Unbound Version - nutzt jemand 1.26?

[Avenger84]

Ich nutze Unbound auf Ubuntu 24.04: "1.19.2-1ubuntu3.9".
Nun habe ich zufällig gesehen, dass es offiziell schon 1.26 gibt, aber es gibt keine Repo und der Docker ist noch älter.
KI hat mir eine lustige Anleitung erstellt, aber da lasse ich lieber die Finger von.
Daher die Frage: Nutzt hier Jemand die aktuelle Unbound Version? Wenn ja wie?

Spoiler: KI Anleitung

Selbst kompilieren, aber mit denselben Pfaden wie das apt-Paket (--prefix=/usr --sysconfdir=/etc), damit deine bestehende /etc/unbound/unbound.conf und der vorhandene systemd-Unit unverändert weiterlaufen. Wichtig dabei: der mitgelieferte systemd-Unit nutzt Type=notify, was ohne einen mit --enable-systemd kompilierten Unbound zu einem hängenden bzw. fehlschlagenden Service-Start führt – dafür brauchst du libsystemd-dev. archlinuxarchlinux

Build-Abhängigkeiten:

bash
sudo apt install -y build-essential libssl-dev libexpat1-dev bison flex libsystemd-dev pkg-config

Quelle holen und Prüfsumme checken:


bash
mkdir -p ~/build && cd ~/build
wget https://nlnetlabs.nl/downloads/unbound/unbound-1.26.0.tar.gz
wget https://nlnetlabs.nl/downloads/unbound/unbound-1.26.0.tar.gz.sha256
sha256sum -c unbound-1.26.0.tar.gz.sha256
tar xzf unbound-1.26.0.tar.gz
cd unbound-1.26.0

Konfigurieren, bauen, installieren (überschreibt nur die Binaries, Config/Unit bleiben unangetastet):


bash
./configure --prefix=/usr --sysconfdir=/etc --enable-systemd
make -j$(nproc)
sudo make install

Testen und neu starten:


bash
unbound -V # sollte 1.26.0 zeigen
sudo unbound-checkconf # prüft, ob deine Config mit dem neuen Build kompatibel ist
sudo systemctl restart unbound
systemctl status unbound

Ein Punkt, den man leicht übersieht: dpkg weiß nichts von dem manuellen Build. Ein künftiges apt upgrade würde die Binary sonst irgendwann wieder auf 1.19.2 zurücksetzen, ohne dass es auffällt. Dagegen hilft:


bash
sudo apt-mark hold unbound

Damit fasst apt das Paket nicht mehr an, und du wiederholst den Build manuell, sobald NLnet Labs die nächste Version released.

Falls deine unbound.conf Optionen wie dnstap:, cachedb: oder Python-Module nutzt (im Ubuntu-Paket standardmäßig aktiv), brauchst du zusätzlich --enable-dnstap, --enable-cachedb --with-libhiredis bzw. --with-pythonmodule --with-pyunbound samt der passenden -dev-Pakete – sonst bricht unbound-checkconf bei diesen Zeilen ab.

edit, sehe gerade dass es doch einen 1.26 Docker gibt: https://hub.docker.com/layers/klutchell/unbound/1.26.0
nutzt ihr den?

 

[norKoeri]

Bist Du wild auf die Versionsnummer, hast Du Angst wegen einem Security-Patch oder brauchst Du eine der neuen Funktionen aus jenem Software-Branch? Soweit ich das auf den ersten Blick sehe – bitte selbständig prüfen –, patcht Ubuntu das Package aktiv, also versorgt es mit Security-Patches. Daher sind die beiden ersten Themen egal. Wenn Du eine bestimmte Funktionalität brauchst, würde ich erstmal auf Ubuntu 26.04 LTS hochgehen und so Unbound 1.24 bekommen. Reicht das?

 

[redjack1000]

Nutzt hier Jemand die aktuelle Unbound Version?

Ja mit OPNSense

CU
redjack

 

[Avenger84]

Ich wollte tatsächlich demnächst auf 26.04 updaten, das ist ein super Tipp.

