslog' to 'no' and set the log file location below:
 +
#logfile: /var/log/unbound
 
python:
 
python:
 
remote-control:
 
remote-control:
 
         control-enable: no
 
         control-enable: no
#enable to not answer id.server and hostname.bind queries.  
+
## Stub zones are like forward zones (see below) but must only contain authority server (no recursive servers)
        hide-identity: yes
+
#stub-zone:
#enable to not answer version.server and version.bind queries.  
+
#        name: "my.test.com"
        hide-version: yes
+
# stub-addr: 172.16.1.1
forward-zone:      name: "."
+
# stub-addr: 172.16.1.2
#Level3 Verizon
+
## Note for forward zones, the destination servers must be able to handle recursion to other DNS server
 +
## Forward all *.example.com queries to the server at 192.168.1.1
 +
#forward-zone:
 +
#        name: "example.com"
 +
#        forward-addr: 192.168.1.1
 +
## Forward all other queries to the Verizon DNS servers
 +
forward-zone:       
 +
        name: "."
 +
## Level3 Verizon
 
         forward-addr: 4.2.2.1
 
         forward-addr: 4.2.2.1
         forward-addr: 4.2.2.4</pre>
+
         forward-addr: 4.2.2.4
 +
</pre>
 +
 
 +
== root-hints ==
 +
Instead of forwarding queries to a public DNS server, you may prefer to query the root DNS servers.  To do this, comment out the forwarding entries ("forward-zone" sections) in the config.  Then, grab the latest root hints file using wget:
 +
{{Cmd|wget -S -N https://www.internic.net/domain/named.cache -O /etc/unbound/root.hints}}
 +
And finally point unbound to the root hints file by adding the following line to the server section of the unbound config file:
 +
<pre>
 +
root-hints: "/etc/unbound/root.hints"
 +
</pre>
 +
Restart unbound to ensure the changes take effect.  You may wish to setup a [[FAQ#My cron jobs don.27t run.3F|cron job]] to update the root hints file occasionally.
 +
 
 +
== 0x20 bit ==
 +
Use of the [https://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00.html 0x20 bit] is considered experimental.  It makes use of an otherwise unused bit in a DNS packet to ask an authoritative server to respond with an answer mimicking the case used in the query.
 +
 
 +
For example, when using this feature a query for www.google.com could appear in the request as www.google.com or Www.GoogLe.coM or WWW.GoOGlE.cOm or any other conbination of upper and lower case.  The authoritative server should respond with the same case.  This helps prevent DNS spoofing attacks. 
 +
 
 +
In some cases a very small number of old or misconfigured servers may return an error (less than 1% of servers will respond incorrectly). To turn on this feature, simply add the following line to the 'server' section of {{Path|/etc/unbound/unbound.conf}} and restart the server:
 +
<pre>
 +
use-caps-for-id: yes
 +
</pre>
  
 
= Set auto-start, start and test the daemon =
 
= Set auto-start, start and test the daemon =
  
Set to auto-start then start unbound:
+
Check the configuration for errors:
 +
{{Cmd|unbound-checkconf}}
 +
and if no errors are reported, set to auto-start then start unbound:
 
{{Cmd|rc-update add unbound
 
{{Cmd|rc-update add unbound
 
rc-service unbound start}}
 
rc-service unbound start}}
Test:
+
Test, for example:
 
{{Cmd|dig nl.alpinelinux.org @10.0.0.1}}
 
{{Cmd|dig nl.alpinelinux.org @10.0.0.1}}
 +
or:
 +
{{Cmd|nslookup www.google.cz 10.0.0.1}}
 +
or use {{Pkg|drill}}:
 +
{{Cmd|drill www.bbc.co.uk @10.0.0.1}}
 +
 +
= Further information =
 +
unbound.conf man page [http://linux.die.net/man/5/unbound.conf here] or [http://unbound.net/documentation/unbound.conf.html here]
 +
 +
[http://unbound.net/documentation/howto_optimise.html unbound optimization guide]
 +
 +
[https://calomel.org/unbound_dns.html excellent unbound tutorial at calomel.org]
  
 +
General information via the Wikipedia pages on [https://en.wikipedia.org/wiki/Domain_Name_System DNS], [https://en.wikipedia.org/wiki/List_of_DNS_record_types record types], [https://en.wikipedia.org/wiki/Dns_zone zones], [https://en.wikipedia.org/wiki/Name_server name servers] and [https://en.wikipedia.org/wiki/Dnssec DNSsec]
  
 
[[Category:Networking]]
 
[[Category:Networking]]

Latest revision as of 08:45, 7 November 2015

Unbound is a validating, recursive, and caching DNS resolver that supports DNSSEC.

