Martineau
Part of the Furniture
unbound is an Entware App, so follows the startup criteria for all Entware Apps
Code:
ls -lah /opt/etc/init.d/
Last edited:
Unbound unbound_manager (Manager/Installer utility for unbound - Recursive DNS Server)
- Thread starter Martineau
- Start date
Safemode
Regular Contributor
Code:
do-daemonize: <yes or no>
Enable or disable whether the unbound server forks into the
background as a daemon. Set the value to no when unbound runs
as systemd service. Default is yes.Do i need to correct this?So I rebooted, and decided to retest.
So I manually enforce logging by using 'vx' ; then I use 'rs' to restart unbound.
I leave everything for 10 mins, and all looks good, so I use 'l' to watch the log - again all looks good for 10 mins.
However, when I CTRL-C to terminate the log watch ...guess what... unbound suddenly goes AWOL.
Strange...until I notice you have included !!!!???
then it all clicked.Code:do-daemonize: no
PEBKAC
D
Deleted member 62525
Guest
Placebo effect?
tomsk
Very Senior Member
Yes unbound needs to run as daemon ...
Safemode
Regular Contributor
Thank you. Will do asap.
Edit: Thanks to Martineau and Tomsk for clearing up the setting to daemonize unbound. I removed it from the configuration file which will result at the default yes.
Code:
# no threads and no memory slabs for threads
num-threads: 1
msg-cache-slabs: 1
rrset-cache-slabs: 1
infra-cache-slabs: 1
key-cache-slabs: 1
# tiny memory cache / # prefetch / # gentle on recursion
extended-statistics: yes # v1.06 Martineau for @juched GUI TAB
key-cache-size: 50m
msg-cache-size: 50m
rrset-cache-size: 100m
outgoing-range: 950
num-queries-per-thread: 512
edns-buffer-size: 1232
max-udp-size: 1232
harden-algo-downgrade: yes
harden-referral-path: yes
harden-large-queries: yes
harden-short-bufsize: yes
identity: "DNS"
unwanted-reply-threshold: 10000
use-caps-for-id: yes
hide-identity: yes
hide-version: yes
do-not-query-localhost: no
aggressive-nsec: yes
ratelimit: 1000
prefetch: yes
prefetch-key: yes
serve-expired: yes
serve-expired-ttl: 3600
deny-any: yes
Last edited:
Martineau
Part of the Furniture
If you issue
Code:
e = Exit Script [?]
A:Option ==> lx
unbound logging DISABLEDSafemode
Regular Contributor
Yes it does.
Martineau
Part of the Furniture
Abject apologies for the inconvenience
I was genuinely trying to eliminate the unnecessary manual intervention/disruption caused by the 'i config' command which, if users have used 'vx' 'unbound.conf' rather than add their config overrides to '/opt/share/unbound/configs/unbound.conf.add' would result in way more complaints than the spurious untidy error text.
Anyway the hack will auto-apply the 'lx' command....(safe option) which may still displease some users as they may need to manually reissue 'lo' anyway
Uploaded Hotfix v3.06 Github md5=4bd9b8ad9059d14720c72952752cc67d
Updated to the minor version increment and spurious untidy error text is indeed gone. Thanks for identifying and resolving so quickly.
Having read through this full thread in the past several days, I did want to mention that I am also not seeing scribe from advanced options.
Yesterday, my router decided to go back to vanilla defaults for some reason, so I took the opportunity to format jffs and the flash drive to have a clean install. I have the following loaded from amtm (entware, Skynet (incl. 2GB swap), scribe (incl. uiScribe), unbound manager, nsrum, conmon, scMerlin, spdMerlin, and YaziFi added last). From the first install of unbound manager, scribe was notably missing from the advanced options, although it was already installed along with Skynet. Not sure why, but figured I pass along the information in case you were looking for a clean install validation of it being notably absent.
Having read through this full thread in the past several days, I did want to mention that I am also not seeing scribe from advanced options.
