Unbound-1.25.1

#### Beyond Linux® From Scratch (System V Edition) - Version r13.0-1090

### Chapter 23. Other Server Software

- Prev

  OpenLDAP-2.6.13

- Next

  Graphical Components

- Up
- Home

# Unbound-1.25.1

## Introduction to Unbound

Unbound is a validating, recursive, and caching DNS resolver. It is designed as a set of modular components that incorporate modern features, such as enhanced security (DNSSEC) validation, Internet Protocol Version 6 (IPv6), and a client resolver library API as an integral part of the architecture.

### Note

Development versions of BLFS may not build or run some packages properly if LFS or dependencies have been updated since the most recent stable versions of the books.

### Package Information

- Download (HTTP): https://nlnetlabs.nl/downloads/unbound/unbound-1.25.1.tar.gz

- Download MD5 sum: dce631cc8c882ebc707dade27e7fe6f3

- Download size: 6.6 MB

- Estimated disk space required: 196 MB (with docs; add 11 MB for tests)

- Estimated build time: 0.3 SBU (Using parallelism=4; with docs; add 0.1 SBU for tests)

### Additional Downloads

- Required patch: https://www.linuxfromscratch.org/patches/blfs/svn/unbound-1.25.1-openssl4-1.patch

### Unbound Dependencies

#### Optional

libevent-2.1.13, Nettle-4.0, Protobuf-c-1.5.2 (for dnstap), sphinx-9.1.0 (for Python bindings documentation), SWIG-4.4.1 (for Python bindings), Doxygen-1.17.0 (for html documentation), dnstap, and Python2

## Installation of Unbound

There should be a dedicated user and group to take control of the unbound daemon after it is started. Issue the following commands as the `root` user:

    groupadd -g 88 unbound &&
    useradd -c "Unbound DNS Resolver" -d /var/lib/unbound -u 88 \
            -g unbound -s /bin/false unbound

Make the package compatible with OpenSSL-4 by applying a patch:

    patch -Np1 -i ../unbound-1.25.1-openssl4-1.patch

Install Unbound by running the following commands:

    ./configure --prefix=/usr     \
                --sysconfdir=/etc \
                --disable-static  \
                --with-pidfile=/run/unbound.pid &&
    make

If you have Doxygen-1.17.0 package installed and want to build html documentation, run the following command:

    make doc

To test the results, issue make check.

Now, as the `root` user:

    make install &&
    mv -v /usr/sbin/unbound-host /usr/bin/

If you built the documentation, install it by running the following commands as the `root` user:

    install -v -m755 -d /usr/share/doc/unbound-1.25.1 &&
    install -v -m644 doc/html/* /usr/share/doc/unbound-1.25.1

## Command Explanations

`--disable-static`: This switch prevents installation of static versions of the libraries.

`--with-libevent`: This option enables libevent support, which allows for the use of large outgoing port ranges.

`--with-pyunbound`: This option enables building the Python bindings. If you want to build the bindings, you also need to pass the `PYTHON_VERSION=3.14` environment variable to configure.

## Configuring Unbound

### Config Files

`/etc/unbound/unbound.conf`

### Configuration Information

In the default configuration, unbound will bind to localhost (127.0.0.1 IP address) and allow recursive queries only from localhost clients. If you want to use unbound for local DNS resolution, run the following command as the `root` user:

    echo "nameserver 127.0.0.1" > /etc/resolv.conf

For advanced configuration, view the `/etc/unbound/unbound.conf` file and the installed or online documentation.

When Unbound is installed, some package builds fail if the file `/etc/unbound/root.key` is not found. This file is created by running the boot script (install instructions below). Alternatively, it can be created by running the following command as the `root` user:

    unbound-anchor

### Boot Script

If you want the Unbound server to start automatically when the system is booted, install the `/etc/rc.d/init.d/unbound` init script included in the blfs-bootscripts-20251220 package:

    make install-unbound

## Contents

Installed Programs: unbound, unbound-anchor, unbound-checkconf, unbound-control, unbound-control-setup, and unbound-host
Installed Library: libunbound.so
Installed Directories: /etc/unbound and /usr/share/doc/unbound-1.25.1 (optional)

### Short Descriptions

unbound | is a DNS resolver daemon
unbound-anchor | initializes or updates the root trust anchor for DNSSEC validation
unbound-checkconf | checks the unbound configuration file for syntax and other errors
unbound-control | performs remote administration on the unbound DNS resolver
unbound-control-setup | generates a self-signed certificate and private keys for the server and client
unbound-host | is a DNS lookup utility similar to host from BIND Utilities-9.20.24
`libunbound.so` | provides the Unbound API functions to programs

- Prev

  OpenLDAP-2.6.13

- Next

  Graphical Components

- Up
- Home