Différences

Ci-dessous, les différences entre deux révisions de la page.

--- tech:notes_serveur_dns_unbound [2025/03/24 15:06] – créée - modification externe 127.0.0.1
+++ tech:notes_serveur_dns_unbound [2026/06/07 19:12] (Version actuelle) – modification externe 127.0.0.1
@@ Ligne 1: / Ligne 1: @@
+<!DOCTYPE markdown>
+{{tag>Brouillon DNS Resolveur CA}}
+# Notes serveur DNS Unbound
+Voir :
+ * https://nlnetlabs.nl/documentation/unbound/unbound.conf/
+ * https://github.com/iusrepo/unbound1/blob/main/unbound.conf
+Voir aussi :
+* [CoreDNS](https://coredns.io/) (cncf.io)
+Exemple sur RedHat
+Fix Unbound is very slow to start
+`/etc/sysconfig/unbound`
+~~~bash
+DISABLE_UNBOUND_ANCHOR=yes
+~~~
+## Conf Unbound en resolveur avec Cache DNS
+`/etc/unbound/unbound.conf`
+~~~yaml
+server:
+        #verbosity: 1
+        #use-syslog: no
+        #module-config: "subnetcache validator iterator"
+        interface: 127.0.0.53
+        #interface: ::0
+        #prefer-ip4: yes
+        #prefer-ip6: no
+        do-ip4: yes
+        do-ip6: no
+        #do-tcp: yes
+        access-control: 127.0.0.0/8 allow
+        #cache-min-ttl: 3600
+        #cache-max-ttl: 86400
+        cache-max-negative-ttl: 1
+        #prefetch: yes
+        #serve-expired: yes
+        #serve-expired-ttl: 14400
+        #qname-minimisation: yes # Default yes
+        #minimal-responses: yes  # Default yes
+        #rrset-roundrobin: yes   # Default yes
+forward-zone:
+        name: "."
+        forward-addr: 8.8.8.8
+        forward-addr: 8.8.4.4
+~~~
+~~~bash
+unbound-checkconf
+systemctl enable --now unbound.service
+~~~
+## Conf autres
+no-aaaa
+Voir : https://github.com/berstend/unbound-no-aaaa/tree/master/etc/unbound
+## Administration
+Source : https://gist.github.com/f9n/3c4453489820f150c81bdf2f1ccd9516
+Verify configuration
+~~~bash
+unbound-checkconf
+~~~
+Unbound Status
+~~~bash
+unbound-control status
+~~~
+List Forwards
+~~~bash
+unbound-control list_forwards
+~~~
+Lookup on Cache
+~~~bash
+unbound-control lookup youtube.com
+~~~
+Dump Cache
+~~~bash
+unbound-control dump_cache > dns-cache.txt
+~~~
+Restore Cache
+~~~bash
+unbound-control load_cache < dns-cache.txt
+~~~
+Flush Cache
+~~~bash
+# Flush Specific Host
+unbound-control flush www.youtube.com
+# Flush everything
+unbound-control flush_zone .
+~~~
+### Diag
+Increase logged verbosity only runtime
+~~~bash
+unbound-control verbosity 3
+~~~
+Print operational statistics numbers.
+~~~bash
+unbound-control stats
+~~~
+Print used root server hints
+~~~bash
+unbound-control list_stubs
+~~~
+Print contacted servers details. Useful to read how fast they respond and what features they support.
+~~~bash
+unbound-control dump_infra
+~~~
+Test DNSSEC status of host
+~~~bash
+unbound-host -rv example.net -D
+~~~
+## Autres
+Essaie de surcharger la conf /etc/unbound/unbound.conf (RedHat)
+`/etc/unbound/cond.d/common.conf`
+~~~yaml
+server:
+        #trust-anchor-file: ""
+        #auto-trust-anchor-file: ""
+        #trust-anchor: ""
+        #trusted-keys-file: ""
+        #val-permissive-mode: yes
+        #prefetch: no
+        #disable-dnssec-lame-check: no
+        #harden-dnssec-stripped: no
+        #harden-glue: no
+        #harden-below-nxdomain: no
+        #harden-referral-path: no
+~~~