diff options
| author | des <des@FreeBSD.org> | 2013-09-23 20:06:59 +0000 |
|---|---|---|
| committer | des <des@FreeBSD.org> | 2013-09-23 20:06:59 +0000 |
| commit | 0f8f840670a0d35203600fb99b86013beb6c00eb (patch) | |
| tree | dad1b185fb3066fe3114c2afce467b93f0213d9b /usr.sbin/unbound | |
| parent | ff52db8211aeda98e79c8dde663aae3ea5d12dd0 (diff) | |
| download | FreeBSD-src-0f8f840670a0d35203600fb99b86013beb6c00eb.zip FreeBSD-src-0f8f840670a0d35203600fb99b86013beb6c00eb.tar.gz | |
Prevent resolvconf from updating /etc/resolv.conf. As Jakob Schlyter
pointed out, having additional nameservers listed in /etc/resolv.conf
can break DNSSEC verification by providing a false positive if unbound
returns SERVFAIL due to an invalid signature. The downside is that
the domain / search path won't get updated either, but we can live
with that.
Approved by: re (blanket)
Diffstat (limited to 'usr.sbin/unbound')
| -rwxr-xr-x | usr.sbin/unbound/local-setup/local-unbound-setup.sh | 8 |
1 files changed, 3 insertions, 5 deletions
diff --git a/usr.sbin/unbound/local-setup/local-unbound-setup.sh b/usr.sbin/unbound/local-setup/local-unbound-setup.sh index 9996df5..99c9324 100755 --- a/usr.sbin/unbound/local-setup/local-unbound-setup.sh +++ b/usr.sbin/unbound/local-setup/local-unbound-setup.sh @@ -156,14 +156,12 @@ gen_resolv_conf() { # gen_resolvconf_conf() { echo "# Generated by $self" - echo "name_servers=\"127.0.0.1\"" - echo "resolv_conf_options=\"edns0\"" + echo "resolv_conf=\"/dev/null\" # prevent updating ${resolv_conf}" echo "unbound_conf=\"${forward_conf}\"" echo "unbound_pid=\"${pidfile}\"" echo "unbound_service=\"${service}\"" - # resolvconf(8) likes to restart rather than reload - consider - # forcing its hand? - #echo "unbound_restart=\"service ${service} reload\"" + # resolvconf(8) likes to restart rather than reload + echo "unbound_restart=\"service ${service} reload\"" } # |
