Agenda: dns-unbound-config.txt

File dns-unbound-config.txt, 2.8 KB (added by regnauld, 8 years ago)

dns-unbound-config.txt

Line 
1Configuring Unbound
2
31. Log in using SSH/Putty/... to your CACHE machine:
4
5    $ ssh -l adm cache.grpXX.ws.nsrc.org
6
72. On CACHE:
8
9    # cd /usr/local/etc/unbound/
10    # cp unbound.conf.sample unbound.conf
11
12    Now edit the file unbound.conf, and make the following changes:
13
14    a) enable listening - find the lines with:
15
16        # interface: ...
17        # interface: ...
18
19    and just under, add this line:
20
21        interface: 0.0.0.0
22
23    b) access control - find the lines with:
24
25        # access-control: ...
26        # access-control: ...
27
28    and just under, add this line:
29
30        access-control: 10.10.0.0/16 allow
31
32    c) chroot security - find the line
33   
34        # chroot: "/usr/local/etc/unbound"
35
36    and just under, add this line:
37
38        chroot: ""
39
40    d) set the root-hints file - find the line with:
41
42        # root-hints: ""
43
44    and just under, add this line:
45
46        root-hints: "/usr/local/etc/unbound/named.root"
47
48    e) re-enable the 10.in-addr.arpa zone - find the line with:
49
50        # local-data-ptr: "192.0.2.3 www.example.com"
51
52    and just under, add this line:
53
54        local-zone: "10.in-addr.arpa." nodefault
55
56    f) enable remote control - find the line with:
57
58        # control-enable: no
59
60    and CHANGE it (by removing # in front) to:
61
62        control-enable: yes
63
64    - find the line with:
65
66        # control-interface: 127.0.0.1
67
68    and CHANGE it to:
69
70        control-interface: 0.0.0.0
71
72    - find the line with:
73
74        # control-port: 953
75
76    and CHANGE it to:
77
78        control-port: 953
79       
80    - finally, uncomment the following lines:
81
82        # server-key-file: "/usr/local/etc/unbound/unbound_server.key"
83    becomes
84        server-key-file: "/usr/local/etc/unbound/unbound_server.key"
85 
86        # server-cert-file: "/usr/local/etc/unbound/unbound_server.pem"
87    becomes
88        server-cert-file: "/usr/local/etc/unbound/unbound_server.pem"
89 
90        # control-key-file: "/usr/local/etc/unbound/unbound_control.key"
91    becomes
92        control-key-file: "/usr/local/etc/unbound/unbound_control.key"
93 
94        # control-cert-file: "/usr/local/etc/unbound/unbound_control.pem"
95    becomes
96        control-cert-file: "/usr/local/etc/unbound/unbound_control.pem"
97
98
99    Save the file, exit.
100
1013. Create the control keys:
102
103    # unbound-control-setup
104
1054.  Test the configuration:
106
107    # unbound-checkconf
108
1095. edit /etc/rc.conf and add:
110
111    unbound_enable="YES"
112
1136. start unbound!
114
115    # /usr/local/etc/rc.d/unbound start
116
1177. Change your /etc/resolv.conf to use your newly configured Unbound,
118   on this machine (CACHE), but on MASTER as well:
119
120    # vi /etc/resolv.conf
121
122    Change the nameserver line to:
123
124        nameserver 10.10.XX.2
125
126    ... where XX is the number of your group
127
1288. Test
129
130        # dig
131    # dig noc.ws.nsrc.org
132        # dig MYTLD. NS
133
134        Make sure you see SERVER: ...(10.10.XX.2) at the bottom of
135        dig's output.
136