 

[CoMo]

Daher die Frage: Nutzt hier Jemand die aktuelle Unbound Version? Wenn ja wie?

Ja, mit DietPi.

unbound/trixie,now 1.26.0-dietpi1 amd64 [installed]
  validating, recursive, and caching DNS resolver

root@unbound:~# apt info unbound
Package: unbound
Version: 1.26.0-dietpi1
Priority: optional
Section: net
Maintainer: MichaIng <micha@dietpi.com>
Installed-Size: 4.825 kB
Depends: libc6 (>= 2.41-12+deb13u3), libsystemd0 (>= 257.13-1~deb13u1), libssl3t64 (>= 3.5.6-1~deb13u2), libevent-2.1-7t64 (>= 2.1.12-stable-10), libnghttp2-14 (>= 1.64.0-1.1+deb13u1), libprotobuf-c1 (>= 1.5.1-1), dns-root-data (>= 2025080400~deb13u1), libhiredis1.1.0 (>= 1.2.0-6)
Homepage: https://www.unbound.net/
Date: Tue, 04 Aug 2026 10:24:44 +0000
Download-Size: 852 kB
APT-Manual-Installed: yes
APT-Sources: https://dietpi.com/apt trixie/main amd64 Packages
Description: validating, recursive, and caching DNS resolver

Notice: There are 6 additional records. Please use the '-a' switch to see them.
root@unbound:~#

 

[Derduke]

hier auch mit Dietpi

hier auch meine frage nach Relevanz?
Die 1.19.2-1buntu3.9 hat doch Sicherheits fixes nur keine Feature bekommen

 

[Avenger84]

Relevanz: unrelevant

ich überlege, PiHole und Unbound von meiner VM als Docker direkt in Unraid zu ziehen.
Im Unraid App Store ist nur ein völlig überalterter Unbound Docker, daher habe ich jetzt als erstes mir per Hand den klutchell/unbound geladen.

 

[Sensei21]

1.26 enthält eine schöne Menge an Fixes, läuft soweit hier - erst kürzlich installiert, danke für den Hinweis

 

[Avenger84]

Ich bin gerade dabei meine config zu überarbeiten.
Vorher Unbound 1.19.2 von Ubuntu (nicht Docker) mit:

Spoiler: alte Config

server:
    interface: 127.0.0.1
    interface: ::1
    port: 5335
    do-ip4: yes
    do-ip6: yes
    do-udp: yes
    do-tcp: yes
    prefer-ip6: yes
    access-control: 127.0.0.0/8 allow
    access-control: ::1 allow
    root-hints: "/var/lib/unbound/root.hints"
    val-clean-additional: yes
    harden-dnssec-stripped: yes
    use-caps-for-id: no
    module-config: "validator iterator"
    # Cache-Poisoning-Härtung
    harden-referral-path: yes
    harden-below-nxdomain: yes
    harden-glue: yes
    qname-minimisation: yes
    unwanted-reply-threshold: 10000
    # Logging (nur Warnungen)
    verbosity: 1
    #log-queries: yes
    #log-replies: yes
    #log-servfail: yes
    #log-local-actions: yes
    # Performance: Cache-Optimierung
    # cache-min-ttl: 3600
    cache-max-ttl: 86400
    msg-cache-size: 100m
    rrset-cache-size: 200m
    num-threads: 2
    msg-cache-slabs: 2
    rrset-cache-slabs: 2
    infra-cache-slabs: 2
    key-cache-slabs: 2
    # Prefetching: Häufig genutzte Domains werden aktiv erneuert
    prefetch: yes
    prefetch-key: yes
    # EDNS und UDP Buffer optimieren
    edns-buffer-size: 1232
    so-rcvbuf: 1m
    so-sndbuf: 1m
    # Sicherheit
    hide-identity: yes
    hide-version: yes
    identity: "localhost"
    version: "not disclosed"
    private-address: 10.0.0.0/8
    private-address: 172.16.0.0/12
    private-address: 192.168.0.0/16
    private-address: 169.254.0.0/16
    private-address: 192.0.2.0/24
    private-address: 198.51.100.0/24
    private-address: 203.0.113.0/24
    private-address: 255.255.255.255/32
    private-address: fd00::/8
    private-address: fe80::/10
    private-address: 2001:db8::/32