Yesterday, my router decided to go back to vanilla defaults for some reason, so I took the opportunity to format jffs and the flash drive to have a clean install. I have the following loaded from amtm (entware, Skynet (incl. 2GB swap), scribe (incl. uiScribe), unbound manager, nsrum, conmon, scMerlin, spdMerlin, and YaziFi added last). From the first install of unbound manager, scribe was notably missing from the advanced options, although it was already installed along with Skynet. Not sure why, but figured I pass along the information in case you were looking for a clean install validation of it being notably absent.
tomsk
Very Senior Member
i notice that using the "include" directive we can drop extra bits of configuration into the unbound config file ( similar to the way scribe drops additional config files into the syslog-ng conf).
Would there be any mileage in having a very basic config file and the customisations in an additional file... although i guess the unbound.conf.add is doing a similar thing.
Would there be any mileage in having a very basic config file and the customisations in an additional file... although i guess the unbound.conf.add is doing a similar thing.
Code:
Files can be included using the include: directive. It can appear any-
where, it accepts a single file name as argument. Processing continues
as if the text from the included file was copied into the config file
at that point. If also using chroot, using full path names for the
included files works, relative pathnames for the included names work if
the directory where the daemon is started equals its chroot/working
directory or is specified before the include statement with directory:
dir. Wildcards can be used to include multiple files, see glob(7).Martineau
Part of the Furniture
It was on my list to fix, but simply forgot to prioritise it for the formal v3.09 release, but I'll address it tomorrow.
However, in the interim you can always execute the 'scribe' command even if it is not actually visible on the screen.
Last edited:
SomeWhereOverTheRainBow
Part of the Furniture
I am curious about
Code:
val-override-date: <rrsig-style date spec>
Default is "" or "0", which disables this debugging feature. If enabled by giving a RRSIG style date, that date is used for verifying RRSIG inception and expiration dates, instead of the current date. Do not set this unless you are debugging signature inception and expiration. The value -1 ignores the date altogether, useful for some special applications.would setting this to -1 overide the need to validate date and "time" on dnssec signatures? this may be benefit the whole "oh no my clock didn't set". what are your thoughts? @dave14305 @Martineau
I was able to do so; desire is to have minimal logging in Scribe to show that it is functioning as expected, though relying primarily on the Add-on page to confirm along with stats in SSH.
Not sure if you may know why, but I have not seen a single DNS Filtering hit over the 2 days before the greenfield install or in the day since. Perhaps this is expected behavior, though I'm not sure if there is some way to validate that it is indeed functioning as expected. It may be due to using a VPN with DNS set to Disabled, but Unbound shows to be working as expected with an above 90% hit rate and significant Ad-Block rate. Digging from Ubuntu on W10 also shows an initial response higher than the near 0ms second response.
Xentrk
Part of the Furniture
I have standardized on using the "true" command rather than "touch" to create files in my shell scripts this past year.
Code:
<snip>
true >"$VPNC_UP_FILE"
{
printf '%s\n' "#!/bin/sh"
printf '%s\n' "$IPTABLES_ENTRY"
} >"$VPNC_UP_FILE"
chmod 755 "$VPNC_UP_FILE"
logger -st "($(basename "$0"))" $$ "$IPTABLES_ENTRY added to $VPNC_UP_FILE"
fi
doneYes, I did this with my own Unbound implementation. If ntp_ready = 0, then add val-override-date: -1 to unbound.conf. Once ntp is synced (I set a service-event trigger for "restart_diskmon"), restart Unbound without val-override-date. I stole this idea from OpenWRT.
SomeWhereOverTheRainBow
Part of the Furniture
I can see it as highly beneficial.
SomeWhereOverTheRainBow
Part of the Furniture
why would you run it as a daemon? ( not saying you shouldn't, just want clarification as we are running this on a router). Does it use less system resources or more or no difference?
(i figured it is more for using the unbound control features.)
juched
Very Senior Member
Interesting, could graph cache size over time. Hmm
juched
Very Senior Member
Not sure why you are getting stats from unbound like that. I am always around 91%.
joe scian
Very Senior Member
Agreed I think Kernol is the only one with this problem?
Similar threads
Similar threads
Similar threads
-
Unbound Force all DNS requests through Unbound using iptables?- Started by muffintastic
- Replies: 14
-
-
-
-
-
-
Is it possible to use nord dns with unbound or any way to add it?- Started by Jack-Sparr0w
- Replies: 9
-
-
Unbound Use unbound/router as default DNS server
- Started by BeachGuy
- Replies: 2
-