Résolveur DNS par défaut.
-
Liste des paquets à modifier : ajouter dans le fichier config/package-lists/handylinux.list.chroot : unbound unbound-anchor
-
Création du fichier de configuration pour unbound : fichier /etc/unbound/unbound.conf.d/unbound.conf :
## Authoritative, validating, recursive caching DNS ## unbound.conf -- https://calomel.org # See /usr/share/doc/unbound/examples/unbound.conf for a commented # reference config file. # server: access-control: 127.0.0.1 allow verbosity: 1 do-ip4: yes do-ip6: yes do-udp: yes do-tcp: yes interface: 127.0.0.1 hide-identity: yes hide-version: yes logfile: /var/log/unbound.log # Will trust glue only if it is within the servers authority. # Harden against out of zone rrsets, to avoid spoofing attempts. # Hardening queries multiple name servers for the same data to make # spoofing significantly harder and does not mandate dnssec. harden-glue: yes # Require DNSSEC data for trust-anchored zones, if such data is absent, the # zone becomes bogus. Harden against receiving dnssec-stripped data. If you # turn it off, failing to validate dnskey data for a trustanchor will trigger # insecure mode for that zone (like without a trustanchor). Default on, # which insists on dnssec data for trust-anchored zones. harden-dnssec-stripped: yes # Use 0x20-encoded random bits in the query to foil spoof attempts. # http://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00 # While upper and lower case letters are allowed in domain names, no significance # is attached to the case. That is, two names with the same spelling but # different case are to be treated as if identical. This means calomel.org is the # same as CaLoMeL.Org which is the same as CALOMEL.ORG. use-caps-for-id: yes # the time to live (TTL) value lower bound, in seconds. Default 0. # If more than an hour could easily give trouble due to stale data. cache-min-ttl: 3600 # the time to live (TTL) value cap for RRsets and messages in the # cache. Items are not cached for longer. In seconds. cache-max-ttl: 86400 # perform prefetching of close to expired message cache entries. If a client # requests the dns lookup and the TTL of the cached hostname is going to # expire in less than 10% of its TTL, unbound will (1st) return the ip of the # host to the client and (2nd) pre-fetch the dns request from the remote dns # server. This method has been shown to increase the amount of cached hits by # local clients by 10% on average. prefetch: yes # number of threads to create. 1 disables threading. This should equal the number # of CPU cores in the machine. Our example machine has 4 CPU cores. # num-threads: 4 # If nonzero, unwanted replies are not only reported in statistics, but also # a running total is kept per thread. If it reaches the threshold, a warning # is printed and a defensive action is taken, the cache is cleared to flush # potential poison out of it. A suggested value is 10000000, the default is # 0 (turned off). We think 10K is a good value. unwanted-reply-threshold: 10000 # Should additional section of secure message also be kept clean of unsecure # data. Useful to shield the users of this validator from potential bogus # data in the additional section. All unsigned data in the additional section # is removed from secure messages. val-clean-additional: yes
-
Facultatif : filtrage des serveurs de publicité afin d'accélérer le chargement des pages :
wget -q -O- --header\="Accept-Encoding: gzip" 'http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&mimetype=plaintext' | \ gunzip | \ awk '/^127\./{ print "local-zone: \"" $2 "\" redirect" print "local-data: \"" $2 " A 127.0.0.1\"" }' > /etc/unbound/unbound.conf.d/ad_servers.conf
À mettre dans un hook par exemple
- Lancer cette commande : unbound-anchor -a "/var/lib/unbound/root.key"
- Faire en sorte que network-manager utilise le résolveur DNS local par défaut. Ça, il faudra vérifier comme je n'ai pas network-manager installé sur ma machine. Moi je fais ainsi :
Dans le fichier etc/dhcp/dhclient.conf, je rajoute la ligne prepend domain-name-servers 127.0.0.1;
echo "prepend domain-name-servers 127.0.0.1;" >> /etc/dhcp/dhclient.conf
À mettre aussi dans le hook handylinux.chroot si on veut. Cette méthode permet d'utiliser en priorité unbound, et en cas d'échec, de se rabattre sur les DNS du fournisseur d'accès.
Sources : https://calomel.org/unbound_dns.html http://www.bortzmeyer.org/son-propre-resolveur-dns.html http://lehollandaisvolant.net/?d=2015/07/07/23/58/05-installer-son-propre-serveur-dns-sous-ubuntu