Dann habe ich alles mögliche was schon in der Standard Config* definiert ist raus genommen und dann weiter geprüft welche Optionen nicht in der Config stehen, aber dennoch aktiviert sind wie z.B.

docker exec unbound unbound-checkconf -o harden-below-nxdomain

yes <- also auch entfernt aus der custom.conf

Übergeblieben ist eine seeehr schlanke custom.conf:

server:
    prefer-ip6: yes
    harden-referral-path: yes
    unwanted-reply-threshold: 10000
    hide-identity: yes
    hide-version: yes
    identity: "localhost"
    version: "not disclosed"

Jetzt würde ich gern noch mit euch "vergleichen".

* Standard Config vom Unbound Docker 1.26:

Spoiler: Standard Config

server:
    # Enable or disable whether the unbound server forks into the background
    # as a daemon. Default is yes.
    do-daemonize: no

    # If given, after binding the port the user privileges are dropped.
    # Default is "unbound". If you give username: "" no user change is performed.
    username: "unbound"

    # No need to chroot as this container has been stripped of all other binaries.
    chroot: ""

    # If "" is given, logging goes to stderr, or nowhere once daemonized.
    logfile: ""

    # The process id is written to the file. Not required since we are running
    # in a container with one process.
    pidfile: ""

    # The verbosity number, level 0 means no verbosity, only errors.
    # Level 1 gives operational information.
    # Level 2 gives detailed operational information.
    # Level 3 gives query level information, output per query.
    # Level 4 gives algorithm level information.
    # Level 5 logs client identification for cache misses.
    # Default is level 1. The verbosity can also be increased from the commandline.
    verbosity: 1

    # Specify the interfaces to answer queries from by ip-address.
    # The default is to listen to localhost (127.0.0.1 and ::1).
    # specify 0.0.0.0 and ::0 to bind to all available interfaces.
    # specify every interface[@port] on a new 'interface:' labelled line.
    interface: 0.0.0.0

    do-ip4: yes
    do-udp: yes
    do-tcp: yes

    # You want to leave this to no unless you have *native* IPv6. With 6to4 and
    # Terredo tunnels your web browser should favor IPv4 for the same reasons
    prefer-ip6: no

    # Trust glue only if it is within the server's authority
    harden-glue: yes

    # Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS
    harden-dnssec-stripped: yes

    # Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes
    # see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details
    use-caps-for-id: no

    # Reduce EDNS reassembly buffer size (see also https://docs.pi-hole.net/guides/dns/unbound/ )
    # IP fragmentation is unreliable on the Internet today, and can cause
    # transmission failures when large DNS messages are sent via UDP. Even
    # when fragmentation does work, it may not be secure; it is theoretically
    # possible to spoof parts of a fragmented DNS message, without easy
    # detection at the receiving end. Recently, there was an excellent study
    # >>> Defragmenting DNS - Determining the optimal maximum UDP response size for DNS <<<
    # by Axel Koolhaas, and Tjeerd Slokker (https://indico.dns-oarc.net/event/36/contributions/776/)
    # in collaboration with NLnet Labs explored DNS using real world data from the
    # the RIPE Atlas probes and the researchers suggested different values for
    # IPv4 and IPv6 and in different scenarios. They advise that servers should
    # be configured to limit DNS messages sent over UDP to a size that will not
    # trigger fragmentation on typical network links. DNS servers can switch
    # from UDP to TCP when a DNS response is too big to fit in this limited
    # buffer size. This value has also been suggested in DNS Flag Day 2020.
    edns-buffer-size: 1232

    # Perform prefetching of close to expired message cache entries
    # This only applies to domains that have been frequently queried
    prefetch: yes

