de:server:services:unbound [Your Digital Privacy DIY Solutions

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Unbound ======

[[https://nlnetlabs.nl/projects/unbound/about/|Unbound]] ist ein validierendes, rekursives und zwischenspeicherndes DNS-Resolver-Produkt von [[https://nlnetlabs.nl|NLnet Labs]]. Es wird kostenlos in Open-Source-Form unter der BSD-Lizenz vertrieben. 

===== Pakete =====

<code>
sudo pacman -S unbound expat
</code>

===== Konfiguration =====

<code>
sudo nano /etc/unbound/unbound.conf
</code>
<code>
server:
    # If no logfile is specified, syslog is used
    # logfile: "/var/log/unbound/unbound.log"
    verbosity: 0

# Enable port if you're going to use DNSCrypt/ADGuardhome.
#    port: 5353

    do-ip4: yes
    do-udp: yes
    do-tcp: yes
    do-daemonize: no
    trust-anchor-file: /etc/unbound/trusted-key.key

    # May be set to yes if you have IPv6 connectivity
    do-ip6: no

    # Use this only when you downloaded the list of primary root servers!
    root-hints: "/etc/unbound/root.hints"

    # Trust glue only if it is within the servers authority
    harden-glue: yes

    # Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS
    harden-dnssec-stripped: yes

    # Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes
    # see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details
    use-caps-for-id: no

    # Reduce EDNS reassembly buffer size.
    # Suggested by the unbound man page to reduce fragmentation reassembly problems
    edns-buffer-size: 1472

    # TTL bounds for cache
    cache-min-ttl: 3600
    cache-max-ttl: 86400

    # Perform prefetching of close to expired message cache entries
    # This only applies to domains that have been frequently queried
    prefetch: yes

    # One thread should be sufficient, can be increased on beefy machines
    num-threads: 1

    # Ensure kernel buffer is large enough to not loose messages in traffic spikes
    so-rcvbuf: 1m

    hide-identity: yes
    hide-version: yes
</code>

===== root.hints =====

Zur rekursiven Abfrage eines Hosts, der nicht als Adresse im Cache gespeichert ist, muss der Resolver an der Spitze des Serverbaums beginnen und die Root-Server abfragen, um zu erfahren, wo die Top-Level-Domain für die abgefragte Adresse zu finden ist. In Unbound sind standardmäßig Hinweise eingebaut. Wenn das Paket regelmäßig aktualisiert wird, ist daher kein manuelles Eingreifen erforderlich. Andernfalls ist es ratsam, eine Root-Hinweisdatei zu verwenden, da die eingebauten Hinweise veraltet sein können. 

<code>
curl --output /etc/unbound/root.hints https://www.internic.net/domain/named.cache
</code>

<code>
sudo nano /etc/systemd/system/roothints.service
</code>
<code>
[Unit]
Description=Update root hints for unbound
After=network.target

[Service]
ExecStart=/usr/bin/curl -o /etc/unbound/root.hints https://www.internic.net/domain/named.cache
</code>

<code>
sudo nano /etc/systemd/system/roothints.timer
</code>
<code>
[Unit]
Description=Run root.hints monthly

[Timer]
OnCalendar=monthly
Persistent=true
 
[Install]
WantedBy=timers.target
</code>

===== Start =====

<code>
sudo systemctl enable --now unbound.service roothints.timer
</code>

===== Lokales DNS über NetworkManager =====

<code>
sudo nano /etc/NetworkManager/conf.d/dns-servers.conf
</code>
<code>
[global-dns-domain-*]
servers=127.0.0.1
</code>
<code>
sudo systemctl restart NetworkManager.service
</code>

===== DNSCrypt proxy =====

Wenn du unser [[de/server/services/dnscrypt|DNSCrypt tutorial]] installieren willst, oder es bereits hast, musst Du noch den Port aktivieren 
># Enable port if you're going to use DNSCrypt/ADGuardhome.
>    port: 5353 

und füge unten den folgenden Eintrag hinzu:

<code>
# dnscrypt-proxy
  do-not-query-localhost: no
forward-zone:
  name: "."
  forward-addr: 127.0.0.1@5300
</code>