Install

Install the unbound package:

apk add unbound

Configure

The following configuration is an example of a caching name server (in a production server, it's recommended to adjust the access-control parameter to limit access to your network). The forward-zone(s) section will forward all DNS queries to the specified servers. Don't forget to change the 'interface' parameter to one of your local interface IP (or 0.0.0.0 to listen on all local IPv4 interfaces). The following is a minimal example with many options commented out.

/etc/unbound/unbound.conf

server:
        verbosity: 1
## Specify the interface address to listen on:
        interface: 10.0.0.1
## To listen on all interfaces use:
#       interface: 0.0.0.0
        do-ip4: yes
        do-ip6: yes
        do-udp: yes
        do-tcp: yes
        do-daemonize: yes
        access-control: 0.0.0.0/0 allow
## Other access control examples
#access-control: 192.168.1.0/24 action
## 'action' should be replaced by any one of:
#deny (drop message)
#refuse (sends  a  DNS  rcode REFUSED error message back)
#allow (recursive ok)
#allow_snoop (recursive and nonrecursive ok).
## Minimum lifetime of cache entries in seconds.  Default is 0.
#cache-min-ttl: 60
## Maximum lifetime of cached entries. Default is 86400 seconds (1  day).
#cache-max-ttl: 172800
## enable to not answer id.server and hostname.bind queries. 
        hide-identity: yes
## enable to not answer version.server and version.bind queries. 
        hide-version: yes
## default is to use syslog, which will log to /var/log/messages.
use-syslog: yes
## to log elsewhere, set 'use-syslog' to 'no' and set the log file location below:
#logfile: /var/log/unbound
python:
remote-control:
        control-enable: no
## Stub zones are like forward zones (see below) but must only contain authority server (no recursive servers)
#stub-zone: 
#        name: "my.test.com"
#		 stub-addr: 172.16.1.1
#		 stub-addr: 172.16.1.2
## Note for forward zones, the destination servers must be able to handle recursion to other DNS server
## Forward all *.example.com queries to the server at 192.168.1.1
#forward-zone:
#        name: "example.com"
#        forward-addr: 192.168.1.1
## Forward all other queries to the Verizon DNS servers
forward-zone:      
        name: "."
## Level3 Verizon
        forward-addr: 4.2.2.1
        forward-addr: 4.2.2.4

root-hints

Instead of forwarding queries to a public DNS server, you may prefer to query the root DNS servers. To do this, comment out the forwarding entries ("forward-zone" sections) in the config. Then, grab the latest root hints file using wget:

wget -S -N https://www.internic.net/domain/named.cache -O /etc/unbound/root.hints

And finally point unbound to the root hints file by adding the following line to the server section of the unbound config file:

root-hints: "/etc/unbound/root.hints"

Restart unbound to ensure the changes take effect. You may wish to setup a cron job to update the root hints file occasionally.

0x20 bit

Use of the 0x20 bit is considered experimental. It makes use of an otherwise unused bit in a DNS packet to ask an authoritative server to respond with an answer mimicking the case used in the query.

For example, when using this feature a query for www.google.com could appear in the request as www.google.com or Www.GoogLe.coM or WWW.GoOGlE.cOm or any other conbination of upper and lower case. The authoritative server should respond with the same case. This helps prevent DNS spoofing attacks.

In some cases a very small number of old or misconfigured servers may return an error (less than 1% of servers will respond incorrectly). To turn on this feature, simply add the following line to the 'server' section of /etc/unbound/unbound.conf and restart the server:

use-caps-for-id: yes

Set auto-start, start and test the daemon

Check the configuration for errors:

unbound-checkconf

and if no errors are reported, set to auto-start then start unbound:

rc-update add unbound rc-service unbound start

Test, for example:

dig nl.alpinelinux.org @10.0.0.1

or:

nslookup www.google.cz 10.0.0.1

or use drill:

drill www.bbc.co.uk @10.0.0.1

Further information

unbound.conf man page here or here

unbound optimization guide

excellent unbound tutorial at calomel.org

General information via the Wikipedia pages on DNS, record types, zones, name servers and DNSsec