d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Prevent resolvconf from updating /etc/resolv.conf. As Jakob Schlyter

Browse Source 
pointed out, having additional nameservers listed in /etc/resolv.conf
can break DNSSEC verification by providing a false positive if unbound
returns SERVFAIL due to an invalid signature.  The downside is that
the domain / search path won't get updated either, but we can live
with that.

Approved by:	re (blanket)
This commit is contained in:
des 2013-09-23 20:06:59 +00:00
parent ff52db8211
commit 0f8f840670
1 changed files with 3 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
usr.sbin/unbound/local-setup/local-unbound-setup.sh
View File

@ -156,14 +156,12 @@ gen_resolv_conf() {
#
gen_resolvconf_conf() {
echo "# Generated by $self"
echo "name_servers=\"127.0.0.1\""
echo "resolv_conf_options=\"edns0\""
echo "resolv_conf=\"/dev/null\" # prevent updating ${resolv_conf}"
echo "unbound_conf=\"${forward_conf}\""
echo "unbound_pid=\"${pidfile}\""
echo "unbound_service=\"${service}\""
# resolvconf(8) likes to restart rather than reload - consider
# forcing its hand?
#echo "unbound_restart=\"service ${service} reload\""
# resolvconf(8) likes to restart rather than reload
echo "unbound_restart=\"service ${service} reload\""
}
#