|
|
@@ -0,0 +1,154 @@
|
|
|
1
|
+--- a/doc/example.conf.in
|
|
|
2
|
|
|
|
3
|
+@@ -38,6 +38,8 @@ server:
|
|
|
4
|
+ # interface: 192.0.2.154
|
|
|
5
|
+ # interface: 192.0.2.154@5003
|
|
|
6
|
+ # interface: 2001:DB8::5
|
|
|
7
|
++ interface: 0.0.0.0
|
|
|
8
|
++ interface: ::0
|
|
|
9
|
+
|
|
|
10
|
+ # enable this feature to copy the source address of queries to reply.
|
|
|
11
|
+ # Socket options are not supported on all platforms. experimental.
|
|
|
12
|
+@@ -57,6 +59,7 @@ server:
|
|
|
13
|
+ # port range that can be open simultaneously. About double the
|
|
|
14
|
+ # num-queries-per-thread, or, use as many as the OS will allow you.
|
|
|
15
|
+ # outgoing-range: 4096
|
|
|
16
|
++ outgoing-range: 60
|
|
|
17
|
+
|
|
|
18
|
+ # permit unbound to use this port number or port range for
|
|
|
19
|
+ # making outgoing queries, using an outgoing interface.
|
|
|
20
|
+@@ -73,9 +76,11 @@ server:
|
|
|
21
|
+
|
|
|
22
|
+ # number of outgoing simultaneous tcp buffers to hold per thread.
|
|
|
23
|
+ # outgoing-num-tcp: 10
|
|
|
24
|
++ outgoing-num-tcp: 1
|
|
|
25
|
+
|
|
|
26
|
+ # number of incoming simultaneous tcp buffers to hold per thread.
|
|
|
27
|
+ # incoming-num-tcp: 10
|
|
|
28
|
++ incoming-num-tcp: 1
|
|
|
29
|
+
|
|
|
30
|
+ # buffer size for UDP port 53 incoming (SO_RCVBUF socket option).
|
|
|
31
|
+ # 0 is system default. Use 4m to catch query spikes for busy servers.
|
|
|
32
|
+@@ -99,18 +104,22 @@ server:
|
|
|
33
|
+ # buffer size for handling DNS data. No messages larger than this
|
|
|
34
|
+ # size can be sent or received, by UDP or TCP. In bytes.
|
|
|
35
|
+ # msg-buffer-size: 65552
|
|
|
36
|
++ msg-buffer-size: 8192
|
|
|
37
|
+
|
|
|
38
|
+ # the amount of memory to use for the message cache.
|
|
|
39
|
+ # plain value in bytes or you can append k, m or G. default is "4Mb".
|
|
|
40
|
+ # msg-cache-size: 4m
|
|
|
41
|
++ msg-cache-size: 100k
|
|
|
42
|
+
|
|
|
43
|
+ # the number of slabs to use for the message cache.
|
|
|
44
|
+ # the number of slabs must be a power of 2.
|
|
|
45
|
+ # more slabs reduce lock contention, but fragment memory usage.
|
|
|
46
|
+ # msg-cache-slabs: 4
|
|
|
47
|
++ msg-cache-slabs: 1
|
|
|
48
|
+
|
|
|
49
|
+ # the number of queries that a thread gets to service.
|
|
|
50
|
+ # num-queries-per-thread: 1024
|
|
|
51
|
++ num-queries-per-thread: 30
|
|
|
52
|
+
|
|
|
53
|
+ # if very busy, 50% queries run to completion, 50% get timeout in msec
|
|
|
54
|
+ # jostle-timeout: 200
|
|
|
55
|
+@@ -121,11 +130,13 @@ server:
|
|
|
56
|
+ # the amount of memory to use for the RRset cache.
|
|
|
57
|
+ # plain value in bytes or you can append k, m or G. default is "4Mb".
|
|
|
58
|
+ # rrset-cache-size: 4m
|
|
|
59
|
++ rrset-cache-size: 100k
|
|
|
60
|
+
|
|
|
61
|
+ # the number of slabs to use for the RRset cache.
|
|
|
62
|
+ # the number of slabs must be a power of 2.
|
|
|
63
|
+ # more slabs reduce lock contention, but fragment memory usage.
|
|
|
64
|
+ # rrset-cache-slabs: 4
|
|
|
65
|
++ rrset-cache-slabs: 1
|
|
|
66
|
+
|
|
|
67
|
+ # the time to live (TTL) value lower bound, in seconds. Default 0.
|
|
|
68
|
+ # If more than an hour could easily give trouble due to stale data.
|
|
|
69
|
+@@ -143,9 +154,11 @@ server:
|
|
|
70
|
+ # the number of slabs must be a power of 2.
|
|
|
71
|
+ # more slabs reduce lock contention, but fragment memory usage.
|
|
|
72
|
+ # infra-cache-slabs: 4
|
|
|
73
|
++ infra-cache-slabs: 1
|
|
|
74
|
+
|
|
|
75
|
+ # the maximum number of hosts that are cached (roundtrip, EDNS, lame).
|
|
|
76
|
+ # infra-cache-numhosts: 10000
|
|
|
77
|
++ infra-cache-numhosts: 200
|
|
|
78
|
+
|
|
|
79
|
+ # Enable IPv4, "yes" or "no".