    # Fetch DS records earlier (DNSSEC): more cpu usage, less latency
    prefetch-key: yes

    # One thread should be sufficient, can be increased on beefy machines.
    # In reality for most users running on small networks or on a single machine,
    # it should be unnecessary to seek performance enhancement by increasing num-threads above 1.
    num-threads: 1

    # Ensure kernel buffer is large enough to not lose messages in traffic spikes
    # (requires CAP_NET_ADMIN or privileged)
    # so-rcvbuf: 1m

    # Set to 0 to use system default and avoid startup warnings
    so-sndbuf: 0

    # Increase cache size to utilize more RAM
    msg-cache-size: 64m
    rrset-cache-size: 128m

    # This attempts to reduce latency by serving the outdated record before
    # updating it instead of the other way around
    # Default: cache-min-ttl: 0
    serve-expired: yes

    # Limit serving of expired responses to configured seconds after expiration. 0 means disabled
    # A suggested value per RFC 8767 is between 86400 (1 day) and 259200 (3 days).
    serve-expired-ttl: 86400

    # Time in milliseconds before replying to the client with expired data
    # A recommended value per RFC 8767 is 1800
    serve-expired-client-timeout: 1800

    # The netblock is given as an IP4 or IP6 address with /size appended for a
    # classless network block. The action can be deny, refuse, allow or allow_snoop.
    access-control: 127.0.0.0/8 allow
    access-control: 192.168.0.0/16 allow
    access-control: 172.16.0.0/12 allow
    access-control: 10.0.0.0/8 allow

    # Ensure privacy of local IP ranges
    private-address: 192.168.0.0/16
    private-address: 169.254.0.0/16
    private-address: 172.16.0.0/12
    private-address: 10.0.0.0/8
    private-address: fd00::/8
    private-address: fe80::/10

    # Read  the  root  hints from this file. Default is nothing, using built in
    # hints for the IN class. The file has the format of  zone files,  with  root
    # nameserver  names  and  addresses  only. The default may become outdated,
    # when servers change,  therefore  it is good practice to use a root-hints
    # file.  get one from https://www.internic.net/domain/named.root
    root-hints: root.hints

    # File with trust anchor for one zone, which is tracked with RFC5011 probes.
    # The probes are several times per month, thus the machine must be online frequently.
    # The initial file can be one with contents as described in trust-anchor-file.
    # The file is written to when the anchor is updated, so the unbound user must
    # have write permission.
    auto-trust-anchor-file: root.key

    # Number of ports to open. This number of file descriptors can be opened per thread.
    # Must be at least 1. Default depends on compile options. Larger numbers need extra
    # resources from the operating system. For performance a very large value is best,
    # use libevent to make this possible.
    outgoing-range: 8192

    # The number of queries that every thread will service simultaneously. If more queries
    # arrive that need servicing, and no queries can be jostled out (see jostle-timeout),
    # then the queries are dropped. This forces the client to resend after a timeout;
    # allowing the server time to work on the existing queries. Default depends on
    # compile options, 512 or 1024.
    num-queries-per-thread: 4096

    # If  null or "", no file is used.  Set it to the certificate bun-
    # dle file, for example "/etc/pki/tls/certs/ca-bundle.crt".  These
    # certificates  are  used  for  authenticating connections made to
    # outside peers.  For example auth-zone urls, and  also  DNS  over
    # TLS  connections.  It is read at start up before permission drop
    # and chroot.
    tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt

# Allow custom configuration to override the settings above
include-toplevel: /etc/unbound/custom.conf.d/*.conf

Ergänzung (Mittwoch um 15:03)

Edit: habe noch Statistiken aktiviert:

server:
    prefer-ip6: yes
    harden-referral-path: yes
    unwanted-reply-threshold: 10000
    hide-identity: yes
    hide-version: yes
    identity: "localhost"
    version: "not disclosed"
    extended-statistics: yes
    statistics-cumulative: yes

remote-control:
    control-enable: yes
    control-use-cert: no