|
|
|
80
|
+ # do-ip4: yes
|
|
|
81
|
+@@ -178,6 +191,8 @@ server:
|
|
|
82
|
+ # access-control: ::0/0 refuse
|
|
|
83
|
+ # access-control: ::1 allow
|
|
|
84
|
+ # access-control: ::ffff:127.0.0.1 allow
|
|
|
85
|
++ access-control: 0.0.0.0/0 allow
|
|
|
86
|
++ access-control: ::0/0 allow
|
|
|
87
|
+
|
|
|
88
|
+ # if given, a chroot(2) is done to the given directory.
|
|
|
89
|
+ # i.e. you can chroot to the working directory, for example,
|
|
|
90
|
+@@ -208,6 +223,7 @@ server:
|
|
|
91
|
+ # and the given username is assumed. Default is user "unbound".
|
|
|
92
|
+ # If you give "" no privileges are dropped.
|
|
|
93
|
+ # username: "@UNBOUND_USERNAME@"
|
|
|
94
|
++ username: ""
|
|
|
95
|
+
|
|
|
96
|
+ # the working directory. The relative files in this config are
|
|
|
97
|
+ # relative to this directory. If you give "" the working directory
|
|
|
98
|
+@@ -230,10 +246,12 @@ server:
|
|
|
99
|
+
|
|
|
100
|
+ # the pid file. Can be an absolute path outside of chroot/work dir.
|
|
|
101
|
+ # pidfile: "@UNBOUND_PIDFILE@"
|
|
|
102
|
++ pidfile: "/var/run/unbound.pid"
|
|
|
103
|
+
|
|
|
104
|
+ # file to read root hints from.
|
|
|
105
|
+ # get one from ftp://FTP.INTERNIC.NET/domain/named.cache
|
|
|
106
|
+ # root-hints: ""
|
|
|
107
|
++ root-hints: "/etc/unbound/named.cache"
|
|
|
108
|
+
|
|
|
109
|
+ # enable to not answer id.server and hostname.bind queries.
|
|
|
110
|
+ # hide-identity: no
|
|
|
111
|
+@@ -256,12 +274,15 @@ server:
|
|
|
112
|
+ # positive value: fetch that many targets opportunistically.
|
|
|
113
|
+ # Enclose the list of numbers between quotes ("").
|
|
|
114
|
+ # target-fetch-policy: "3 2 1 0 0"
|
|
|
115
|
++ target-fetch-policy: "2 1 0 0 0 0"
|
|
|
116
|
+
|
|
|
117
|
+ # Harden against very small EDNS buffer sizes.
|
|
|
118
|
+ # harden-short-bufsize: no
|
|
|
119
|
++ harden-short-bufsize: yes
|
|
|
120
|
+
|
|
|
121
|
+ # Harden against unseemly large queries.
|
|
|
122
|
+ # harden-large-queries: no
|
|
|
123
|
++ harden-large-queries: yes
|
|
|
124
|
+
|
|
|
125
|
+ # Harden against out of zone rrsets, to avoid spoofing attempts.
|
|
|
126
|
+ # harden-glue: yes
|
|
|
127
|
+@@ -342,7 +363,7 @@ server:
|
|
|
128
|
+ # you start unbound (i.e. in the system boot scripts). And enable:
|
|
|
129
|
+ # Please note usage of unbound-anchor root anchor is at your own risk
|
|
|
130
|
+ # and under the terms of our LICENSE (see that file in the source).
|
|
|
131
|
+- # auto-trust-anchor-file: "@UNBOUND_ROOTKEY_FILE@"
|
|
|
132
|
++ auto-trust-anchor-file: "@UNBOUND_ROOTKEY_FILE@"
|
|
|
133
|
+
|
|
|
134
|
+ # File with DLV trusted keys. Same format as trust-anchor-file.
|
|
|
135
|
+ # There can be only one DLV configured, it is trusted from root down.
|
|
|
136
|
+@@ -428,15 +449,18 @@ server:
|
|
|
137
|
+ # the amount of memory to use for the key cache.
|
|
|
138
|
+ # plain value in bytes or you can append k, m or G. default is "4Mb".
|
|
|
139
|
+ # key-cache-size: 4m
|
|
|
140
|
++ key-cache-size: 100k
|
|
|
141
|
+
|
|
|
142
|
+ # the number of slabs to use for the key cache.
|
|
|
143
|
+ # the number of slabs must be a power of 2.
|
|
|
144
|
+ # more slabs reduce lock contention, but fragment memory usage.
|
|
|
145
|
+ # key-cache-slabs: 4
|
|
|
146
|
++ key-cache-slabs: 1
|
|
|
147
|
+
|
|
|
148
|
+ # the amount of memory to use for the negative cache (used for DLV).
|
|
|
149
|
+ # plain value in bytes or you can append k, m or G. default is "1Mb".
|
|
|
150
|
+ # neg-cache-size: 1m
|
|
|
151
|
++ neg-cache-size: 10k
|
|
|
152
|
+
|
|
|
153
|
+ # By default, for a number of zones a small default 'nothing here'
|
|
|
154
|
+ # reply is built-in. Query traffic is thus blocked. If you
|
Michael Hanselmann
10 år sedan